Communication data encryption method and device, electronic equipment, storage medium and program product

Abstract

The invention discloses a communication data encryption method and device, electronic equipment, a storage medium and a program product, belongs to the technical field of communication, and is used for improving the encryption efficiency of communication data. The method comprises the steps that a digital envelope is processed through a super SIM card, a first secret key is obtained, and the digital envelope is sent by a server; exporting the first key from the super SIM card, and generating a second key according to the first key and a first random number; and encrypting communication data for communicating with the server through the second key.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and specifically relates to a communication data encryption method, device, electronic device, storage medium and program product. Background Art

[0002] Traditional SIM card-based data encryption and decryption is that the terminal imports messages and files into the super SIM card for encryption and decryption, and then exports the encrypted and decrypted messages and files to the terminal. The terminal can use the super SIM card to perform identity authentication with other entities and perform key negotiation with other entities. During the negotiation process, the session key is obtained, and the session key can be used for encryption and decryption in the super SIM later.

[0003] However, the communication rate between mobile terminals and super SIM cards is currently slow. If a large amount of content is encrypted and decrypted in a super SIM card, it will take a long time and result in poor user experience. Especially for encryption of large files, the encryption and decryption of data will occupy the 7816 channel of the ISO 7816 standard for a long time, resulting in blocking other applications from accessing the SIM card and affecting the normal use of the SIM card. Summary of the invention

[0004] The embodiments of the present application provide a communication data encryption method, device, electronic device, storage medium and program product, which can solve the problem that the normal use of the SIM card is affected by the large amount of encrypted and decrypted content in the super SIM card.

[0005] In a first aspect, an embodiment of the present application provides a communication data encryption method, the method comprising: processing a digital envelope through a super SIM card to obtain a first key, wherein the digital envelope is sent by a server; deriving the first key from the super SIM card, and generating a second key based on the first key and a first random number; encrypting the communication data used to communicate with the server through the second key.

[0006] In a second aspect, an embodiment of the present application provides a communication data encryption device, which includes: a processing module, used to process a digital envelope through a super SIM card to obtain a first key, wherein the digital envelope is sent by a server; a generation module, used to derive the first key from the super SIM card, and generate a second key based on the first key and a first random number; an encryption module, used to encrypt the communication data used to communicate with the server through the second key.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer performs the steps of the method described in the first aspect.

[0010] In an embodiment of the present application, a digital envelope is processed by a super SIM card to obtain a first key, where the digital envelope is sent by a server; the first key is derived from the super SIM card, and a second key is generated based on the first key and a first random number; the communication data used to communicate with the server is encrypted by the second key, and the communication data can be encrypted on a terminal device, thereby improving the processing efficiency of the communication data. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a flow chart of a communication data encryption method provided in an embodiment of the present application; Figure 2 This is a key negotiation flow chart provided in an embodiment of the present application; Figure 3 This is a key decryption flow chart provided in an embodiment of the present application; Figure 4 It is a structural schematic diagram of a communication data encryption device provided in an embodiment of the present application; Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0013] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0014] In conjunction with the accompanying drawings, a communication data encryption method, device, electronic device, storage medium and program product provided by the embodiments of the present application are described in detail through specific embodiments and their application scenarios.

[0015] Figure 1 A communication data encryption method provided by an embodiment of the present application is shown, and the method can be executed by a terminal device. In other words, the method can be executed by software or hardware installed in the terminal device, and the method includes the following steps: Step 102: Process the digital envelope through the super SIM card to obtain a first key.

[0016] Specifically, before the terminal device and the server communicate, the server will send a digital envelope to the terminal device in advance, and the digital envelope includes the first key (MasterKey). After receiving the digital envelope, the terminal device can process the digital envelope through the super SIM card to obtain the first key. : The super SIM card itself has a high security, which can make the generation of session keys more secure and effectively prevent the risk of key leakage and attack.

[0017] In one implementation, the method according to claim 1 is characterized in that, before the digital envelope is processed through the super SIM card, it also includes: receiving a first message sent by a server; and obtaining the digital envelope from the first message when the legality verification of the first message is successful.

