Embedded SIM card encryption protection method, system and medium

Abstract

The present invention provides an embedded SIM card encryption protection method, system and medium. The method binds the EID of the embedded SIM card with the CPUID and SN number of the device during the device production process, generates unique signature data through a signature server, and then performs a verification process of the embedded SIM card each time the device is turned on to verify the validity of the signature data and compare the stored CPUID and EID with the actual value of the device. If all the verifications are successful, the device will start normally; if any of the verification results fails, the device will be locked in recovery mode, and the situation that the embedded SIM card has been replaced or damaged can be discovered in time, preventing the stolen embedded SIM card from continuing to be used on other devices, thereby fundamentally solving the problem of embedded SIM theft.

Description

Technical Field

[0001] The technical field of the present invention belongs to communication technology, and in particular, relates to an embedded SIM card encryption protection method, system and medium. Background Art

[0002] Embedded SIM (Embedded SIM card) is a SIM card built into a device. Unlike traditional physical SIM cards, embedded SIM cards are pre-installed on the motherboard when the device leaves the factory. Users can remotely activate and configure them through the network to select and switch operators. Embedded SIM technology is widely used in smart communication devices, IoT devices, and the automotive industry. It marks a major advancement in the field of mobile communications and significantly improves the flexibility and convenience of devices. However, with the widespread application of embedded SIM technology, users' communication security is also facing challenges. At present, the vast majority of terminal devices using embedded SIM cards on the market have not taken effective security measures, which makes embedded SIM cards at risk of being maliciously stolen or replaced for illegal activities such as telecommunications fraud, which may cause users to suffer significant losses. Summary of the invention

[0003] The purpose of the present invention is to provide an encryption protection method, system and medium for an embedded SIM card, aiming to solve the problem that most terminal devices on the current market lack security protection measures when using embedded SIM cards, resulting in the embedded SIM cards being maliciously stolen or replaced.

[0004] In a first aspect of the present invention, there is provided an encryption protection method for an embedded SIM card, comprising the following steps:

[0005] The production server reads the device’s CPUID, SN number, and EID information of the embedded SIM card;

[0006] Send the read information to the signature server;

[0007] The signature server signs the read information to generate signature data;

[0008] Returning the signature data to the production server;

[0009] The production server stores the signature data in the Modem partition of the device;

[0010] Each time the device is turned on, the signature data is read and a verification process of the embedded SIM card is performed, and a decision is made based on the verification result whether the device is turned on normally or enters recovery mode.

[0011] Preferably, the signature server signs the read information using a two-level key, wherein the two-level key includes a root key and a device key;

[0012] The root key includes a root public key and a root private key, and the device key includes a device public key and a device private key;

[0013] The root key is used to protect the public key part of the device key, and the device key is used to protect the binding relationship between CPUID and EID.

[0014] Preferably, the signature data includes the following fields: device public key, device public key signature, data and data signature;

[0015] The device public key field is stored in the signature data by the device public key;

[0016] The device public key signature field is generated by signing the device public key and SN number using the root private key;

[0017] The data field is encapsulated by CPUID and EID in a fixed format;

[0018] The data signature field is generated by signing the data field using the device private key.

[0019] Preferably, the verification process steps include:

[0020] Step S1: Read the signature data stored in the Modem partition of the device;

[0021] Step S2: Using the root public key to verify the validity of the device public key signature;

[0022] Step S3: using the device public key to verify the validity of the data signature;

[0023] Step S4: Read the actual CPUID and EID of the device, and compare them with the CPUID and EID stored in the signature data.

[0024] Preferably, when reading the signature data stored in the Modem partition of the device, if reading the signature data is successful, the verification of step S2 is continued; if reading the signature data fails, the device enters the recovery mode.

[0025] Preferably, the using the root public key to verify the validity of the device public key signature includes reading signature data, and using the root public key and device public key in the signature data, and the SN number in the device to verify the validity of the device public key signature;

[0026] If the verification is successful, the signature is valid and the verification continues in step S3; otherwise, the signature is invalid and the device enters recovery mode.

[0027] Preferably, the using the device public key to verify the validity of the data signature includes reading the signature data, and using the device public key in the signature data, and a data field consisting of CPUID and EID to verify the validity of the data signature;

[0028] If the verification is successful, the signature is valid and the verification continues in step S4; otherwise, the signature is invalid and the device enters recovery mode.

[0029] Preferably, if all steps S1-S4 are verified successfully, the device starts normally;

[0030] If any of steps S1-S4 fails to be verified, the device enters recovery mode and prompts the user that the embedded SIM is abnormal.

