Data transmission method and device, electronic equipment and storage medium

Abstract

The invention relates to a data transmission method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring a master key synchronized between an SIM card and a core network in the authentication process of the SIM card and the core network; performing key derivation based on the master key to obtain a candidate key; in response to a sending instruction of target service data, determining a target key in the candidate keys; and encrypting the target service data by using the target key, and sending the encrypted target service data to the communication opposite end. The method is essentially characterized in that after the SIM card and the core network are authenticated, the service data are protected by adopting the secret key, so that the user data can be prevented from being attacked and stolen.

Description

Technical Field

[0001] The present disclosure relates to the field of mobile communication technology, and in particular to a data transmission method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of mobile networks, the security of mobile devices has received increasing attention. Currently, when a mobile device connects to an operator's network, it usually needs to use a SIM card for authentication to complete identity verification. After authentication, the mobile device can use the operator's network. However, the security of business data transmitted between the mobile device and the operator's network is often ignored. Under this traditional communication method, the network security mechanism has poor protection effect on user data and is vulnerable to attacks and theft. Summary of the invention

[0003] In order to solve the above technical problem or at least partially solve the above technical problem, the present disclosure provides a data transmission method, device, electronic device and storage medium.

[0004] In a first aspect, the present disclosure provides a data transmission method, comprising:

[0005] Acquire a master key synchronized between the SIM card and the core network during authentication between the SIM card and the core network;

[0006] Based on the master key, perform key derivation to obtain a candidate key;

[0007] In response to a sending instruction of the target service data, determining a target key from the candidate keys;

[0008] The target business data is encrypted using the target key, and the encrypted target business data is sent to the communication peer.

[0009] In a second aspect, the present disclosure further provides a data transmission device, including:

[0010] An acquisition module, used to acquire a master key synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network;

[0011] A derivation module, used to perform key derivation based on the master key to obtain a candidate key;

[0012] A determination module, configured to determine a target key from among the candidate keys in response to a receiving instruction of target business data;

[0013] The encryption module is used to encrypt the target business data using the target key and send the encrypted target business data to the communication peer.

[0014] In a third aspect, the present disclosure further provides an electronic device, including: a processor and a memory;

[0015] The processor is used to execute the steps of any of the above methods by calling the program or instruction stored in the memory.

[0016] In a fourth aspect, the present disclosure further provides a computer-readable storage medium, which stores a program or instruction, and the program or instruction enables a computer to execute the steps of any of the above methods.

[0017] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0018] The technical solution provided by the embodiment of the present disclosure is to obtain the master key synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network; derive the key based on the master key to obtain the candidate key; determine the target key in the candidate key in response to the instruction to send the target service data; encrypt the target service data using the target key, and send the encrypted target service data to the communication peer. Its essence is to use the key to protect the service data after the SIM card and the core network are authenticated, so that the user data can be protected from attacks and theft. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0021] Figure 1 A data transmission method provided by an embodiment of the present disclosure;

[0022] Figure 2 A schematic diagram of the structure of a data transmission device proposed in an embodiment of the present disclosure;

[0023] Figure 3 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0025] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0026] Figure 1 A data transmission method provided by an embodiment of the present disclosure, the execution subject of the method may be a terminal or a core network device. Figure 1 , the method comprising:

[0027] S110: Acquire a master key synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network.

[0028] The master key is used to generate or derive other keys. The master key is synchronized during the authentication process between the SIM card and the core network.

[0029] There are many implementation methods for this step, which are not limited in this application. Exemplarily, the implementation method for this step may include: obtaining a random number synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network; and determining a master key based on the random number.

[0030] Furthermore, the random number can be used as the master key; or a specific operation is performed on the random number, and the operation result is used as the master key. Optionally, the master key can include CK (Cipher Key) and IK (Integrity Key).

