SIM card data management method and device, equipment, storage medium and product

Abstract

The invention discloses an SIM card data management method and device, equipment, a storage medium and a product, and relates to the technical field of data management.The method comprises the steps that an SIM card manufacturing request is responded through a card manufacturing system, and a card manufacturing flow batch number is generated; generating card making encryption data based on the pipeline batch number and a corresponding algorithm; generating a card manufacturer card-making file package based on the card-making flow batch number and the card-making encrypted data; sending the card manufacturer card-making file package to a target card manufacturer production system, reading the card manufacturer signature file and the card manufacturer card-making file in the card manufacturer card-making file package, carrying out production verification, respectively decrypting the random encryption key and the operator variant key according to the card manufacturer ciphertext random encryption key and the card manufacturer ciphertext operator variant key after the verification is passed, and sending the random encryption key and the operator variant key to the target card manufacturer production system; and writing the key and the card making configuration information into a pre-connected blank SIM card, thereby ensuring the safety of the whole process of generation, storage and transmission of the card making data of the SIM card, and improving the safety and availability of the card making data management method.

Description

Technical Field

[0001] The present application relates to the field of data management technology, and in particular to a SIM card data management method, device, equipment, storage medium and product. Background Art

[0002] In the field of communications, especially in mobile communications technology, the SIM card (Subscriber Identity Module) is a key component for user identification and network access, and the security of its data is of vital importance. With the rapid development of the Internet of Things and information technology, security issues in the generation, storage and transmission of SIM card data have become increasingly prominent.

[0003] SIM card data includes sensitive information such as ICCID (Integrated Circuit Card ID), IMSI (International Mobile Subscriber Identity), K (Ciphering Key), OPc (Operator Variant Key), SMSP (SIM Service Provider), PIN (Personal Identification Number), and PUK (Personal Unblocking Key). Among them, IMSI, K, and OPc, as important authentication data, play a core role when the SIM card in the user's mobile phone logs in. The security of this data is directly related to the user's privacy protection and communication security.

[0004] In the prior art, the generation, storage and transmission of SIM card data mainly rely on the card making system to store the data after generation, and transmit it to the card manufacturer for SIM card production when needed. In this process, core data such as K and OPc are encrypted and stored using symmetric keys after generation, and directly transmit the data in the system when transmitting it to the card manufacturer, who then uses the symmetric key to decrypt it before making the card. However, this unified symmetric key storage method has significant security risks. Once the key is leaked, it will lead to the leakage of card making data, resulting in major security risks. In addition, since all card making data is encrypted by the same key, once the key is cracked, all data stored in the system will face security threats.

[0005] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The main purpose of this application is to provide a SIM card data management method, device, equipment, storage medium and computer program product, aiming to reduce the risk of data leakage during the SIM card making data transmission process and improve the security and usability of the card making data management method.

[0007] To achieve the above object, the present application proposes a SIM card data management method, which is applied to a card making system and includes:

[0008] In response to a SIM card production request, generating a card production serial batch number corresponding to the SIM card production request;

[0009] Generate SIM card production encrypted data based on the card production batch number and a preset card production data generation algorithm;

[0010] Generate a card manufacturer's card making file package based on the card making serial batch number and the SIM card making encrypted data;

[0011] The card merchant card making file package is sent to the target card merchant production system, so that the target card merchant production system receives the card merchant card making file package, decrypts the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, respectively, and writes the random encryption key and the operator variant key, as well as the SIM card making configuration information in the card merchant card making file into a pre-connected blank SIM card.

[0012] In one embodiment, the SIM card manufacturing encrypted data includes an encrypted random encryption key and an encrypted operator variant key, and the step of generating the SIM card manufacturing encrypted data based on the card manufacturing serial batch number and a preset card manufacturing data generation algorithm includes:

[0013] Obtaining a number of integrated circuit card identification codes corresponding to the card production serial batch number;

[0014] Generate random encryption keys and operator variant keys based on a preset system encryption machine;

[0015] Perform secondary distributed encryption according to the pre-generated storage root key, the batch number of the card production serial number, and the integrated circuit card identification code to obtain a mixed distributed key;

[0016] According to the mixed distributed key, the random encryption key and the operator variant key are encrypted by a first national secret algorithm to obtain the encrypted random encryption key and the encrypted operator variant key.

[0017] In one embodiment, the step of generating a card manufacturer's card making file package based on the card making serial batch number and the SIM card making encrypted data includes:

[0018] According to the card production batch number and the pre-acquired card production manufacturer code, target card production data and card production manufacturer certificate index are determined respectively, wherein the target card production data includes a number of integrated circuit card identification codes and the SIM card production encryption data;

[0019] Perform secondary distributed encryption based on the pre-generated storage root key, the card production batch number, and the integrated circuit card identification code to obtain a mixed distributed key;

[0020] According to the mixed distributed key, the SIM card manufacturing encrypted data is decrypted by the national secret algorithm to obtain a random encryption key and an operator variant key;

[0021] According to the card manufacturer certificate corresponding to the card manufacturer certificate index, the random encryption key and the operator variant key are encrypted by a second national secret algorithm to obtain a card manufacturer ciphertext random encryption key and a card manufacturer ciphertext operator variant key;

[0022] The card merchant card making file package is generated based on the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key.

[0023] In one embodiment, the card merchant card making file package includes a card merchant signature file and a card merchant card making file, and the step of generating the card merchant card making file package based on the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key includes:

[0024] Generate original card making files and original signature files of card merchants;

[0025] Write the integrated circuit card identification code, the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key, and the pre-acquired SIM card making configuration information into the card merchant making original file to obtain the card merchant making file;

[0026] Assemble and sign the signature string based on the file attribute of the card merchant's card making file, the card making serial number, and the pre-acquired card making system private key to obtain a signature string and a string signature value;

[0027] The signature string and the string signature value are written into the card merchant signature original file to obtain the card merchant signature file.

[0028] In addition, to achieve the above purpose, the present application also proposes a SIM card data management method, which is applied to a target card manufacturer production system, including:

[0029] Receiving a card making file package sent by a card making system, wherein the card making file package is generated by the card making system in response to a SIM card making request, generating a card making serial batch number corresponding to the SIM card making request, and generating SIM card making encrypted data based on the card making serial batch number and a preset card making data generation algorithm, and generating the SIM card making encrypted data based on the card making serial batch number and the SIM card making encrypted data;

[0030] Decrypt the random encryption key and the operator variant key of the card merchant ciphertext in the card merchant card making file package to obtain the random encryption key and the operator variant key respectively;

[0031] The random encryption key and the operator variant key, as well as the SIM card manufacturing configuration information in the card manufacturer's card manufacturing file package are written into a pre-connected blank SIM card.