[0018] In one implementation, before receiving the first message sent by the server, it also includes: generating a second message based on the second random number of the terminal device, the third random number of the server, the server identification of the server and the encryption certificate of the terminal device; sending the second message to the server, so that the server generates the first message when the legality verification of the second message is successful, and the first message includes the digital envelope, the second random number, the third random number and the terminal identification of the terminal device.

[0019] Specifically, first, the SIM card smart password key is initialized, and a certificate is requested from the server. Figure 2 In the key negotiation flowchart shown, the terminal device generates a second random number RA, and together with the signature certificate CertA of the terminal device, forms the first message: CertA||RA|| Text1, Text1 is empty, and is sent to the server. The server generates a third random number RB, and together with the server's certificate CertB, forms the first message: CertB||RB|| Text2, Text2 is empty, and is sent to the terminal device. The terminal device signs RA, RB, the server's server identifier IDB, and Text3 to form SignA (RA||RB||B||Text3), and then forms the first message: TokenAB = RA||RB||B||Text4|| SignA(RA||RB||B||Text3), Text4 = Text3 are all encryption certificates of the terminal device. The server verifies the legitimacy of the first message TokenAB. If the verification fails, the session negotiation process ends. If the verification passes, RB, RA, the terminal device's terminal identifier IDA and Text5 are signed to form SignB(Rb||RA||A||Text5, and then the second message is formed: TokenBA = RB||RA||A||Text6|| SignB(Rb||RA||A||Text5), Text6 = Text5 (digital envelope). The session key is negotiated synchronously during the identity authentication process. At the same time, by importing the session key into the software for encryption and decryption, a large number of message and file encryption and decryption operations can be flexibly processed on the mobile terminal, improving the user experience.

[0020] In one implementation, before the digital envelope is processed by the super SIM card, the method further includes: Receive a first message sent by a server; and if the first message is successfully verified as legitimate, obtain the digital envelope from the first message.

[0021] Specifically, after receiving the first message TokenBA, the terminal device verifies the legitimacy of the first message. If the verification fails, the session key negotiation process ends. If the verification passes, the Text6 digital envelope is decrypted.

[0022] In the server, the construction process of the digital envelope Text6 = Text5 is as follows: the server randomly generates a 16-byte first key MasterKey. The server uses the fifth key SensitiveKey to encrypt the first key MasterKey to form a second encrypted ciphertext SensitiveData. The server generates a fourth key RandKey to encrypt the second encrypted ciphertext SensitiveData to form a lost encrypted ciphertext EncData. The fourth key RandKey is encrypted using the client's public key to form an encrypted third key EncRandKey, forming a digital envelope and passing it to the client, digital envelope = EncRandKey||EncData. A predetermined key derivation algorithm is used to generate a second key TransKey, and the second key is used to perform a cryptographic operation on the preset data to obtain a session key verification value VerifyCode. Text6 = Text5 = other data||EncSKey||EncData||Verifycode. After the server and the terminal device establish a secure channel, the secure channel will be used to perform confidentiality and integrity protection.

[0023] Step 104: derive the first key from the super SIM card, and generate a second key according to the first key and a first random number.

[0024] Specifically, the terminal device may derive the first key from the SIM card, and then generate a second key (TransKey) according to the first key and the first random number.

[0025] Step 106: Encrypt the communication data used to communicate with the server by using the second key.

[0026] Specifically, after obtaining the second key, the communication data used to communicate with the server can be encrypted by the second key, and then the encrypted data can be transmitted to the server.

[0027] The communication data encryption method provided in the embodiment of the present application processes a digital envelope through a super SIM card to obtain a first key, wherein the digital envelope is sent by a server; the first key is derived from the super SIM card, and a second key is generated according to the first key and a first random number; the communication data used to communicate with the server is encrypted through the second key, and the communication data can be encrypted on a terminal device, thereby improving the processing efficiency of the communication data and avoiding the problem that a large amount of encrypted and decrypted content in the super SIM card affects the normal use of the SIM card.