[0031] In some embodiments, when a user applies for a SIM card, the operator will generate a unique shared key for the user in the authentication center of its core network. The shared key will be bound to the user's IMSI (International Mobile Subscriber Identity) and written into the user's SIM card and core network database. When the terminal installed with the SIM card is turned on or enters a new network area, the SIM card initiates an authentication request, which contains the user's IMSI. After receiving the authentication request, the core network finds the corresponding shared key according to the user's IMSI, and uses the preset algorithm and the shared key to generate a random number (RAND). The core network uses the shared key, the random number (RAND) and the predefined encryption algorithm to calculate the expected response value (XRES), authentication token (AUTN) and other authentication parameters. The core network sends the random number (RAND) and the authentication token (AUTN) to the SIM card. After receiving the random number (RAND) and the authentication token (AUTN), the SIM card uses the shared key stored in the card and the same encryption algorithm as the core network to calculate the response value (RES) and other parameters. The SIM card sends the calculated response value (RES) back to the core network, and the core network compares the received response value RES with the expected response value (XRES) calculated previously. If the two are consistent, the authentication is successful and the terminal can access the network; if they are inconsistent, the authentication fails.

[0032] It should be emphasized that in practice, in the process of authentication between the SIM card and the core network, a random number is necessary, but after the two have completed the authentication, the random number is usually no longer used. In this application, by setting a master key based on a random number, the random number used in the authentication process between the SIM card and the core network is actually reused for a second time, which will not affect the authentication process between the SIM card and the core network.

[0033] Those skilled in the art can understand that since the random number is random, this means that different random numbers are used for authentication between the SIM card and the core network at different times. The master key obtained based on the random number is also different, and the candidate key obtained subsequently is different. In this way, the master key generated after each authentication is unique, which improves the security and anti-attack capability of the system.

[0034] S120: Based on the master key, perform key derivation to obtain a candidate key.

[0035] There are many ways to implement this step, and this application does not limit this. For example, a key derivation algorithm can be used to derive a key based on a master key to obtain a candidate key. The number of the following keys can be one or more.

[0036] In some embodiments, a key derivation algorithm may be used to derive multiple candidate keys, and a corresponding usage scenario may be set for each candidate key.

[0037] Specifically, in some exemplary embodiments, a key derivation algorithm can be used to derive multiple candidate keys, and different candidate keys correspond to different applications. Later, when it is necessary to encrypt business data sent to a communication peer, or to decrypt business data received from a communication peer, a candidate key is selected according to the application to which the business data belongs.

[0038] In some other exemplary embodiments, the master key can be derived using a first key derivation algorithm to obtain multiple root keys; each root key can be derived using a second key derivation algorithm to obtain a candidate key corresponding to the root key; the candidate keys corresponding to the same root key are added to the same key set; the correspondence between the key set and the application, and the correspondence between the candidate key and the business type in the key set are set. In this way, different key sets can correspond to different applications. In the same key set, different candidate keys correspond to different business types. Later, when it is necessary to encrypt business data sent to the communication peer, or to decrypt business data received from the communication peer, the candidate key is selected according to the application to which the business data belongs and the business type of the business data.

[0039] Optionally, the first key derivation algorithm is the national secret SM3 algorithm or the national secret SM4 algorithm. The second key derivation algorithm is the national secret SM3 algorithm or the national secret SM4 algorithm.

[0040] S130. In response to an instruction to send target business data, determine a target key from candidate keys.

[0041] The essence of this step is to select the key to be used for the target business data from all candidate keys.

[0042] There are many methods for implementing this step, and this application does not limit this. For example, if there are multiple candidate keys; multiple candidate keys constitute multiple key sets; different key sets correspond to different applications; the implementation method of this step includes: responding to the sending instruction of the target business data, determining the target application, the target application corresponds to the target business data; determining the target key set in multiple key sets, the target key set corresponds to the target application; determining the target key in the target key set.

[0043] Furthermore, if the key set includes multiple keys; different keys correspond to different business types; determining the target key in the target key set includes: determining the business type of the target business data; and determining the target key in the target key set based on the business type of the target business data.

[0044] Exemplarily, it is assumed that there are two key sets, namely key set 1 and key set 2, key set 1 corresponds to application 1, and key set 2 corresponds to application 2. Key set 1 includes key 1, key 2 and key 3. The business type corresponding to key 1 is transaction data, the business type corresponding to key 2 is log data, and the business type corresponding to key 3 is geographic location data. If the business type of the target business data currently to be sent to the communication peer is transaction data, and the target business data is the data to be transmitted during the use of application 1. Therefore, key set 1 is determined to be the target key set, key 1 is the target key, and key 1 is subsequently used to encrypt the target business data.