[0032] In one embodiment, the card merchant signature file and the card merchant card making file in the card merchant card making file package, before the step of respectively decrypting the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, further comprises:

[0033] Obtain the signature string and string signature value in the card merchant signature file;

[0034] Verify whether the string signature value is correct based on the pre-acquired card making system certificate and the signature string;

[0035] Parse the signature string to obtain the file attributes of the file written by the card merchant when making the card;

[0036] If the file attributes of the card merchant's card making file match the preset file attribute values, and the string signature value is correct, execute the following steps: decrypt the random encryption key and the operator variant key in the card merchant's ciphertext in the card merchant's card making file respectively to obtain the random encryption key and the operator variant key.

[0037] In addition, to achieve the above purpose, the present application also proposes a SIM card data management device, the SIM card data management device comprising:

[0038] A first generating module, configured to generate a card making serial batch number corresponding to a SIM card making request in response to the SIM card making request;

[0039] A second generating module is used to generate SIM card production encrypted data based on the card production serial batch number and a preset card production data generation algorithm;

[0040] A third generating module is used to generate a card making file package for a card merchant based on the card making serial batch number and the SIM card making encrypted data;

[0041] A sending module is used to send the card merchant card making file package to the target card merchant production system, so that the target card merchant production system receives the card merchant card making file package, decrypts the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, and writes the random encryption key and the operator variant key, as well as the SIM card making configuration information in the card merchant card making file into a pre-connected blank SIM card.

[0042] In addition, to achieve the above-mentioned purpose, the present application also proposes a SIM card data management device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the SIM card data management method as described above.

[0043] In addition, to achieve the above objectives, the present application also proposes a storage medium, which is a computer-readable storage medium, and stores a computer program on the storage medium. When the computer program is executed by a processor, the steps of the SIM card data management method described above are implemented.

[0044] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the SIM card data management method as described above are implemented.

[0045] One or more technical solutions proposed in the present application generate a corresponding card making serial batch number in response to a SIM card making request through a card making system; generate SIM card making encrypted data based on the card making serial batch number and the card making data generation algorithm; generate a card making file package for a card merchant based on the card making serial batch number and the SIM card making encrypted data; send the card making file package for a card merchant to a target card merchant production system, so that the target card merchant production system reads the card merchant signature file and the card merchant making file in the card merchant making file package to perform SIM card production verification. If the production verification passes, the random encryption key and the operator variant key are decrypted respectively according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant making file, and the above keys and SIM card making configuration information are written into a pre-connected blank SIM card. This solution ensures the security of the entire process of generating, storing and transmitting SIM card making data, thereby improving the security and availability of the card making data management method. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0048] Figure 1 A flowchart of an embodiment of the SIM card data management method provided in the present application;

[0049] Figure 2 A schematic diagram of the architecture of a SIM card data management system provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of a card making data encryption process provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of a card making data generation and storage process provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of a card making data encryption and transmission process for a card merchant provided in an embodiment of the present application;

[0053] Figure 6 A flowchart of another embodiment of the SIM card data management method provided by the present application;

[0054] Figure 7 A schematic diagram of a card merchant decryption and card making process provided in an embodiment of the present application;

[0055] Figure 8 This is a schematic diagram of the module structure of the SIM card data management device according to an embodiment of the present application;

[0056] Fig. 9 This is a schematic diagram of the device structure of the hardware operating environment involved in the SIM card data management method in the embodiment of the present application.

[0057] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0058] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0059] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0060] The main solution of the embodiment of the present application is to propose an encryption method and system for generating, storing and transmitting SIM card data based on a national secret algorithm. This solution aims to solve the security problems of symmetric key management in the prior art, especially the deficiencies in key leakage risk and data transmission security. Specifically, this solution is implemented through the following steps:

[0061] First, during the generation and storage of SIM card data, the card-making system uses a dedicated encryption machine to generate key data K and OPc, and directly outputs the encrypted data. The system uses the national secret SM4 algorithm as the root key, uses the root key to disperse each SIM card data, generates an independent subkey, and encrypts and stores each data separately. In this way, each data has a unique encryption key, and even if a piece of data is cracked, it will not affect the security of other data.

[0062] Secondly, in the data transmission stage, the solution uses the PKI system and the national secret SM2 algorithm to encrypt the card data for transmission. The card system and the card manufacturer use certificates to authenticate and encrypt data, ensuring that only the corresponding card manufacturer can decrypt and obtain the plaintext data. The card system issues an independent certificate to each card manufacturer to achieve access management and data non-repudiation.

[0063] Finally, when the card manufacturer receives the data and produces the card, the card manufacturer uses its own private key to decrypt the received encrypted data and writes the decrypted plaintext data into a blank SIM card to complete the production of the SIM card. The card manufacturer's production system is completely closed, does not leave any log data, and ensures data security through regular inspections.

[0064] In summary, the solution proposed in the technical briefing document achieves security protection of SIM card data throughout its entire life cycle, including data generation, storage and transmission, by combining symmetric and asymmetric national encryption algorithms, thereby improving the security of SIM card data.

[0065] The present application provides a solution, in which a card making system generates a corresponding card making serial batch number in response to a SIM card making request; generates SIM card making encrypted data based on the card making serial batch number and the SIM card making encrypted data; generates a card making file package for a card merchant based on the card making serial batch number and the SIM card making encrypted data; sends the card making file package for a card merchant to a target card merchant production system, so that the target card merchant production system reads the card merchant signature file and the card merchant making file in the card merchant making file package to perform SIM card production verification. If the production verification passes, the random encryption key and the operator variant key are decrypted respectively according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant making file, and the above keys and SIM card making configuration information are written into a pre-connected blank SIM card. This solution ensures the security of the entire process of generating, storing and transmitting SIM card making data, thereby improving the security and availability of the card making data management method.

[0066] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a SIM card data management system, etc. The following takes the SIM card data management system as an example to illustrate this embodiment and the following embodiments.

[0067] Based on this, the embodiment of the present application provides a SIM card data management method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the SIM card data management method of the present application.

[0068] In this embodiment, the SIM card data management method includes steps S1000 to S4000:

[0069] Step S1000: In response to a SIM card production request, generating a card production serial batch number corresponding to the SIM card production request;

[0070] It should be noted that, refer to Figure 2 , Figure 2 A schematic diagram of the architecture of a SIM card data management system provided for an embodiment of the present application. In an embodiment of the present application, a SIM card data management system is provided, which specifically includes: a SIM card making system, which is mainly responsible for generating SIM card data, retaining a copy of the card making data within the system, and giving a copy to the corresponding card making manufacturer, a dedicated encryption machine for the card making system, which saves all SIM card making manufacturer certificates and data storage master keys, and its own public and private key pairs. The card making system is a system deployed in the internal network of a telecommunications operator.

