Super SIM (Subscriber Identity Module) card key generation system and method supporting SM9 cryptographic algorithm

Abstract

The invention relates to the technical field of information security, and particularly discloses a super SIM (Subscriber Identity Module) card key generation system and method supporting a SM9 cryptographic algorithm, and the system comprises terminal equipment, a super SIM card installed in the terminal equipment, an Internet of Things platform and a key generation center, the terminal equipment provided with the super SIM card forwards information through the Internet of Things platform or directly communicates with the key generation center, a framework in which the key generation center participates in key generation is provided for a national secret SM9 algorithm, and the super SIM card and the key generation center adopt a root key calculation identification code to perform bidirectional identity authentication. According to the super SIM card key generation system supporting the SM9 cryptographic algorithm, the security and integrity of communication in the key generation stage are ensured, namely, in the super SIM card key generation system supporting the SM9 cryptographic algorithm in the embodiment of the invention, the super SIM card can support the SM9 cryptographic algorithm, which is beneficial for using the SM9 cryptographic algorithm to perform information encryption in the Internet of Things, simplifying the key management process and reducing the cost and the system complexity.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a super SIM card key generation system and method supporting the national secret SM9 algorithm. Background Art

[0002] With the rapid development of the Internet of Things, its application scenarios are constantly expanding, covering many fields such as smart homes, industrial automation, and smart transportation. The Internet of Things connects a large number of devices, sensors, etc., and realizes efficient data transmission and interaction. However, at the same time, the security requirements of the Internet of Things are also increasing. In the Internet of Things environment, communication between devices needs to ensure the confidentiality, integrity, and authenticity of data to prevent information from being stolen, tampered with, or forged.

[0003] At present, the use of a super SIM card integrated with the national secret SM2 algorithm is a common technical solution to ensure the information security of the Internet of Things. The national secret SM2 algorithm is an elliptic curve public key cryptography algorithm with high security. However, the algorithm needs to rely on the certificate authority to issue a certificate, which increases the cost and management complexity for a large number of Internet of Things devices. The national secret SM9 algorithm is an identity-based encryption (IBE) algorithm with significant application advantages on Internet of Things devices. The most important of these is that it can encrypt and authenticate without a certificate, which greatly simplifies the key management process and reduces system complexity and operation and maintenance costs. In view of the high cost and complex management of the national secret SM2 algorithm in the existing technical solutions, as well as the advantages of the national secret SM9 algorithm on Internet of Things devices, the purpose of the present invention is to provide a super SIM card key generation system and method supporting the national secret SM9 algorithm, aiming to utilize the advantages of the national secret SM9 algorithm, simplify the key management process, and reduce costs and system complexity. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a super SIM card key generation system and method supporting the national secret SM9 algorithm, aiming to utilize the advantages of the national secret SM9 algorithm, simplify the key management process, and reduce costs and system complexity.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions: A super SIM card key generation system supporting the national secret SM9 algorithm, specifically comprising a terminal device, a super SIM card installed in the terminal device, an Internet of Things platform and a key generation center, wherein the terminal device communicates with the key generation center through the Internet of Things platform; The terminal device is used to generate a key generation instruction; The super SIM card is used to generate an SM2 temporary key pair in response to the key generation instruction, generate a first key request including a public key of the SM2 temporary key pair and a preset chip unique serial number, and calculate a first authentication code for the first key request using a preset root key; The terminal device is used to generate a second key request including the first key request and a first authentication code in response to the first key request and send the second key request to the Internet of Things platform; The Internet of Things platform is used to send the second key request to the key generation center; The key generation center is used to respond to the second key request, obtain the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, and generate a root key through a key derivation algorithm, and use the root key to calculate the second authentication code for the first key request. When the second authentication code matches the first authentication code, a user key is generated and the public key of the SM2 temporary key pair in the first key request is used to encrypt the user key to obtain a user key ciphertext, and then the root key is used to calculate a third authentication code for a key package consisting of the user key ciphertext and the key generation center identifier, and the key package and the third authentication code are sent to the Internet of Things platform; The Internet of Things platform is used to send the key package and the third authentication code to the terminal device; The terminal device is used to forward the key package and the third authentication code to the super SIM card; The super SIM card is used to use the root key to calculate the fourth identification code of the key package. When the fourth identification code matches the third identification code, the private key of the SM2 temporary key pair is used to decrypt the user key ciphertext in the key package to obtain the user key, and the user key and the key generation center identifier in the key package are stored in the memory.