[0045] Those skilled in the art can understand that, in practice, the more detailed the usage scenarios corresponding to the candidate keys are, the more comprehensive and detailed the protection of business data is, and the more perfect the network security mechanism is. This is because when different business scenarios (such as applications and / or business types) correspond to different keys, even if a key is compromised, it will not affect the security of other business scenarios, thereby improving the security and reliability of the overall network.

[0046] S140: Encrypt the target business data using the target key, and send the encrypted target business data to the communication peer.

[0047] The above technical solution is to obtain the master key synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network; derive the key based on the master key to obtain the candidate key; determine the target key from the candidate key in response to the instruction to send the target service data; encrypt the target service data using the target key, and send the encrypted target service data to the communication peer. Its essence is to use the key to protect the service data after the SIM card and the core network are authenticated, so that the user data can be protected from attacks and theft.

[0048] Based on the above technical solution, optionally, after each step of SIM card authentication with core network is performed, the candidate key is updated once. The purpose of this setting is to increase the updating frequency of candidate keys, ensure the uniqueness and freshness of passwords, and effectively prevent security threats such as key reuse and data tampering.

[0049] On the basis of the above technical solutions, optionally, the key set is stored in a security chip of the terminal.

[0050] The security chip is usually an independent hardware module, isolated from the main system. Even if the main system is compromised, it is difficult for the attacker to directly access the key stored in the security chip. The security chip is also tamper-proof.

[0051] Storing the key set in the terminal's security chip can limit the security of the candidate keys.

[0052] Furthermore, the method further comprises:

[0053] In response to a receiving instruction of target business data, determining a target key from candidate keys;

[0054] The target service data received from the communication peer is decrypted using the target key.

[0055] It should also be emphasized that when using the technical solution provided by this application for data transmission, the communication end device and the communication end device need to use the master key synchronized between the SIM card and the core network in the same SIM card and core network authentication process, and each use the corresponding derivation algorithm to derive the password to obtain the candidate key. In this way, the candidate keys in the communication end device and the communication end device can be consistent.

[0056] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0057] Figure 2 This is a schematic diagram of the structure of the data transmission device proposed in the embodiment of the present disclosure. Figure 2 As shown, the device comprises:

[0058] An acquisition module 210 is used to acquire a master key synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network;

[0059] A derivation module 220, configured to perform key derivation based on the master key to obtain a candidate key;

[0060] A determination module 230, configured to determine a target key from the candidate keys in response to a receiving instruction of target business data;

[0061] The encryption module 240 is used to encrypt the target business data using the target key and send the encrypted target business data to the communication peer.

[0062] Furthermore, a module is obtained for:

[0063] Acquire a random number synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network;

[0064] Based on the random number, a master key is determined.

[0065] Furthermore, there are multiple candidate keys; the multiple candidate keys constitute multiple key sets; different key sets correspond to different applications; the determination module is used for;

[0066] In response to a sending instruction of the target business data, determining a target application, the target application corresponding to the target business data;

[0067] Determine a target key set among the multiple key sets, wherein the target key set corresponds to the target application;

[0068] A target key is determined in the target key set.

[0069] Furthermore, the key set includes multiple keys; different keys correspond to different business types;

[0070] Determine the module for:

[0071] Determine the business type of the target business data;

[0072] Based on the service type of the target service data, a target key is determined in the target key set.

[0073] Further, a derived module is used for;

[0074] Using a first key derivation algorithm, deriving the master key to obtain multiple root keys;

[0075] Using a second key derivation algorithm, derive each of the root keys to obtain a candidate key corresponding to the root key;

[0076] Add candidate keys corresponding to the same root key to the same key set;

[0077] The corresponding relationship between the key set and the application, and the corresponding relationship between the candidate keys in the key set and the service type are set.

[0078] Furthermore, a module is derived for:

[0079] After each execution of the step of authenticating the SIM card with the core network, the candidate key is updated once.

[0080] Furthermore, the device also includes a storage module, which is used to:

[0081] The key set is stored in a security chip of the terminal.

[0082] The device disclosed in the above embodiments can implement the process of the method disclosed in the above method embodiments, and has the same or corresponding beneficial effects. To avoid repetition, it will not be described here.