[0028] In one implementation, the processing of the digital envelope through the super SIM card to obtain the first key includes: in the super SIM card, decrypting the encrypted third key in the digital envelope through the first private key to obtain a fourth key, where the third key is obtained by the server encrypting the fourth key through the first public key corresponding to the first private key; and obtaining the first key through the fourth key and the digital envelope.

[0029] In one implementation, obtaining the first key through the fourth key and the digital envelope includes: decrypting the first encrypted ciphertext in the digital envelope through the fourth key to obtain the second encrypted ciphertext; and decrypting the second encrypted ciphertext through the fifth key to obtain the first key.

[0030] Specifically, Figure 3 As shown, after the client receives the digital envelope Text6, the terminal device will import EncSKey into the SIM card through the ImportSessionKey command. In the super SIM card, the encrypted third key in the digital envelope is decrypted by the first private key to obtain the key ID corresponding to the fourth key RandKey. Through the DecryptoInit and Decrypto commands, the key ID obtained in the previous step is used to decrypt the first encrypted ciphertext EncData to obtain the second encrypted ciphertext SensitiveData, and the second encrypted ciphertext SensitiveData is returned to the terminal device. The terminal device uses the fifth key SensitiveKey to decrypt the second encrypted ciphertext SensitiveData to obtain the first MasterKey. TransKey is calculated using the MasterKey and random numbers, and the legitimacy of the VerifyCode is verified using TransKey. The MasterKey and TransKey are stored in DRAM, the session key negotiation is successful, and TransKey is used to encrypt and decrypt messages and files later.

[0031] In one implementation, the exporting the first key from the super SIM card includes: importing a second public key into the super SIM card, and encrypting the first key in the super SIM card by using the second public key to obtain a first encryption key; exporting the first encryption key from the super SIM card; and decrypting the first encryption key by using a second private key corresponding to the second public key to obtain the first key.

[0032] In one implementation, before the digital envelope is processed by the super SIM card, it also includes: importing a third public key into the super SIM card; exporting the first key from the super SIM card includes: encrypting the first key by the third public key to obtain a second encryption key; exporting the second encryption key from the super SIM card; and decrypting the second encryption key by the third private key corresponding to the third public key to obtain the first key.

[0033] In an implementation manner, after deriving the first key from the super SIM card and generating the second key according to the first key and the first random number, the method further includes: saving the first key and the second key in a memory.

[0034] Since the session key is stored in memory and encrypted and decrypted using software, the appropriate encryption algorithm and key length can be selected as needed, and it can be upgraded and expanded in the future to meet different security requirements.

[0035] In one implementation, before obtaining the first key through the fourth key and the digital envelope, it also includes: sending the first signature of the terminal device to the server, so that the server generates a second signature when the first signature is successfully verified, the first signature is obtained by the super SIM card signing the second random number of the terminal device, the third random number of the server, the server identification of the server and the encryption certificate of the terminal device, the second signature is obtained by the server signing the second random number, the third random number, the terminal identification of the terminal device and the second encrypted ciphertext of the first key, and the second signature is used to verify the server.

[0036] In one implementation, the processing of the digital envelope by using the super SIM card includes: if the second signature is verified successfully, processing the digital envelope by using the super SIM card.

[0037] In the embodiment of the present application, the Applet in the super SIM card can be modified with reference to the 15843.3 specification, and the ImportSessionKey function in the existing command of GM / T 0017 is expanded to attach the temporary public key generated by the host software to the command and pass it to the super SIM card.

[0038] Specifically, the host software generates a random number RA, reads the signature certificate, organizes the message: CertA||RA and sends it to the server. The server generates a random number RB, organizes the message: CertB||RB and sends it to the client. The host reads the encryption certificate EncCertA, calls the 0016 interface to sign RA||RB||B||EncCertA to obtain SignatureA, and sends RA||RB||B||EncCertA||SignatureA to the server. The server verifies EncCertA, generates the master key MasterKey, encrypts MasterKey with the public key corresponding to EncCertA to obtain the master key ciphertext EncMasterKey, and the server uses the private key to sign RB||RA||A||EncMasterKey to obtain SignatureB, and the server sends RB||RA||A||EncMasterKey||SignatureB to the client. The host software verifies SignatureB, generates a temporary key pair TempPriKey and TempPubKey, and sends the GM / T 0017 import session key command (extend this command and add TempPubKey in the command data field). The super SIM card decrypts EncMasterKey internally and uses TempPubKey to encrypt the MasterKey output while clearing the MasterKey handle in the card. The host software uses TempPriKey to decrypt and obtain the MasterKey.