[0006] As a further technical solution of the present invention, the terminal device includes an MCU and a communication module, and the MCU communicates with the super SIM card through the communication module; The MCU is used to generate a key generation instruction, and transparently transmit the key generation instruction to the super SIM card through the communication module; The communication module is used to transparently transmit the first key request and the first authentication code generated by the super SIM card to the MCU; The MCU is also used to generate a network request instruction in response to the first key request and send it to the communication module; The communication module is also used to generate a second key request including the first key request and the first authentication code in response to the network request instruction and send the second key request to the Internet of Things platform.

[0007] As a further technical solution of the present invention, the key generation center is used to respond to the second key request, obtain the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, and generate a root key through a key derivation algorithm, and use the root key to calculate the second authentication code for the first key request. When the second authentication code matches the first authentication code, a user key is generated and the public key of the SM2 temporary key pair in the first key request is used to encrypt the user key to obtain a user key ciphertext, and then the root key is used to calculate a third authentication code for a key package consisting of the user key ciphertext and the key generation center identifier, and the key package and the third authentication code are sent to the Internet of Things platform; The Internet of Things platform is also used to send the key package and the third authentication code to the communication module.

[0008] As a further technical solution of the present invention, the communication module is further used to forward the key package and the third authentication code to the MCU; The MCU is also used to generate a parsing instruction including a key package and the third authentication code, and transparently transmit the parsing instruction to the super SIM card through the communication module; The super SIM card is also used to respond to the parsing instruction and use the root key to calculate the key package to obtain a fourth identification code, and when the fourth identification code matches the third identification code, use the private key of the SM2 temporary key pair to decrypt the user key ciphertext in the key package to obtain the user key, and store the user key and the key generation center identifier in the key package in the memory.

[0009] As a further technical solution of the present invention, the calculation algorithm of the first identification code, the second identification code, the third identification code and the fourth identification code is a hash algorithm using a root key.

[0010] As a further technical solution of the present invention, the Internet of Things platform communicates with the key generation center through a secure channel.

[0011] As a further technical solution of the present invention, the super SIM card includes an application layer and a hardware layer, the hardware layer includes a non-volatile memory, and the application layer is used to store the user key and the key generation center identifier in the non-volatile memory.

[0012] As a further technical solution of the present invention, the application layer is also used to store the key generation center identifier and key operation parameters in the non-volatile memory.

[0013] As a further technical solution of the present invention, the hardware layer further includes a random access memory, and the application layer is further used for: The user key and the key operation parameters are loaded from the non-volatile memory into the random access memory according to the received key generation center identifier.

[0014] A super SIM card key generation method supporting the national secret SM9 algorithm is applied to any super SIM card key generation system supporting the national secret SM9 algorithm described in the present invention, specifically comprising the following steps: The terminal device generates a key generation instruction; The super SIM card generates an SM2 temporary key pair in response to the key generation instruction, generates a first key request including a public key of the SM2 temporary key pair and a preset chip unique serial number, and calculates a first authentication code for the first key request using a preset root key; The terminal device generates, in response to the first key request, a second key request including the first key request, a first authentication code and preset device information, and sends the second key request to the Internet of Things platform; The Internet of Things platform sends the second key request to a key generation center; The key generation center responds to the second key request, obtains the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, generates a root key through a key derivation algorithm, uses the root key to calculate the second authentication code for the first key request, and when the second authentication code matches the first authentication code, generates a user key and uses the public key of the SM2 temporary key pair in the first key request to encrypt the user key to obtain a user key ciphertext, and then uses the root key to calculate a third authentication code for a key package consisting of the user key ciphertext and the key generation center identifier, and sends the key package and the third authentication code to the Internet of Things platform; The Internet of Things platform sends the key package and the third authentication code to the terminal device; The terminal device forwards the key package and the third authentication code to the super SIM card; The super SIM card uses the root key to calculate the fourth identification code for the key package. When the fourth identification code matches the third identification code, the private key of the SM2 temporary key pair is used to decrypt the user key ciphertext in the key package to obtain the user key, and the user key and the key generation center identifier in the key package are stored in the memory.