[0071] SIM card manufacturers are mainly used to receive card-making data and produce SIM cards based on the card-making data. The dedicated encryption machine of the SIM card manufacturer stores the certificate of the SIM card-making system and its own public and private key pairs. CA, or certificate authority, is the provider of the certificate center CI and the standard PKI certificate authority. It issues trusted digital certificates to all communicating parties in the system. CI issues certificates to SIM card manufacturers. During the production process, SIM card manufacturers decrypt and verify the received card-making data, and produce SIM cards after passing the verification. CI can also issue certificates to the SIM card-making system, and subsequent card-making files are signed with the certificate, which is stored in the encryption machine.

[0072] Specifically, during the certificate application and use process, the certificate applicant (card merchant or card making system) can generate a pair of public and private keys in the encryption machine and generate a certificate issuance application (the application contains the public key of the certificate applicant and the applicant's information). After receiving the application, CI generates a certificate file and returns the certificate file to the certificate applicant (the certificate contains the public key of the certificate applicant, the applicant's information and CI's information).

[0073] After the applicant receives the certificate file, it can pass the certificate file to other parties (such as card dealers can submit their own certificates to the card production system). When the recipient receives the certificate provided by other parties, it can verify whether the applicant information and CI information in the certificate are correct. If correct, it can be confirmed that it is a credible certificate and the certificate can be imported into the encryption machine. The subsequent encryption machine can use the certificate public key for encryption and other operations.

[0074] In the embodiment of the present application, taking into account that the existing card-making system will store the K (Ciphering Key) and OPc (Operator Variant Key) in the card-making data as card-making data in the system after generation, in order to ensure the security of the data, it is necessary to encrypt and store it. In order to ensure the security of the stored data, each piece of data needs to be encrypted and retained using a separate key. In the embodiment of the present application, the national secret SM4 can be used as the root key. After each piece of card-making data is dispersed using the root key, it is encrypted and retained separately. The SM4 root key is randomly generated in the encryption machine. After the encryption machine is randomly generated, it is only retained in the encryption machine, and this key is not visible anywhere else.

[0075] Specifically, please refer to Figure 3 , Figure 3A schematic diagram of a card-making data encryption process is provided for an embodiment of the present application. When the card-making data is transmitted to the card manufacturer system, the PKI system (using the national secret SM2 key) is used to encrypt the card data for transmission. The PKI certificate system is divided into two levels: root certificate and card-making manufacturer certificate / card-making system platform certificate. The root certificate is a self-signed certificate and is the starting point of the trust chain. The card-making manufacturer certificate is issued by the root certificate. The card-making manufacturer submits the issued certificate offline to the card-making system and imports it into the encryption machine of the card-making system. The card-making system certificate is also issued by the root certificate. After issuance, it is submitted to each card-making manufacturer, and the card-making manufacturer verifies that the certificate is valid.

[0076] It should be noted that in the embodiment of the present application, in response to the SIM card making request, the step of generating the card making serial batch number corresponding to the SIM card making request is to ensure the uniqueness and traceability of each card making request. The card making serial batch number is a unique identifier, which corresponds to the SIM card making request one by one, and is used to identify and manage each batch of cards in the entire card making process. The batch number not only helps to monitor and manage the production process, but also can track the specific card making batch when problems occur, thereby improving the security and efficiency of the card making process. In addition, it should be noted that the process of generating the card making serial batch number involves the identification and processing of the card making request, as well as the generation and recording of the batch number. This process can be completed by a dedicated module in the card making system, which is responsible for receiving the card making request signal and automatically or semi-automatically generating a unique batch number, which usually contains a timestamp, a serial number or other identification information to ensure its uniqueness.

[0077] For example, in a specific embodiment, when the card making system receives a card making request, the system triggers an event, which activates the batch number generation module. The module creates a unique batch number based on the current date and time and an internal serial number generator, which is then used to identify and manage all subsequent operations related to the request.

[0078] Step S2000: Generate SIM card production encrypted data based on the card production batch number and a preset card production data generation algorithm;

[0079] It should be noted that the step of generating SIM card manufacturing encrypted data based on the card manufacturing batch number and the preset card manufacturing data generation algorithm is to ensure the security of SIM card data. The system will generate encrypted SIM card data according to the batch number and the preset algorithm, including the encrypted random encryption key (K) and the encrypted operator variant key (OPc). The process of generating SIM card manufacturing encrypted data includes obtaining the integrated circuit card identification code (ICCID), generating a random encryption key and an operator variant key, and using the storage root key and the national secret algorithm for secondary decentralized encryption. This process ensures that even if the data is intercepted during transmission, it cannot be decrypted and used by unauthorized parties.

[0080] In a specific implementation, the card making system will retrieve the corresponding ICCID from the database according to the card making serial batch number, and then the system encryption machine module will generate random K and OPc, and then use the pre-set storage root key and batch number, as well as the ICCID for secondary decentralized encryption to obtain a mixed decentralized key. Finally, the mixed decentralized key is used to encrypt K and OPc using the national secret SM4 algorithm to obtain encrypted K and OPc.

[0081] Step S3000: Generate a card manufacturer's card manufacturing file package based on the card manufacturing serial batch number and the SIM card manufacturing encrypted data;

[0082] It should be noted that in the embodiment of the present application, the step of generating a card manufacturer's card making file package based on the card making serial batch number and the SIM card making encrypted data is to securely package the encrypted SIM card data for transmission to the card manufacturer. In this step, the card making system will generate a file package containing all necessary information based on the batch number and encrypted data. This file package will be sent to the card manufacturer for producing SIM cards.

[0083] In addition, it should be noted that the process of generating a card manufacturer's card making file package involves determining the target card making data and the card manufacturer's certificate index, decrypting the SIM card making encrypted data using a hybrid decentralized key, and re-encrypting the decrypted data using the card manufacturer's certificate. For example, in a specific implementation, the card making system will determine the target card making data and the card manufacturer's certificate index based on the batch number and the pre-acquired card manufacturer code, and then use the hybrid decentralized key to decrypt the SIM card making encrypted data to obtain a random encryption key and an operator variant key. Then, the system uses the card manufacturer's certificate to encrypt these keys using the national secret SM2 algorithm to obtain the card manufacturer's ciphertext random encryption key and the card manufacturer's ciphertext operator variant key. Finally, the system will generate a card manufacturer's card making file package based on these keys.

[0084] Step S4000: Send the card merchant card making file package to the target card merchant production system, so that the target card merchant production system receives the card merchant card making file package, decrypts the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, respectively, and writes the random encryption key and the operator variant key, as well as the SIM card making configuration information in the card merchant card making file into a pre-connected blank SIM card.