[0031] In a second aspect of the present invention, there is also provided an encryption protection system for an embedded SIM card, comprising a production server, a signature server, a device and a verification module;

[0032] The production server is used to read the device information and send it to the signature server;

[0033] The signature server is used to sign the device information and generate signature data;

[0034] The Modem partition in the device is used to store signature data;

[0035] The verification module is integrated in the device and is used to read the signature data and execute the verification process when the device is turned on.

[0036] In a third aspect of the present invention, a computer-readable storage medium is provided, wherein program instructions are stored in the computer-readable storage medium, and when the program instructions are executed, they are used to implement the method of the first aspect.

[0037] Compared with the prior art, the present invention has at least the following technical effects:

[0038] By binding the embedded SIM card to the device hardware and generating unchangeable signature data through the signature server, the embedded SIM card is protected, thereby improving security. And every time the device is turned on, by verifying the validity of the signature data, it is possible to promptly detect the replacement or damage of the embedded SIM card, effectively preventing potential security risks. In addition, by locking the device in recovery mode, it is possible to prevent the stolen embedded SIM card from continuing to be used on other devices, thereby fundamentally solving the problem of embedded SIM theft. Furthermore, the use of a two-level key signature mechanism can enhance the encryption strength, making it difficult to crack or forge the signature data, thereby reducing the risk of the embedded SIM card being maliciously stolen or replaced. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A method flow chart of an encryption protection method for an embedded SIM card in one embodiment of the present invention;

[0040] Figure 2 This is a flow chart of a method for processing an embedded SIM card when a device is produced in a factory in one embodiment of the present invention;

[0041] Figure 3 The figure is a detailed flow chart of verifying the embedded SIM card after the device is turned on at the factory in one embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will be described in more detail with reference to the schematic diagram of an embedded SIM card encryption protection method, system and medium of the present invention, wherein the preferred embodiment of the present invention is shown, and it should be understood that those skilled in the art can modify the present invention described herein, while still achieving the beneficial effects of the present invention. Therefore, the following description should be understood as being widely known to those skilled in the art, and not as a limitation of the present invention.

[0043] For the sake of clarity, not all features of the actual embodiments are described. In the following description, well-known functions and structures are not described in detail because they would clutter the invention with unnecessary detail. It should be recognized that in the development of any actual embodiment, a large number of implementation details must be made to achieve the developer's specific goals, such as changing from one embodiment to another according to the limitations of the relevant system or the relevant business. In addition, it should be recognized that such development work may be complex and time-consuming, but it is just a routine task for those skilled in the art.

[0044] The present invention is described in more detail in the following paragraphs by way of example with reference to the accompanying drawings. The advantages and features of the present invention will become more apparent from the following description. It should be noted that the accompanying drawings are in very simplified form and are not in exact proportions, and are only used to facilitate and clearly assist in illustrating the purpose of the embodiments of the present invention.

[0045] Embodiment 1

[0046] like Figure 1 As shown, in this embodiment 1, an encryption protection method for an embedded SIM card is proposed, comprising the following steps:

[0047] The production server reads the device’s CPUID, SN number, and EID information of the embedded SIM card;

[0048] Send the read information to the signature server;

[0049] The signature server signs the read information to generate signature data;

[0050] Returning the signature data to the production server;

[0051] The production server stores the signature data in the Modem partition of the device;

[0052] Each time the device is turned on, the signature data is read and a verification process of the embedded SIM card is performed, and a decision is made based on the verification result whether the device is turned on normally or enters recovery mode.

[0053] Specifically, Figure 2 As shown, when the device is produced in the factory, the method flow includes the following steps:

[0054] Step 101: When the device is manufactured in the factory, the production server aggregates the device's CPUID, SN number, and EID information of the embedded SIM card (also called eSIM card) and sends them to the signature server.

[0055] Specifically, after the device is manufactured in the factory, the production server reads the device's CPUID, SN number, and EID information of the embedded SIM card. Among them, the CPUID is generated by the chip supplier when it leaves the factory, indicating the unique identifier of the device's central processor, which is unique. The SN number is generated when the device is manufactured, indicating the serial number of the device, which is also unique. EID represents the unique identifier of the embedded SIM card, which is also unique. The purpose of this information reading step is to obtain the unique identification information of the device, which will be used in the subsequent signing process.