[0015] Compared with the prior art, the present invention has the following beneficial effects: In the super SIM card key generation system supporting the national secret SM9 algorithm of the embodiment of the present invention, the terminal device installed with the super SIM card forwards information through the Internet of Things platform or directly communicates with the key generation center, providing a framework for the key generation center to participate in the generation of keys for the national secret SM9 algorithm, and the super SIM card uses the root key to calculate the identification code, and the key generation center also uses the root key to calculate the identification code, so that the terminal device installed with the super SIM card and the key generation center perform two-way identity authentication through the root key calculation identification code in the interaction during the key generation stage, ensuring the security and integrity of the communication during the key generation stage, that is, the super SIM card key generation system supporting the national secret SM9 algorithm of the embodiment of the present invention provides a key generation framework for the national secret SM9 algorithm, so that the national secret SM9 algorithm can be applied to the super SIM card, which is beneficial to the use of the national secret SM9 algorithm for information encryption in the Internet of Things, and improves the network information security of the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention.

[0017] Figure 1 The application architecture diagram of a super SIM card key generation system supporting the national encryption SM9 algorithm provided by an embodiment of the present invention is shown.

[0018] Figure 2 The application architecture diagram of a super SIM card key generation system supporting the national encryption SM9 algorithm provided by another embodiment of the present invention is shown.

[0019] Figure 3 An interactive schematic diagram of super SIM card key generation supporting the national encryption SM9 algorithm provided by an embodiment of the invention is shown.

[0020] Figure 4 A memory management strategy diagram of a super SIM card supporting the national encryption SM9 algorithm provided by an embodiment of the present invention is shown.

[0021] Figure 5 A hardware architecture diagram of a super SIM card supporting the national encryption SM9 algorithm provided by an embodiment of the present invention is shown.

[0022] Figure 6 A flowchart of a super SIM card key generation method supporting the national encryption SM9 algorithm provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0024] Figure 1 The application architecture diagram of the super SIM card key generation system supporting the national secret SM9 algorithm provided by an embodiment of the present invention is shown as follows: Figure 1 As shown, the super SIM card key generation system supporting the national secret SM9 algorithm of an embodiment of the present invention includes a terminal device, a super SIM card installed in the terminal device, an Internet of Things platform and a key generation center, wherein the terminal device forwards information through the Internet of Things platform or directly communicates with the key generation center.

[0025] The terminal device can be various IoT devices in the Internet of Things, or mobile terminals such as mobile phones and tablets. The terminal device can include communication modules, such as 2G, 3G, 4G, 5G and other wireless communication modules. Communication can be achieved after installing a super SIM card on the terminal device. Among them, the super SIM (Subscriber Identity Module) card is a new type of smart card that integrates the communication functions of traditional SIM cards with advanced technologies such as large-capacity storage and secure encryption.

[0026] The IoT platform can be an IoT server, gateway, etc. Each terminal device in the IoT is connected to the IoT platform. The Key Generation Center (KGC) is mainly responsible for generating, storing and managing keys to ensure information security and data privacy. In KGC, the user key is an identity-based key.

[0027] Specifically, in this embodiment, the terminal device is used to generate a key generation instruction, the super SIM card is used to respond to the key generation instruction to generate an SM2 temporary key pair, generate a first key request including a public key of the SM2 temporary key pair and a preset chip unique serial number, and use a preset root key to calculate a first authentication code for the first key request, the terminal device is used to respond to the first key request to generate a second key request including the first key request and the first authentication code and send it to the Internet of Things platform, the Internet of Things platform is used to transparently transmit the second key request to the key generation center, the key generation center is used to respond to the second key request, obtain the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, and generate a root key through a key derivation algorithm, use the root key to calculate the second authentication code for the first key request, and in the second authentication code When the code matches the first identification code, a user key is generated and the public key of the SM2 temporary key pair in the first key request is used to encrypt the user key to obtain the user key ciphertext, and then the root key is used to calculate the third identification code for the key package composed of the user key ciphertext and the key generation center identifier, and the key package and the third identification code are sent to the Internet of Things platform. The Internet of Things platform is used to send the key package and the third identification code to the terminal device, and the terminal device is used to forward the key package and the third identification code to the super SIM card. The super SIM card is used to calculate the fourth identification code for the key package using the root key. When the fourth identification code matches the third identification code, the private key of the SM2 temporary key pair is used to decrypt the user key ciphertext in the key package to obtain the user key, and the user key and the key generation center identifier in the key package are stored in the memory.