[0083] Figure 3 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure is shown in FIG. Figure 3 As shown, the electronic device may include a smart terminal such as a mobile phone or a PAD, and the electronic device may be a core network device. The electronic device includes:

[0084] One or more processors 301, Figure 3 A processor 301 is taken as an example;

[0085] Memory 302;

[0086] The electronic device may further include: an input device 303 and an output device 304 .

[0087] The processor 301, memory 302, input device 303 and output device 304 in the electronic device may be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0088] The memory 302 is a non-transitory computer-readable storage medium that can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the data transmission method in the embodiment of the present disclosure. The processor 301 executes various functional applications and data processing of the server by running the software programs, instructions and modules stored in the memory 302, that is, the data transmission method of the above method embodiment is implemented.

[0089] The memory 302 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 302 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 302 may optionally include a memory remotely arranged relative to the processor 301, and these remote memories may be connected to the terminal device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] The input device 303 may be used to receive input digital or character information and generate signal input related to user settings and function control of the electronic device. The output device 304 may include a display device such as a display screen.

[0091] The embodiment of the present disclosure also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute a data transmission method when executed, the method comprising:

[0092] Acquire a master key synchronized between the SIM card and the core network during authentication between the SIM card and the core network;

[0093] Based on the master key, perform key derivation to obtain a candidate key;

[0094] In response to a sending instruction of the target service data, determining a target key from the candidate keys;

[0095] The target business data is encrypted using the target key, and the encrypted target business data is sent to the communication peer.

[0096] Optionally, the computer executable instructions, when executed by a computer processor, may also be used to execute the technical solution of the data transmission method provided by any embodiment of the present disclosure.

[0097] Through the above description of the implementation methods, the technical personnel in the relevant field can clearly understand that the present disclosure can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure can be essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0098] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0099] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data transmission method, characterized in that: include: Acquire a master key synchronized between the SIM card and the core network during authentication between the SIM card and the core network; Based on the master key, perform key derivation to obtain a candidate key; In response to a sending instruction of the target service data, determining a target key from the candidate keys; The target business data is encrypted using the target key, and the encrypted target business data is sent to the communication peer.

2. The data transmission method according to claim 1, characterized in that: The obtaining of a master key synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network includes: Acquire a random number synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network; Based on the random number, a master key is determined.

3. The data transmission method according to claim 1, characterized in that; There are multiple candidate keys; the multiple candidate keys constitute multiple key sets; different key sets correspond to different applications; The step of determining the target key from the candidate keys in response to the instruction to send the target service data comprises: In response to a sending instruction of the target business data, determining a target application, the target application corresponding to the target business data; Determine a target key set among the multiple key sets, wherein the target key set corresponds to the target application; A target key is determined in the target key set.

4. The data transmission method according to claim 3, characterized in that: The key set includes multiple keys; different keys correspond to different business types; Determining the target key in the target key set includes: Determine the business type of the target business data; Based on the service type of the target service data, a target key is determined in the target key set.

5. The data transmission method according to claim 4, characterized in that: The step of performing key derivation based on the master key to obtain a candidate key; Using a first key derivation algorithm, deriving the master key to obtain multiple root keys; Using a second key derivation algorithm, derive each of the root keys to obtain a candidate key corresponding to the root key; Add candidate keys corresponding to the same root key to the same key set; The corresponding relationship between the key set and the application, and the corresponding relationship between the candidate keys in the key set and the service type are set.

6. The data transmission method according to claim 1, characterized in that: Also includes: After each execution of the step of authenticating the SIM card with the core network, the candidate key is updated once.

7. The data transmission method according to claim 3, characterized in that: The key set is stored in a security chip of the terminal.

8. A data transmission device, characterized in that: include: An acquisition module, used to acquire a master key synchronized between the SIM card and the core network during the authentication process between the SIM card and the core network; A derivation module, used to perform key derivation based on the master key to obtain a candidate key; A determination module, configured to determine a target key from among the candidate keys in response to a receiving instruction of target business data; The encryption module is used to encrypt the target business data using the target key and send the encrypted target business data to the communication peer.

9. An electronic device, characterized in that: include: Processor and memory; The processor is used to execute the steps of the method according to any one of claims 1 to 7 by calling the program or instruction stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute the steps of the method according to any one of claims 1 to 7.

Images