[0085] It should be noted that in order to complete the transmission of SIM card data, the system sends the card manufacturer's card-making file package to the target card manufacturer's production system, so that the card manufacturer can receive all necessary information to produce SIM cards. In this step, the card-making system will send the file package to the card manufacturer through a secure communication channel to ensure the security and integrity of the data during the transmission process.

[0086] In addition, it should be noted that the process of sending the card-making file package to the card merchant involves the packaging, encryption and transmission of files. This file package contains the card-making file and the card merchant signature file. The card-making file contains the SIM card making configuration information, and the card merchant signature file is used to verify the integrity and authenticity of the file package.

[0087] For example, in a specific implementation, the card-making system will deliver the card-making file package of the card-making business to the card-making business point-to-point offline. After receiving the file package, the card-making business production system will first read the signature value and signature string in the card-making business signature file, and use the card-making system certificate to verify the correctness of the signature value. If the signature verification passes, the card-making business production system will further verify the file attributes, such as whether the file name and size match the expectations. If all checks pass, the card-making business production system will use the card-making business ciphertext random encryption key and the card-making business ciphertext operator variant key to decrypt and obtain the random encryption key and operator variant key, and write these keys together with the SIM card manufacturing configuration information into the pre-connected blank SIM card to complete the production of the SIM card.

[0088] In a feasible implementation manner, the SIM card manufacturing encryption data includes an encrypted random encryption key and an encrypted operator variant key, and step S2000 may include steps S2100 to S2400:

[0089] Step S2100: obtaining a plurality of integrated circuit card identification codes corresponding to the card production serial number;

[0090] Step S2200: Generate a random encryption key and an operator variant key based on a preset system encryption engine;

[0091] Step S2300: performing secondary distributed encryption according to the pre-generated storage root key, the batch number of the card production serial number, and the integrated circuit card identification code to obtain a mixed distributed key;

[0092] Step S2400: According to the mixed distributed key, the random encryption key and the operator variant key are encrypted by a first national secret algorithm to obtain the encrypted random encryption key and the encrypted operator variant key.

[0093] It should be noted that in the embodiment of the present application, first, a number of integrated circuit card identification codes (ICCIDs) corresponding to the card manufacturing batch number are obtained. ICCID is the unique identifier of the SIM card, which is assigned and burned by the operator when manufacturing the SIM card. It is the globally unique identification code of the SIM card and is crucial for the identification and management of the SIM card. Then, a random encryption key (K) and an operator variant key (OPc) are generated based on the preset system encryption machine. These two keys are the core data in the SIM card authentication process, ensuring the data security when the SIM card logs in. The random encryption key (K) is used to encrypt sensitive information in the SIM card, while the operator variant key (OPc) is used for authentication between the SIM card and the network.

[0094] Subsequently, secondary decentralized encryption is performed based on the pre-generated storage root key, card production batch number, and ICCID to obtain a mixed decentralized key. This step uses the national secret SM4 algorithm to enhance the security of the key by distributing the key, ensuring that even in the event of key leakage, the encrypted data cannot be easily cracked. Finally, based on the mixed decentralized key, the random encryption key and the operator variant key are encrypted using the first national secret algorithm to obtain an encrypted random encryption key and an encrypted operator variant key. This step is to encrypt K and OPc, ensuring the security of these sensitive data during storage and transmission. During the entire process from SIM card data generation to transmission, sensitive information is always encrypted, preventing the risk of data being intercepted and cracked during transmission, thereby greatly improving the security of SIM card data.

[0095] In a feasible implementation, the card making system first generates a unique card making serial batch number according to the received card making request, and retrieves the corresponding ICCID. Then, the system encryption machine generates random K and OPc, and uses the storage root key and ICCID for secondary decentralized encryption to obtain a mixed decentralized key. Then, the mixed decentralized key is used to encrypt K and OPc using the national secret SM4 algorithm to obtain encrypted K and OPc. Finally, these encrypted data are used to generate a card merchant card making file package and sent to the target card merchant production system. At the card merchant production system end, the encrypted K and OPc in the received file package will be decrypted and written into the blank SIM card together with the SIM card making configuration information to complete the production of the SIM card. The entire process follows strict security standards to ensure the security and reliability of the data.

[0096] For example, in another possible implementation, please refer to Figure 4 , Figure 4 A schematic diagram of a card making data generation and storage process provided in an embodiment of the present application, wherein the card making data includes ICCID, IMSI, K, OPc, SMSP, PIN, and PUK, wherein ICCID and IMSI are serial numbers, and the system itself is managed according to the numbering, and SMSP is distinguished according to the different cities to which the card belongs, and generally a city is a fixed value, and PIN and PUK are fixed values ​​according to the batch number, among which K and OPc are considered in particular, and the data is subsequently used for authentication of SIM card login, and is a core parameter, and it is necessary to ensure that the data is not dropped in plain text during generation, storage, and transmission.

[0097] The card making system receives the card making request, including the quantity, SIM card manufacturer, city, number segment, etc., and then generates the serial number for this time. It determines the ICCID, IMSI, SMSP, PIN and PUK according to the data selected by the user. The card making system sends the ICCID and serial number to the encryption machine. The encryption machine first generates a random K (32 bytes). The encryption machine uses the storage root key (SM4 type) to disperse the last 8 bytes of the serial number to obtain the dispersed key 1. The dispersed key 1 is dispersed again using the last 8 bytes of the ICCID to obtain the dispersed key 2. The dispersed key 2 is used to perform SM4 encryption on K, and then it is returned to the card making system after encryption (this operation is an atomic operation in the encryption machine, and the encryption machine does not retain any data, and the intermediate data is not retained). The card making system receives the encrypted K and saves it.

[0098] The card making system sends the ICCID and serial number to the encryption machine. The encryption machine first generates a random OPc (32 bytes). The encryption machine uses the storage root key (SM4 type) to disperse the last 8 bytes of the serial number to obtain the dispersed key one, and uses the last 8 bytes of the ICCID to disperse the dispersed key one again to obtain the dispersed key two. The dispersed key two is used to perform SM4 encryption on the OPc, and then returned to the card making system after encryption (this operation is an atomic operation in the encryption machine, and the encryption machine does not retain any data, and the intermediate data is not retained). The card making system receives the encrypted OPc and saves it. After the card making data is generated, the card making system retains the card making serial number, ICCID, IMSI, encrypted K, encrypted OPc, SMSP, PIN, and PUK. During the whole process, no plaintext K and OPc are implemented, and the encryption keys of all K and OPc are different. If a piece of data is decrypted, it will not affect the security of other data.