[0056] In addition, the signature server uses a two-level key to sign the read information, and the two-level key includes a root key and a device key. The root key is a pair of public and private keys, including a root public key (denoted as root_pub_key) and a root private key (denoted as root_priv_key). The root public key is stored in the signature server, and the root private key is stored in the software code of the device. The device key is a pair of public and private keys generated for each device, including a device public key (denoted as dev_pub_key) and a device private key (denoted as dev_priv_key), and the device key is randomly generated when signing on the signature server. The root key is used to protect the device public key part of the device key, and the device key is used to verify the binding relationship between the CPUID of the protection device and the EID of the embedded SIM card.

[0057] Step 102: The production server aggregates the read information and sends it to the signature server for signing, generates signature data, and returns it to the production server.

[0058] Specifically, the generated signature data includes the following fields: device public key (denoted as

[0059] dev_pub_key), device public key signature (denoted as dpk_signature), data (denoted as data), and data signature (denoted as data_signature).

[0060] The device public key field is directly stored in the signature data for use in device software verification.

[0061] Furthermore, the device public key signature field is generated by signing the device public key and SN number using the root private key. The device public key signature can ensure that the device public key is bound to the device SN number and can be easily verified by the device software using the root public key. The detailed generation algorithm of the device public key signature is as follows:

[0062] signature=rsa_encrypt(root_priv_key,sha256(SN+dev_pub_key))

[0063] dpk_signature=hex(signature)

[0064] The detailed explanation of the above code is as follows:

[0065] sha256(SN+dev_pub_key) means: First, concatenate the two strings, the device public key and the SN number, and then hash the concatenated string using the SHA-256 hash algorithm to generate a hash value. SHA-256 is a widely used cryptographic hash function that can produce a 256-bit (32-byte) hash value, which is often used to ensure data integrity.

[0066] rsa_encrypt(root_priv_key,...) means using root_priv_key (root private key) to perform RSA encryption on the hash value generated in the previous step. RSA encryption is an asymmetric encryption algorithm that uses a pair of keys: a public key and a private key. Here, the private key is used to encrypt the data.

[0067] signature means that the encrypted result is stored in the variable signature, where the variable signature represents the digital signature.

[0068] hex(...) means to convert the signature obtained in the previous step into a hexadecimal string. In computers, binary data is often represented in hexadecimal form because it is easier to read and process. The converted hexadecimal string is stored in the variable dpk_signature, which represents the final digital signature, the device public key signature, which is used to verify the integrity and source of the data. The device public key signature can ensure that the data has not been tampered with during transmission and can verify that the data is indeed signed by the entity with the corresponding private key.

[0069] Furthermore, the data field is encapsulated by CPUID and EID in a fixed format. The data signature field is generated by signing the data field (referring to the data encapsulating CPUID and EID) using the device private key. Through the data signature, the integrity of the device information and the authenticity of the source can be ensured, and it can be easily verified by the device software using the device public key. The detailed generation algorithm of the data signature is as follows:

[0070] signature=rsa_encrypt(dev_priv_key,sha256(data))

[0071] data_signature=hex(signature)

[0072] The detailed explanation of the above code is as follows: sha256(data): First, the provided data (data) is hashed using the SHA-256 hash algorithm to generate a hash value.

[0073] rsa_encrypt(dev_priv_key,...) means: Use the device private key to perform RSA encryption on the hash value generated in the previous step.

[0074] signature indicates that the encrypted result is stored in the variable signature.

[0075] hex(...) means converting the signature (digital signature) obtained in the previous step into a hexadecimal string. In computers, binary data is often represented in hexadecimal form because it is easier to read and process.

[0076] data_signature means that the converted hexadecimal string is stored in the variable data_signature, which represents the final digital signature and is usually used to verify the integrity and source of the data.

[0077] Data signatures ensure that data has not been tampered with during transmission and can verify that the data was indeed signed by a device that possesses the corresponding private key.

[0078] Further, step 103: the device continues to flow on the production line, and the signature data on the production server is written into the modem partition storage of the device.

[0079] Specifically, the production server writes the signature data returned by the signature server to the device's Modem partition storage through the software interface. In this way, each device will have a Modem partition containing signature information for subsequent verification processes.

[0080] Further, step 104: flashing the official version of the embedded SIM card function that has been imported for power-on verification before leaving the factory.

[0081] Specifically, after all the production steps are completed, the device will be flashed with the official factory version. After that, each time the device is turned on, it will enter the process of verifying the embedded SIM card function.