[0028] Specifically, the root key preset in the super SIM card can be generated in the following way: the salt value (i.e., random number) permanently fixed in the super SIM card when the super SIM card is produced and the chip unique serial number (ICCID) are used to generate the key using the key derivation algorithm. The root key generation method of the key generation center is: the super SIM card manufacturer provides a relationship table between the chip unique serial number (ICCID) and the salt value (i.e., random number), obtains the salt value from the relationship table, and combines it with the chip unique serial number to generate the key using the key derivation algorithm. This operation can effectively ensure the security of the root key. Calculating the authentication code through the root key can be calculating the message digest through HMAC (Hash-based Message Authentication Code). HMAC is a key-based hash function used to ensure the integrity and security of information. It involves a hash function, a key and a specific XOR operation. The message authentication code is generated through a two-step hash process. The algorithm includes key processing, content splicing and two hash operations. Specifically in this embodiment, the root key is defined as the key, the hmac.new function is used to initialize the HMAC object, the key, the message and the hash function (such as SHA-256) are specified, and the hexdigest method is called to obtain the hexadecimal representation of HMAC as the authentication code.

[0029] The terminal device forwards information through the Internet of Things platform or communicates directly with the key generation center, providing a framework for the key generation center to participate in the generation of keys for the national secret SM9 algorithm. The super SIM card uses the root key to calculate the identification code, and the key generation center also uses the root key to calculate the identification code, so that the terminal device installed with the super SIM card and the key generation center perform two-way identity authentication through the root key calculation identification code in the interaction during the key generation stage, ensuring the security and integrity of the communication during the key generation stage. That is, the super SIM card key generation system supporting the national secret SM9 algorithm in the embodiment of the present invention provides a key generation framework for the national secret SM9 algorithm, so that the national secret SM9 algorithm can be applied to the super SIM card, which is conducive to the use of the national secret SM9 algorithm for information encryption in the Internet of Things, and improves the network information security of the Internet of Things.

[0030] like Figure 2As shown, in another embodiment, the terminal device includes an MCU and a communication module, and the MCU communicates with the super SIM card through the communication module, wherein the MCU is used to generate a key generation instruction, and transmit the key generation instruction to the super SIM card through the communication module, and the communication module is used to transmit the first key request and the first identification code generated by the super SIM card to the MCU, and the MCU is also used to generate a network request instruction in response to the first key request and send it to the communication module, and the communication module is also used to generate a second key request including the first key request and the first identification code in response to the network request instruction and send it to the Internet of Things platform.

[0031] Among them, the key generation center is specifically used to respond to the second key request, obtain the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, and generate a root key through a key derivation algorithm, and use the root key to calculate the second authentication code for the first key request. When the second authentication code matches the first authentication code, a user key is generated and the public key of the SM2 temporary key pair in the first key request is used to encrypt the user key to obtain the user key ciphertext, and then the root key is used to calculate the third authentication code for the key package composed of the user key ciphertext and the key generation center identifier, and the key package and the third authentication code are sent to the Internet of Things platform. The Internet of Things platform is also used to send the key package and the third authentication code to the Internet of Things platform. The third identification code is sent to the communication module, and the communication module is also used to forward the key package and the third identification code to the MCU. The MCU is also used to generate a parsing instruction including the key package and the third identification code, and transparently transmit the parsing instruction to the super SIM card through the communication module. The super SIM card is also used to respond to the parsing instruction and use the root key to calculate the key package to obtain a fourth identification code, and when the fourth identification code matches the third identification code, use the private key of the SM2 temporary key pair to decrypt the user key ciphertext in the key package to obtain the user key, and store the user key and the key generation center identifier in the key package in the memory.

[0032] In this embodiment, each super SIM card is assigned a unique chip unique serial number (ICCID) as device information to identify the identity of the super SIM card. Each key generation center is responsible for generating a master key and a user key, and assigning a unique key generation center identifier KGCID to each master key. The key generation center and the Internet of Things platform can communicate through a secure channel, such as through a dedicated communication tunnel.