[0099] In a feasible implementation manner, step S3000 may include steps S3100 to S3500:

[0100] Step S3100: determining target card making data and a card making manufacturer certificate index respectively according to the card making serial batch number and the pre-acquired card making manufacturer code, wherein the target card making data includes a plurality of integrated circuit card identification codes and the SIM card making encrypted data;

[0101] Step S3200: performing secondary distributed encryption based on the pre-generated storage root key, the card production serial batch number, and the integrated circuit card identification code to obtain a mixed distributed key;

[0102] Step S3300: Decrypt the SIM card manufacturing encrypted data using a national encryption algorithm according to the hybrid distributed key to obtain a random encryption key and an operator variant key;

[0103] Step S3400: According to the card manufacturer certificate corresponding to the card manufacturer certificate index, the random encryption key and the operator variant key are encrypted by a second national secret algorithm to obtain a card manufacturer ciphertext random encryption key and a card manufacturer ciphertext operator variant key;

[0104] Step S3500: Generate the card merchant card making file package based on the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key.

[0105] It should be noted that in order to ensure the security of data during transmission from the card-making system to the card manufacturer, in the embodiment of the present application, the target card-making data and the card-making merchant certificate index can be determined according to the card-making serial batch number and the pre-acquired card-making merchant code. The target card-making data includes several integrated circuit card identification codes (ICCIDs) and SIM card making encryption data, where the ICCID is the unique identifier of the SIM card, which is crucial for the identification and management of the SIM card. Next, secondary distributed encryption is performed based on the pre-generated storage root key, the card-making serial batch number and the ICCID to obtain a hybrid distributed key. The national secret SM4 algorithm is used to enhance the security of the key by distributing the key, ensuring that the encrypted data cannot be easily cracked even if the key is leaked.

[0106] Subsequently, the hybrid distributed key is used to decrypt the encrypted data of the SIM card using the national secret algorithm to obtain the random encryption key and the operator variant key. These two keys are the core data in the SIM card authentication process, ensuring the data security when the SIM card is logged in. According to the card manufacturer certificate corresponding to the card manufacturer certificate index, the random encryption key and the operator variant key are encrypted using the second national secret algorithm to obtain the card manufacturer ciphertext random encryption key and the card manufacturer ciphertext operator variant key. This step ensures that only the card manufacturer holding the correct certificate can decrypt and access the SIM card data.

[0107] Finally, a card merchant card-making file package is generated based on the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key. This file package includes the card merchant signature file and the card merchant card-making file. The card merchant card-making file contains the SIM card making configuration information, and the card merchant signature file is used to verify the integrity and authenticity of the file package.

[0108] In addition, it should be noted that the card manufacturer's card making file package generation process involves multiple security measures, including the use of national secret algorithms for encryption, decryption and signing, and the use of the PKI certificate system to ensure the security of data transmission. These measures jointly ensure the security of SIM card data during generation, storage and transmission, and prevent the risk of data leakage and unauthorized access.

[0109] In a feasible implementation, the card making system first generates a card making serial batch number according to the card making request, and retrieves the corresponding ICCID and SIM card making encrypted data. Then, the system uses the storage root key and ICCID for secondary decentralized encryption to obtain a mixed decentralized key. Using this key, the system decrypts the SIM card making encrypted data to obtain a random encryption key and an operator variant key. Next, the system encrypts these keys again according to the card making certificate to obtain the card making random encryption key and the card making operator variant key. Finally, the system packages these keys and SIM card making configuration information into a card making file package, and securely delivers it to the card making merchant offline. After receiving the file package, the card making merchant uses its own private key to decrypt it to obtain the plaintext key, and writes these keys and configuration information into a blank SIM card to complete the production of the SIM card. The entire process follows strict security standards to ensure the security and reliability of the data.

[0110] For example, refer to Figure 5 , Figure 5 A schematic diagram of a card-making data encryption and transmission process to a card merchant is provided for an embodiment of the present application. In another feasible implementation, in order to transmit the card-making data to the card merchant, it is necessary to ensure that K and OPc ciphertexts are transmitted, and it is necessary to ensure that only the corresponding card merchant can decrypt. If other parties obtain the card-making data, they cannot decrypt it. First, the card-making file is transmitted to the card merchant, and K and OPc need to be encrypted. After the user selects the card-making serial number and the card merchant, a card-making file production request is submitted. After receiving the request, the card-making system obtains the corresponding data, ICCID, IMSI, encrypted K (storage encryption), encrypted OPc (storage encryption), SMSP, PIN, PUK, through the card-making serial number. The card-making system searches for the corresponding card merchant configuration in the system according to the card merchant code, determines the certificate index of the card merchant certificate stored in the encryption machine, and sends the serial batch number, ICCID, ciphertext K, and the certificate index corresponding to the card merchant to the encryption machine.

[0111] The encryption machine uses the storage root key (SM4 type) to disperse the last 8 bytes of the serial number to obtain dispersed key one, and then uses the last 8 bytes of the ICCID to disperse dispersed key one again to obtain dispersed key two, and uses dispersed key two to perform SM4 decryption on the ciphertext K. The card merchant certificate is used to encrypt K again to obtain the card merchant ciphertext K (key type SM2), and the card merchant ciphertext K is returned to the card making system (this operation is an atomic operation in the encryption machine, the encryption machine does not retain any data, and no intermediate data is retained). The card making system sends the serial batch number, ICCID, ciphertext OPc, and the certificate index corresponding to the card merchant to the encryption machine. At the same time, the encryption machine uses the storage root key (SM4 type) to disperse the last 8 bytes of the serial number to obtain dispersed key one, and uses the last 8 bytes of the ICCID to disperse the dispersed key one again to obtain dispersed key two. The dispersed key two is used to perform SM4 decryption on the ciphertext OPc, and the card merchant certificate is used again to encrypt OPc to obtain the card merchant ciphertext OPc (key type SM2) and return the card merchant ciphertext OPc to the card making system (this operation is an atomic operation in the encryption machine, the encryption machine does not retain any data, and no intermediate data is retained).

[0112] In a feasible implementation manner, the card merchant card making file package includes a card merchant signature file and a card merchant card making file, and step S3500 may include steps S3510 to S3540:

[0113] Step S3510: Generate the original card making file and the original signature file of the card merchant;

[0114] Step S3520: writing the IC card identification code, the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key, and the pre-acquired SIM card making configuration information into the card merchant making original file to obtain the card merchant making file;

[0115] Step S3530: assembling and signing the signature string based on the file attribute of the card merchant's card making file, the card making serial number, and the pre-acquired card making system private key to obtain a signature string and a string signature value;

[0116] Step S3540: Write the signature string and the string signature value into the card merchant signature original file to obtain the card merchant signature file.