[0082] like Figure 3 As shown in the figure, a detailed flow chart of the device verifying the embedded SIM card after the device is turned on at the factory. The steps of the embedded SIM card verification process include:

[0083] Step S1: Read the signature data stored in the Modem partition of the device;

[0084] Step S2: Using the root public key to verify the validity of the device public key signature;

[0085] Step S3: using the device public key to verify the validity of the data signature;

[0086] Step S4: Read the actual CPUID and EID of the device, and compare them with the CPUID and EID stored in the signature data.

[0087] Wherein, in step S1, when reading the signature data stored in the Modem partition of the device, if reading the signature data is successful, then continue with the verification of step S2; if reading the signature data fails, then the device enters the recovery mode.

[0088] Specifically, when the device is started, the system reads the signature data stored in the modem partition of the device for subsequent verification and validation. The purpose of reading is to obtain the signature data for subsequent verification, which is generated and stored during the device production process.

[0089] Furthermore, in step S2, the root public key and device public key in the signature data and the SN number in the device are used to verify the validity of the device public key signature. If the verification is successful, the signature is valid and the verification of step S3 is continued; otherwise, the signature is invalid and the device enters recovery mode.

[0090] Specifically, the root_pub_key in the software code is used to decrypt the dpk_signature. In order to verify the validity of the signature, the decrypted value is compared with the hash value calculated by sha256(dev_pub_key+SN). If the decrypted value is equal to the hash value, it means that the signature is valid, ensuring the integrity of the signature data and the reliability of the source.

[0091] Furthermore, in step S3, the signature data is read, and the validity of the data signature is verified using the device public key in the signature data and the data field consisting of CPUID and EID. If the verification is successful, the signature is valid and the verification of step S4 is continued; otherwise, the signature is invalid and the device enters recovery mode.

[0092] Specifically, use the dev_pub_key in the signature data and the data consisting of CPUID and EID to verify the data_signature (data signature) to confirm that the signature is valid.

[0093] Use dev_pub_key in the software code to decrypt data_signature. To verify the validity of the signature, the decrypted value is compared with the hash value calculated by sha256(data). If the decrypted value is equal to the hash value, the signature is valid. This step further verifies the identity of the device and the integrity of the data, ensuring that the device has not been tampered with at the hardware and software level.

[0094] Furthermore, the actual CPUID and EID of the device are read and compared with the CPUID and EID stored in the signature data. Specifically, after both step S2 and step S3 are verified, the CPUID and EID of the device are read and compared with the CPUID and EID stored in the signature data. This step is to ensure that the hardware identity of the device matches the previously stored signature data to prevent the hardware from being replaced or tampered with. If the data are consistent after comparison, that is, all steps S1-S4 are verified successfully, and it is confirmed that there are no abnormalities in the current embedded SIM card hardware and device software, the device will start normally; if after comparison, any of the CPUID and EID comparison fails, the device will enter recovery mode and prompt the user on the user interface (UI) that the embedded SIM is abnormal, please go to after-sales inspection. This step can further detect potential security risks or hardware problems, prevent the device from continuing to run, and protect user data and device security.

[0095] Embodiment 2

[0096] The second embodiment provides an encryption protection system for an embedded SIM card, including a production server, a signature server, a device and a verification module.

[0097] The production server is used to read the device information and send it to the signature server.

[0098] The signature server is used to sign the device information and generate signature data. By signing the device information through the signature server, the integrity of the information and the reliability of the source can be ensured. The signature server can securely manage the private key used for signing and reduce the risk of private key leakage.

[0099] The Modem partition in the device is used to store signature data, and the Modem partition usually has high security, which can protect the signature data from unauthorized access or tampering. In addition, when the device is started, the Modem partition can quickly provide signature data for verification.

[0100] The verification module is integrated in the device, and reads the signature data in the Modem partition when the device is turned on. The verification is performed every time the device is turned on to ensure the security of the embedded SIM card data during the use of the device. If the signature data is tampered with, the verification module can detect it and take corresponding security measures, such as prompting the user or entering recovery mode.

[0101] The present embodiment proposes an encryption protection system for an embedded SIM card. During factory production, a production server reads device information and sends it to the signature server. The signature server performs signature processing on the device information and generates signature data, which is written into the Modem partition of the device before leaving the factory, thereby ensuring the uniqueness of the signature data after the device leaves the factory. After the device leaves the factory and is sold, when it is powered on normally, a verification module is used to verify the data signature. Only when everything is verified successfully can the device be used normally, thereby ensuring the communication security of the embedded SIM card and the user.