[0039] The safest solution is to refer to the 15843.3 specification and modify the Applet in the super SIM card. Two new commands are added based on the existing commands of GM / T 0017. The terminal device reads the certificate CertA, calls the random number generation interface of GM / T 0017 to generate the random number RA, and the terminal device organizes the message CertA||RA and sends it to the server. The server generates a random number RB, organizes the message: CertB||RB and sends it to the terminal device. The terminal device generates a temporary key pair (PubKeyTEMP, PriKeyTEMP), calls the new command AuthInit of GM / T 0017, and passes in CertB||RB||IDB||PubKeyTEMP. The super SIM card signs RA||RB||IDB||EncCertA to obtain SignatureA. The super SIM card returns EncCertA||SignatureA and saves PubKeyTEMP internally. The terminal device software sends RA||RB||IDB||EncCertA||SignatureA to the server. The server verifies SignatureA, generates the master key MasterKey, encrypts MasterKey with the public key corresponding to EncCertA to obtain the master key ciphertext EncMasterKey, and uses the private key to sign RB||RA||A||EncMasterKey to obtain SignatureB. The server sends RB||RA||A||EncMasterKey||SignatureB to the terminal device. The terminal device software calls the GM / T 0017 new command Auth, passes in IDA||EncMasterKey||SignatureB, and the super SIM card verifies SignatureB, decrypts EncMasterKey, and uses PubKeyTEMP to encrypt the MasterKey output. The terminal device software uses PriKeyTEMP to decrypt and obtain MasterKey.

[0040] It should be noted that the communication data encryption method provided in the embodiment of the present application can be executed by a communication data encryption device, or a control module in the communication data encryption device for executing the communication data encryption method. In the embodiment of the present application, the communication data encryption device provided in the embodiment of the present application is described by taking the communication data encryption device executing the communication data encryption method as an example.

[0041] Figure 4 Schematic diagram of the structure of the communication data encryption device according to the embodiment of the present application. Figure 4 As shown, the communication data encryption device 400 includes: a processing module 410, a generation module 420 and an encryption module 430.

[0042] The processing module 410 is used to process the digital envelope through the super SIM card to obtain a first key, wherein the digital envelope is sent by the server; the generating module 420 is used to derive the first key from the super SIM card and generate a second key according to the first key and a first random number; the encryption module 430 is used to encrypt the communication data used to communicate with the server through the second key.

[0043] In one implementation, the generation module 420 is used to decrypt the encrypted third key in the digital envelope in the super SIM card using the first private key to obtain a fourth key, where the third key is obtained by the server encrypting the fourth key using the first public key corresponding to the first private key; and obtain the first key using the fourth key and the digital envelope.

[0044] In one implementation, the generating module 420 is configured to decrypt the first encrypted ciphertext in the digital envelope by using the fourth key to obtain the second encrypted ciphertext; and decrypt the second encrypted ciphertext by using the fifth key to obtain the first key.

[0045] In one implementation, the processing module 410 is configured to receive a first message sent by a server; and if a legal verification of the first message is successful, obtain the digital envelope from the first message.

[0046] In one implementation, the processing module 410 is used to generate a second message based on the second random number of the terminal device, the third random number of the server, the server identification of the server and the encryption certificate of the terminal device; and send the second message to the server so that the server generates the first message when the legality verification of the second message is successful, and the first message includes the digital envelope, the second random number, the third random number and the terminal identification of the terminal device.

[0047] In one implementation, the generation module 420 is used to import the second public key into the super SIM card, encrypt the first key in the super SIM card using the second public key to obtain a first encryption key; export the first encryption key from the super SIM card; and decrypt the first encryption key using a second private key corresponding to the second public key to obtain the first key.