[0117] It should be noted that the card merchant's card-making file package includes the card merchant's signature file and the card merchant's card-making file, where the signature file is used to verify the integrity and authenticity of the file package, and the card-making file contains all the sensitive data required for SIM card production, generating the card merchant's card-making original file and the card merchant's signature original file as the basis for subsequent operations. The card-making system writes the integrated circuit card identification code (ICCID), the card merchant's ciphertext random encryption key and the card merchant's ciphertext operator variant key, as well as the pre-acquired SIM card making configuration information into the card merchant's card-making original file to obtain the card merchant's card-making file. Next, the card-making system assembles and signs the signature string based on the file attributes and card-making serial batch number of the card merchant's card-making file written in the card merchant's card-making file, as well as the pre-acquired card-making system private key, to obtain the signature string and the string signature value. This step ensures the traceability of the source of the file package and the integrity of the content, and prevents the file from being tampered with during transmission.

[0118] Finally, the card making system writes the signature string and string signature value into the card merchant signature original file to obtain the card merchant signature file. This signature file will form a complete card merchant card making file package together with the card making file, which is used to verify the integrity and authenticity of the file package.

[0119] In a feasible implementation, the card making system first generates the card merchant's original card making file and the card merchant's signature original file. Then, the system writes the ICCID, the encrypted K and OPc, and the SIM card making configuration information into the original card making file to form the card merchant's card making file. Next, the system signs the signature string using the card making batch number and the private key to obtain the signature value, and writes the signature string and the signature value into the signature original file to form the card merchant's signature file. Finally, the two files are packaged into a card merchant's card making file package and securely sent to the card merchant. After receiving the file package, the card merchant first verifies the validity of the signature file, then uses its own private key to decrypt and obtain the plaintext key, and writes these keys and configuration information into a blank SIM card to complete the production of the SIM card. The entire process follows strict security standards to ensure the security and reliability of the data.

[0120] For example, please refer again to Figure 5, according to the card manufacturer certificate corresponding to the card manufacturer certificate index, the random encryption key and the operator variant key are encrypted by the second national secret algorithm respectively, and the card manufacturer ciphertext random encryption key, i.e., the card manufacturer ciphertext K, and the card manufacturer ciphertext operator variant key, i.e., the card manufacturer ciphertext OPc, are obtained. Then, the card manufacturing system generates a card manufacturer card manufacturing file, and the card manufacturing file writes ICCID, IMSI, K encrypted by the card manufacturer certificate, OPc encrypted by the card manufacturer certificate, SMSP, PIN, and PUK. The generated card manufacturer card manufacturing file name, size (byte), and card manufacturing serial number are assembled to generate a signature string, and the signature string and the card manufacturing system private key index are sent to the encryption machine. The encryption machine signs the signature string using the private key and returns the signature value. The card manufacturing system writes the signature string and the signature value into the card manufacturer signature file together. The card manufacturing system packages the card manufacturer signature file and the card manufacturer card manufacturing file together, and transmits the packaged file to the card manufacturer in an offline point-to-point manner.

[0121] The embodiment of the present application provides a SIM card data management method, which generates a corresponding card making serial batch number in response to a SIM card making request through a card making system; generates SIM card making encrypted data based on the card making serial batch number and the card making data generation algorithm; generates a card making file package for a card merchant based on the card making serial batch number and the SIM card making encrypted data; sends the card making file package for a card merchant to a target card merchant production system, so that the target card merchant production system reads the card merchant signature file and the card merchant card making file in the card merchant card making file package to perform SIM card production verification. If the production verification passes, the random encryption key and the operator variant key are decrypted respectively according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file, and the above keys and SIM card making configuration information are written into a pre-connected blank SIM card. This solution ensures the security of the entire process of generating, storing and transmitting SIM card making data, thereby improving the security and availability of the card making data management method.

[0122] Based on the above embodiment of the present application, another embodiment of the present application is proposed. For the same or similar contents as the above embodiment, please refer to the above introduction and will not be repeated in the following. Figure 6 The SIM card data management method is applied to the target card manufacturer's production system, including steps A1000 to A3000:

[0123] Step A1000: receiving a card making file package sent by a card making system, wherein the card making file package is generated by the card making system in response to a SIM card making request, generating a card making serial batch number corresponding to the SIM card making request, and generating SIM card making encrypted data based on the card making serial batch number and a preset card making data generation algorithm, and generating the SIM card making encrypted data based on the card making serial batch number and the SIM card making encrypted data;

[0124] Step A2000: decrypt the random encryption key and the operator variant key of the card merchant ciphertext in the card merchant card making file package to obtain the random encryption key and the operator variant key respectively;

[0125] Step A3000: Write the random encryption key and the operator variant key, as well as the SIM card manufacturing configuration information in the card manufacturer's card manufacturing file package into a pre-connected blank SIM card.

[0126] It should be noted that in the embodiment of the present application, the target card manufacturer production system of the SIM card data management method involves a series of operations of receiving, decrypting and writing SIM card data, ensuring the secure transmission and accurate writing of SIM card manufacturing data. The process starts with the card manufacturing system responding to the SIM card manufacturing request, and generating a card manufacturing serial batch number corresponding to the SIM card manufacturing request. This is a unique number used to identify each batch of SIM cards, which helps to track and manage the production process of SIM cards. Based on the batch number and the preset card manufacturing data generation algorithm, the system generates SIM card manufacturing encrypted data, including an encrypted random encryption key and an operator variant key. These data are the key to SIM card authentication and secure communication.

[0127] In addition, it should be noted that the card manufacturer's card making file package generation process involves combining the SIM card making encrypted data with the card making batch number to generate a file package containing sensitive information. When this file package is transmitted to the target card manufacturer's production system, the integrity and confidentiality of the data are ensured, preventing data leakage during the transmission process.

[0128] At the target card merchant production system end, the first operation is to receive the card merchant card making file package sent by the card making system. The file package contains the SIM card making encrypted data. These data are encrypted using the national secret algorithm during transmission to ensure that only authorized card merchants can decrypt and access these data.

[0129] Next, the card manufacturer's production system needs to decrypt the card manufacturer's ciphertext random encryption key and the card manufacturer's key operator variant key in the card manufacturer's card making file package to obtain the random encryption key and the operator variant key. This step is critical because it involves converting the encrypted data back into a readable format so that this critical information can be written to the SIM card.

[0130] Finally, the card manufacturer's production system writes the random encryption key, operator variant key and SIM card manufacturing configuration information into the pre-connected blank SIM card. This step completes the data programming process of the SIM card, allowing the SIM card to be used by the user and ensuring the secure connection between the SIM card and the mobile network.

[0131] For example, in a feasible implementation, the card making system first responds to the SIM card making request, generates a card making serial batch number, and generates SIM card making encrypted data based on the batch number. Then, the card making system packages these encrypted data into a card merchant making file package and sends it to the target card merchant production system. After receiving the file package, the card merchant production system first verifies the validity of the file package, and then uses its private key to decrypt to obtain the random encryption key and the operator variant key. Finally, the card merchant production system writes these keys and SIM card making configuration information into a blank SIM card to complete the production of the SIM card. The entire process ensures the security and integrity of the SIM card data, prevents unauthorized access and data leakage, and protects the interests of operators and users.