[0102] Embodiment 3

[0103] The third embodiment provides a computer-readable storage medium, in which program instructions are stored. When the program instructions are executed by a processor, some or all steps of the encryption protection method for the embedded SIM card in the first embodiment can be implemented to ensure the communication security of the embedded SIM card and the user, thereby reducing the risk that the embedded SIM card may be maliciously stolen or replaced.

[0104] In summary, in the encryption protection method, system and medium of an embedded SIM card provided in an embodiment of the present invention, the embedded SIM card is bound to the device hardware and the signature server generates unchangeable signature data to protect the embedded SIM card, thereby improving security. And every time the device is turned on, by verifying the validity of the signature data, it is possible to promptly detect that the embedded SIM card has been replaced or damaged, effectively preventing potential security risks. In addition, by locking the device in recovery mode, it is possible to prevent the stolen embedded SIM card from being used on other devices, thereby fundamentally solving the problem of embedded SIM theft.

[0105] Furthermore, the two-level key signature mechanism can enhance the encryption strength, making the signature data difficult to crack or forge, thereby reducing the risk of the embedded SIM card being maliciously stolen or replaced.

[0106] The above is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any technician in the relevant technical field, without departing from the scope of the technical solution of the present invention, makes any form of equivalent replacement or modification to the technical solution and technical content disclosed in the present invention, which does not depart from the content of the technical solution of the present invention and still falls within the protection scope of the present invention.

Claims

1. An encryption protection method for an embedded SIM card, characterized in that: The following steps are involved: The production server reads the device’s CPUID, SN number, and EID information of the embedded SIM card; Send the read information to the signature server; The signature server signs the read information to generate signature data; Returning the signature data to the production server; The production server stores the signature data in the Modem partition of the device; Each time the device is turned on, the signature data is read and a verification process of the embedded SIM card is performed, and a decision is made based on the verification result whether the device is turned on normally or enters recovery mode.

2. The encryption protection method for embedded SIM card according to claim 1, characterized in that: The signature server signs the read information using a two-level key, wherein the two-level key includes a root key and a device key; The root key includes a root public key and a root private key, and the device key includes a device public key and a device private key; The root key is used to protect the public key part of the device key, and the device key is used to protect the binding relationship between CPUID and EID.

3. The encryption protection method for embedded SIM card according to claim 2, characterized in that: The signature data includes the following fields: Device public key, device public key signature, data, and data signature; The device public key field is stored in the signature data by the device public key; The device public key signature field is generated by signing the device public key and SN number using the root private key; The data field is encapsulated by CPUID and EID in a fixed format; The data signature field is generated by signing the data field using the device private key.

4. The encryption protection method for embedded SIM card according to claim 3, characterized in that: The verification process steps include: Step S1: Read the signature data stored in the Modem partition of the device; Step S2: Using the root public key to verify the validity of the device public key signature; Step S3: using the device public key to verify the validity of the data signature; Step S4: Read the actual CPUID and EID of the device, and compare them with the CPUID and EID stored in the signature data.

5. The encryption protection method for embedded SIM card according to claim 4, characterized in that: When reading the signature data stored in the Modem partition of the device, if reading the signature data is successful, the verification of step S2 is continued; if reading the signature data fails, the device enters the recovery mode.

6. The encryption protection method for embedded SIM card according to claim 4, characterized in that: The using the root public key to verify the validity of the device public key signature includes reading signature data, and using the root public key and the device public key in the signature data, and the SN number in the device to verify the validity of the device public key signature; If the verification is successful, the signature is valid and the verification continues in step S3; otherwise, the signature is invalid and the device enters recovery mode.

7. The encryption protection method for embedded SIM card according to claim 4, characterized in that: The using the device public key to verify the validity of the data signature includes reading the signature data, and using the device public key in the signature data, and a data field consisting of CPUID and EID to verify the validity of the data signature; If the verification is successful, the signature is valid and the verification continues in step S4; Otherwise the signature is invalid and the device enters recovery mode.

8. The encryption protection method for embedded SIM card according to claim 4, characterized in that: If all steps S1-S4 are verified successfully, the device will start normally; If any of steps S1-S4 fails to be verified, the device enters recovery mode and prompts the user that the embedded SIM is abnormal.

9. A device production and verification system, characterized in that: Includes production servers, signature servers, devices and verification modules; The production server is used to read the device information and send it to the signature server; The signature server is used to sign the device information and generate signature data; The Modem partition in the device is used to store signature data; The verification module is integrated in the device and is used to read the signature data and execute the verification process when the device is turned on.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program instructions, and when the program instructions are executed, they are used to implement the method according to any one of claims 1 to 8.

Images