[0048] In one implementation, the processing module 410 is used to import the third public key into the super SIM card; the generating module 420 is used to encrypt the first key by using the third public key to obtain a second encryption key; export the second encryption key from the super SIM card; and decrypt the second encryption key by using a third private key corresponding to the third public key to obtain the first key.

[0049] In one implementation, the life module 420 is further configured to save the first key and the second key into a memory.

[0050] In one implementation, the processing module 410 is also used to send the first signature of the terminal device to the server, so that the server generates a second signature when the first signature is successfully verified. The first signature is obtained by the super SIM card signing the second random number of the terminal device, the third random number of the server, the server identifier of the server and the encryption certificate of the terminal device. The second signature is obtained by the server signing the second random number, the third random number, the terminal identifier of the terminal device and the second encrypted ciphertext of the first key. The second signature is used to verify the server.

[0051] In one implementation, the processing module 410 is used to process the digital envelope through the super SIM card when the second signature is successfully verified.

[0052] The communication data encryption device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0053] The communication data encryption device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0054] The communication data encryption device provided in the embodiment of the present application can achieve Figures 1 to 3 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0055] like Figure 5 As shown, an embodiment of the present application further provides an electronic device 500, including a processor 501 and a memory 502, wherein the memory 502 stores a program or instruction that can be run on the processor 501, and when the program or instruction is executed by the processor 501, it is implemented as follows: processing a digital envelope through a super SIM card to obtain a first key, wherein the digital envelope is sent by a server; deriving the first key from the super SIM card, and generating a second key based on the first key and a first random number; and encrypting communication data used to communicate with the server through the second key.

[0056] In one implementation, in the super SIM card, the third key encrypted in the digital envelope is decrypted by the first private key to obtain a fourth key, where the third key is obtained by the server encrypting the fourth key by the first public key corresponding to the first private key; the first key is obtained by the fourth key and the digital envelope.

[0057] In one implementation, the first encrypted ciphertext in the digital envelope is decrypted by the fourth key to obtain the second encrypted ciphertext; and the second encrypted ciphertext is decrypted by the fifth key to obtain the first key.

[0058] In one implementation, before the digital envelope is processed by the super SIM card, the method further includes: receiving a first message sent by a server; and obtaining the digital envelope from the first message when the legality verification of the first message is successful.

[0059] In one implementation, before receiving the first message sent by the server, a second message is generated based on the second random number of the terminal device, the third random number of the server, the server identification of the server and the encryption certificate of the terminal device; the second message is sent to the server, so that the server generates the first message when the legality verification of the second message is successful, and the first message includes the digital envelope, the second random number, the third random number and the terminal identification of the terminal device.

[0060] In one implementation, the second public key is imported into the super SIM card, the first key is encrypted by the second public key in the super SIM card to obtain a first encryption key; the first encryption key is exported from the super SIM card; the first encryption key is decrypted by the second private key corresponding to the second public key to obtain the first key.

[0061] In one implementation, before the digital envelope is processed by the super SIM card, the method further includes: Importing the third public key into the super SIM card; encrypting the first key by using the third public key to obtain a second encryption key; exporting the second encryption key from the super SIM card; decrypting the second encryption key by using the third private key corresponding to the third public key to obtain the first key.

[0062] In one implementation, after the first key is derived from the super SIM card and a second key is generated according to the first key and a first random number, the first key and the second key are saved in a memory.

[0063] In one implementation, before obtaining the first key through the fourth key and the digital envelope, the first signature of the terminal device is sent to the server, so that the server generates a second signature when the first signature is successfully verified. The first signature is obtained by the super SIM card signing the second random number of the terminal device, the third random number of the server, the server identifier of the server and the encryption certificate of the terminal device. The second signature is obtained by the server signing the second random number, the third random number, the terminal identifier of the terminal device and the second encrypted ciphertext of the first key. The second signature is used to verify the server.

[0064] In one implementation, when the second signature is verified successfully, the digital envelope is processed through the super SIM card.