[0132] In a feasible implementation manner, the card merchant signature file and the card merchant card making file in the card merchant card making file package further include steps A1100 to A1400 before step A2000:

[0133] Step A1100: Obtain the signature string and string signature value in the card merchant signature file;

[0134] Step A1200: verifying whether the string signature value is correct according to the pre-acquired card making system certificate and the signature string;

[0135] Step A1300: parsing the signature string to obtain the file attributes of the file written by the card merchant when making the card;

[0136] Step A1400: If the file attributes of the card merchant's card making file match the preset file attribute values, and the string signature value is correct, then execute the following steps: decrypt the random encryption key and the operator variant key according to the card merchant's ciphertext random encryption key and the card merchant's ciphertext operator variant key in the card merchant's card making file, respectively.

[0137] It should be noted that the SIM card data management method involves a series of security measures in the SIM card manufacturing implementation process in the target card manufacturer's production system to ensure the integrity, authenticity and security of the SIM card manufacturing file package. The process starts with the card manufacturing system responding to the SIM card manufacturing request and generating a card manufacturing batch number corresponding to the SIM card manufacturing request. This unique identifier is used to track and manage the production process of the SIM card. Based on the batch number and the preset card manufacturing data generation algorithm, the system generates SIM card manufacturing encrypted data, including an encrypted random encryption key and an operator variant key. These data are crucial to the authentication of the SIM card.

[0138] When receiving the card-making file package from the card merchant, the first thing to do is to verify the validity of the signature of the file package. This includes obtaining the signature string and string signature value in the card merchant's signature file, and using the pre-acquired card-making system certificate to verify the correctness of the signature value. Signature verification is a key step to ensure that the file package has not been tampered with. It uses public key infrastructure (PKI) and digital certificates to confirm the source and integrity of the file.

[0139] After verification, the system parses the signature string to obtain the file attributes of the card merchant's card making file. This step is to ensure that the received file matches the expected file attributes, thereby ensuring the consistency and correctness of the data. If the file attributes match the preset values ​​and the signature value is correct, the system will perform a decryption operation, using the card merchant's ciphertext random encryption key and the card merchant's ciphertext operator variant key to decrypt the random encryption key and operator variant key.

[0140] In addition, it should be noted that the decryption process of these keys is a prerequisite for secure writing to the SIM card. The random encryption key and the operator variant key are the core data in the SIM card authentication process. Their secure transmission and decryption are essential to ensure that the SIM card can correctly log in and use the mobile network. After the verification and decryption steps, the system writes these keys and the SIM card configuration information into the pre-connected blank SIM card to complete the production of the SIM card.

[0141] In a feasible implementation, the card making system first generates a card making serial batch number, and generates SIM card making encrypted data based on the batch number. Then, the system packages these data into a card merchant card making file package and sends it to the target card merchant production system. After receiving the file package, the card merchant production system first reads the signature value and signature string in the card merchant signature file, and uses the public key of the card making system to verify the correctness of the signature. Once the signature verification is passed, the system will parse the signature string to confirm the file attributes, and after a successful match, use the card merchant's private key to decrypt and obtain the random encryption key and operator variant key. Finally, these keys and configuration information are securely written into a blank SIM card to complete the production of the SIM card. The entire process ensures the security and integrity of the SIM card data, prevents unauthorized access and data leakage, and protects the interests of operators and users.

[0142] For example, refer to Figure 7 , Figure 7 A schematic diagram of a merchant decryption and card making process is provided for an embodiment of the present application. In another feasible implementation, the card making system packages the merchant signature file and the merchant card making file together, and delivers the packaged file to the merchant point-to-point offline.

[0143] The card manufacturer's card-making system first reads the signature file, obtains the signature value and signature string, queries the index of the card-making system certificate in the encryption machine, and sends the above data to the encryption machine for signature verification. The encryption machine uses the card-making system's certificate to verify whether the signature value is correct based on the signature string, and feeds back the signature verification result to the card manufacturer's production system. If the signature is abnormal, the production of the SIM card will be suspended and all files and card-making data will be discarded. If the signature is correct, the card-making file name and file size are obtained from the signature string to verify whether the card-making file name and size are correct. If correct, all data in the card-making file will be read. If incorrect, all files and card-making data will be discarded.

[0144] After the above two verifications are passed, the card merchant's ciphertext K and the key index of the card merchant's private key are sent to the encryption machine, which decrypts and returns the plaintext K. The card merchant's ciphertext OPc and the key index of the card merchant's private key are sent to the encryption machine, which decrypts and returns the plaintext OPc. The card merchant's production system writes ICCID, IMSI, plaintext K, plaintext OPc, SMSP, PIN, and PUK into a blank SIM card to complete the SIM card production. The card merchant's production system is completely closed and does not leave any logs or other data. Regular inspections are performed to ensure data security.

[0145] The embodiment of the present application provides a SIM card data management method, which receives a card merchant card making file package sent by a card making system through a target card merchant production system, wherein the card merchant card making file package is generated by the card making system in response to a SIM card making request, generates a card making serial batch number corresponding to the SIM card making request, generates SIM card making encrypted data based on the card making serial batch number and a preset card making data generation algorithm, and generates based on the card making serial batch number and the SIM card making encrypted data; decrypts the random encryption key of the card merchant ciphertext and the card merchant ciphertext operator variant key in the card merchant card making file package to obtain a random encryption key and an operator variant key respectively; writes the random encryption key and the operator variant key, as well as the SIM card making configuration information in the card merchant card making file package into a pre-connected blank SIM card, and through this solution, ensures the security of the entire process of generating, storing and transmitting SIM card making data, thereby improving the security and availability of the card making data management method.

[0146] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the SIM card data management method of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0147] Please refer to Figure 8 The present application also provides a SIM card data management device, the SIM card data management device comprising:

[0148] The first generating module 81 is used to generate a card making serial batch number corresponding to the SIM card making request in response to the SIM card making request;

[0149] The second generating module 82 is used to generate SIM card production encrypted data based on the card production batch number and a preset card production data generation algorithm;

[0150] The third generating module 83 is used to generate a card making file package for a card merchant based on the card making serial batch number and the SIM card making encrypted data;

[0151] The sending module 84 is used to send the card merchant card making file package to the target card merchant production system, so that the target card merchant production system receives the card merchant card making file package, decrypts the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, and writes the random encryption key and the operator variant key, as well as the SIM card making configuration information in the card merchant card making file into a pre-connected blank SIM card.

[0152] The SIM card data management device provided by the present application adopts the SIM card data management method in the above embodiment, which can solve the technical problem of SIM card data management. Compared with the prior art, the beneficial effects of the SIM card data management device provided by the present application are the same as the beneficial effects of the SIM card data management method provided by the above embodiment, and other technical features in the SIM card data management device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0153] The present application provides a SIM card data management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the SIM card data management method in the above-mentioned embodiment 1.

[0154] Reference below Fig. 9, which shows a schematic diagram of the structure of a SIM card data management device suitable for implementing an embodiment of the present application. The SIM card data management device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The SIM card data management device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0155] like Fig. 9 As shown, the SIM card data management device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the SIM card data management device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the SIM card data management device to communicate with other devices wirelessly or by wire to exchange data. Although the SIM card data management device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0156] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0157] The SIM card data management device provided in the present application adopts the SIM card data management method in the above embodiment. Compared with the prior art, the beneficial effects of the SIM card data management device provided in the present application are the same as the beneficial effects of the SIM card data management method provided in the above embodiment, and other technical features in the SIM card data management device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0158] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0159] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0160] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the SIM card data management method in the above-mentioned embodiment.

[0161] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0162] The computer-readable storage medium may be included in the SIM card data management device; or may exist independently without being assembled into the SIM card data management device.

[0163] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0164] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0165] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0166] The readable storage medium provided in the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned SIM card data management method, and can solve the technical problem of SIM card data management. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the present application are the same as the beneficial effects of the SIM card data management method provided in the above-mentioned embodiment, and will not be repeated here.

[0167] The present application also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned SIM card data management method are implemented.

[0168] The computer program product provided by this application can solve the technical problem of SIM card data management. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the SIM card data management method provided by the above embodiment, which will not be repeated here.

[0169] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A SIM card data management method, characterized in that: The method is applied to a card making system, comprising: In response to a SIM card production request, generating a card production serial batch number corresponding to the SIM card production request; Generate SIM card production encrypted data based on the card production batch number and a preset card production data generation algorithm; Generate a card manufacturer's card making file package based on the card making serial batch number and the SIM card making encrypted data; The card merchant card making file package is sent to the target card merchant production system, so that the target card merchant production system receives the card merchant card making file package, decrypts the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, respectively, and writes the random encryption key and the operator variant key, as well as the SIM card making configuration information in the card merchant card making file into a pre-connected blank SIM card.

2. The method according to claim 1, characterized in that The SIM card manufacturing encrypted data includes an encrypted random encryption key and an encrypted operator variant key. The step of generating the SIM card manufacturing encrypted data based on the manufacturing serial batch number and a preset manufacturing data generation algorithm includes: Obtaining a number of integrated circuit card identification codes corresponding to the card production serial batch number; Generate random encryption keys and operator variant keys based on a preset system encryption machine; Perform secondary distributed encryption according to the pre-generated storage root key, the batch number of the card production serial number, and the integrated circuit card identification code to obtain a mixed distributed key; According to the mixed distributed key, the random encryption key and the operator variant key are encrypted by a first national secret algorithm to obtain the encrypted random encryption key and the encrypted operator variant key.

3. The method according to claim 1, characterized in that The step of generating a card manufacturer's card making file package based on the card making serial batch number and the SIM card making encrypted data comprises: According to the card production batch number and the pre-acquired card production manufacturer code, target card production data and card production manufacturer certificate index are determined respectively, wherein the target card production data includes a number of integrated circuit card identification codes and the SIM card production encryption data; Perform secondary distributed encryption based on the pre-generated storage root key, the card production batch number, and the integrated circuit card identification code to obtain a mixed distributed key; According to the mixed distributed key, the SIM card manufacturing encrypted data is decrypted by the national secret algorithm to obtain a random encryption key and an operator variant key; According to the card manufacturer certificate corresponding to the card manufacturer certificate index, the random encryption key and the operator variant key are encrypted by a second national secret algorithm to obtain a card manufacturer ciphertext random encryption key and a card manufacturer ciphertext operator variant key; The card merchant card making file package is generated based on the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key.

4. The method according to claim 3, characterized in that The card merchant card making file package includes a card merchant signature file and a card merchant card making file. The step of generating the card merchant card making file package based on the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key includes: Generate original card making files and original signature files of card merchants; Write the integrated circuit card identification code, the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key, and the pre-acquired SIM card making configuration information into the card merchant making original file to obtain the card merchant making file; Assemble and sign the signature string based on the file attribute of the card merchant's card making file, the card making serial number, and the pre-acquired card making system private key to obtain a signature string and a string signature value; The signature string and the string signature value are written into the card merchant signature original file to obtain the card merchant signature file.

5. A SIM card data management method, characterized in that: The method is applied to a target card manufacturer production system, and includes: Receiving a card making file package sent by a card making system, wherein the card making file package is generated by the card making system in response to a SIM card making request, generating a card making serial batch number corresponding to the SIM card making request, and generating SIM card making encrypted data based on the card making serial batch number and a preset card making data generation algorithm, and generating the SIM card making encrypted data based on the card making serial batch number and the SIM card making encrypted data; Decrypt the random encryption key and the operator variant key of the card merchant ciphertext in the card merchant card making file package to obtain the random encryption key and the operator variant key respectively; The random encryption key and the operator variant key, as well as the SIM card manufacturing configuration information in the card manufacturer's card manufacturing file package are written into a pre-connected blank SIM card.

6. The method according to claim 2, characterized in that The card merchant signature file and the card merchant card making file in the card merchant card making file package, the step of decrypting the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, respectively, also includes: Obtain the signature string and string signature value in the card merchant signature file; Verify whether the string signature value is correct based on the pre-acquired card making system certificate and the signature string; Parse the signature string to obtain the file attributes of the file written by the card merchant when making the card; If the file attributes of the card merchant's card making file match the preset file attribute values, and the string signature value is correct, execute the following steps: decrypt the random encryption key and the operator variant key in the card merchant's ciphertext in the card merchant's card making file respectively to obtain the random encryption key and the operator variant key.

7. A SIM card data management device, characterized in that: The device comprises: A first generating module, configured to generate a card making serial batch number corresponding to a SIM card making request in response to the SIM card making request; A second generating module is used to generate SIM card production encrypted data based on the card production serial batch number and a preset card production data generation algorithm; A third generating module is used to generate a card making file package for a card merchant based on the card making serial batch number and the SIM card making encrypted data; A sending module is used to send the card merchant card making file package to the target card merchant production system, so that the target card merchant production system receives the card merchant card making file package, decrypts the random encryption key and the operator variant key according to the card merchant ciphertext random encryption key and the card merchant ciphertext operator variant key in the card merchant card making file package, and writes the random encryption key and the operator variant key, as well as the SIM card making configuration information in the card merchant card making file into a pre-connected blank SIM card.

8. A SIM card data management device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the SIM card data management method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the SIM card data management method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the SIM card data management method according to any one of claims 1 to 6 are implemented.

Images