[0065] The specific execution steps can refer to the various steps of the above-mentioned communication data encryption method embodiment, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0066] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals, or other devices except terminals.

[0067] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0068] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0069] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0070] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned communication data encryption method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0071] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as ROM, RAM, magnetic disk or optical disk.

[0072] An embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the various processes of the above-mentioned communication data encryption method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0073] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0074] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0075] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A communication data encryption method, characterized in that: Applied to terminal equipment, including: Processing the digital envelope through the super SIM card to obtain a first key, wherein the digital envelope is sent by the server; deriving the first key from the super SIM card, and generating a second key according to the first key and a first random number; The communication data used for communicating with the server is encrypted by the second key.

2. The method according to claim 1, characterized in that The step of processing the digital envelope by the super SIM card to obtain the first key includes: In the super SIM card, the encrypted third key in the digital envelope is decrypted by the first private key to obtain a fourth key, where the third key is obtained by the server encrypting the fourth key by the first public key corresponding to the first private key; The first key is obtained by using the fourth key and the digital envelope.

3. The method according to claim 2, characterized in that The obtaining the first key by using the fourth key and the digital envelope comprises: decrypting the first encrypted ciphertext in the digital envelope by using the fourth key to obtain a second encrypted ciphertext; The second encrypted ciphertext is decrypted using the fifth key to obtain the first key.

4. The method according to claim 1, characterized in that Before the digital envelope is processed by the super SIM card, the method further includes: Receiving a first message sent by a server; When the legality verification of the first message succeeds, the digital envelope is obtained from the first message.

5. The method according to claim 4, characterized in that Before receiving the first message sent by the server, the method further includes: generating a second message according to the second random number of the terminal device, the third random number of the server, the server identifier of the server, and the encryption certificate of the terminal device; The second message is sent to the server, so that the server generates the first message when the second message is successfully verified as legitimate, wherein the first message includes the digital envelope, the second random number, the third random number and the terminal identification of the terminal device.

6. The method according to claim 1, characterized in that The deriving the first key from the super SIM card comprises: Importing the second public key into the super SIM card, and encrypting the first key in the super SIM card by using the second public key to obtain a first encryption key; deriving the first encryption key from the super SIM card; The first encryption key is decrypted using a second private key corresponding to the second public key to obtain the first key.

7. The method according to claim 1, characterized in that Before the digital envelope is processed by the super SIM card, the method further includes: Importing the third public key into the super SIM card; The deriving the first key from the super SIM card comprises: Encrypt the first key by using the third public key to obtain a second encryption key; deriving the second encryption key from the super SIM card; The second encryption key is decrypted using a third private key corresponding to the third public key to obtain the first key.

8. The method according to claim 6, characterized in that After deriving the first key from the super SIM card and generating a second key according to the first key and a first random number, the method further includes: The first key and the second key are stored in a memory.

9. The method according to claim 6 or 7, characterized in that: Before obtaining the first key through the fourth key and the digital envelope, the method further includes: The first signature of the terminal device is sent to the server, so that the server generates a second signature when the first signature is successfully verified. The first signature is obtained by the super SIM card signing the second random number of the terminal device, the third random number of the server, the server identification of the server and the encryption certificate of the terminal device. The second signature is obtained by the server signing the second random number, the third random number, the terminal identification of the terminal device and the second encrypted ciphertext of the first key. The second signature is used to verify the server.

10. The method according to claim 9, characterized in that The processing of the digital envelope by the super SIM card includes: When the second signature is verified successfully, the digital envelope is processed through the super SIM card.

11. A communication data encryption device, characterized in that: include: A processing module, used to process the digital envelope through the super SIM card to obtain a first key, wherein the digital envelope is sent by the server; A generating module, configured to derive the first key from the super SIM card, and generate a second key according to the first key and a first random number; An encryption module is used to encrypt communication data used to communicate with the server by using the second key.

12. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the communication data encryption method as described in any one of claims 1 to 10.

13. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the communication data encryption method as described in any one of claims 1-10 are implemented.

14. A computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the steps of the communication data encryption method as described in any one of claims 1 to 10.

Images