[0033] In order to more clearly illustrate the super SIM card key generation system supporting the national secret SM9 algorithm according to the embodiment of the present invention, the following is combined with Figure 3 The interactive diagram of the key generation process is shown in Figure 3As shown, the super SIM card and the communication module can communicate through the 7816 protocol (APDU), the communication module and the MCU can communicate through the SPI\I2C bus, the communication module and the IoT platform can communicate through MQTT (Message Queuing Telemetry Transport) / COAP (The Constrained Application Protocol), and the IoT platform communicates with the KGC (Key Generation Center) through a secure channel. The specific key generation process is as follows: S1, MCU generates key generation instruction; S2, the communication module transparently transmits the key generation instruction; S3, the super SIM card generates an SM2 temporary key pair and generates a first key request including a public key of the SM2 temporary key pair and a chip unique serial number, and calculates a first authentication code using a root key; S4, the communication module transparently transmits the first key request and the first authentication code; S5, MCU sends a network request instruction; S6. The communication module generates and sends a second key request including the first key request and the first authentication code; S7, the IoT platform sends a second key request; S8. The key generation center obtains the salt value from the relationship table according to the unique serial number of the chip in the first key request and generates a root key through a key derivation algorithm, and uses the root key to calculate a second authentication code for the first key request in the second key request; S9. If the authentication is successful, the key generation center generates a user key and uses the public key of the SM2 temporary key pair in the first key request to encrypt the user key ciphertext, encapsulates the user key ciphertext and the key generation center identifier into a key package, and uses the root key to calculate the third authentication code; S10, the key generation center sends a key package and a third authentication code; S11, the IoT platform sends a key package and a third authentication code; S12, the communication module transparently transmits the key package and the third authentication code to the MCU; S13, MCU sends parsing instructions; S14, the communication module transparently transmits the parsing instruction; S15. The super SIM card uses the root key to calculate the fourth authentication code of the key package, and uses the private key of the SM2 temporary key pair to decrypt the user key ciphertext to obtain the user key when the authentication is passed, and stores the user key and the key generation center identifier in an associated manner.

[0034] On the terminal device, when the key is needed, the super SIM card requests the corresponding user key for cryptographic operation services to encrypt data information.

[0035] like Figure 4 As shown, in an optional embodiment, the super SIM card includes an application layer and a hardware layer, the hardware layer includes a non-volatile memory, and the application layer is used to store the user key and the key generation center identifier in the non-volatile memory when receiving the user key and the key generation center identifier, that is, the Applet (application) stores the corresponding user key in the EEPROM / Flash according to the received key generation center identifier KGCID, ensuring the security and fast retrieval of the user key. For example, when the Applet needs to perform encryption services, it can quickly retrieve different keys from the EEPROM / Flash through the KGCID and load the keys into the RAM, which significantly improves the management efficiency and security of the key data of the super SIM card.

[0036] In yet another embodiment, Figure 4 As shown, the application layer is also used to store the key generation center identifier and the key operation parameters in the non-volatile memory. Exemplarily, a relationship table between KGCID and cryptographic parameters is maintained in the super SIM card, thereby realizing unified management of user keys and public parameters generated by different KGCs. Furthermore, the key G value in the cryptographic operation (i.e., the bilinear pairing generated by the master key and the public parameter calculation) can be pre-calculated and loaded into the relationship table between KGCID and cryptographic parameters, thereby reducing repeated calculations and significantly improving the performance of cryptographic operations and the operating efficiency of the overall system.

[0037] Of course, the hardware layer can also include SE chips, which are customized security chips that support the SM9 algorithm. Identity authentication, cryptographic calculations and security operations are performed through the SE chips to improve the security and performance of the system. The application layer can call on the resources of the hardware layer for cryptographic calculations, password retrieval, etc.

[0038] like Figure 5 The hardware architecture diagram of the Super SIM card is shown in Figure 5In the super SIM card shown, the super SIM card includes a main control module, a storage module, a system bus, an algorithm coprocessor and an interface module. Among them, the main control module as the central processing unit of the super SIM card may include a CPU and a DMA, which is responsible for executing programs and processing data. The storage module as the memory of the super SIM card may include Flash, Cache, SRAM, which can be used to store operating systems, applications, user data and other contents. The system bus connects various components and provides a data transmission channel. The algorithm coprocessor can be a variety of processors with digital logic operations for executing complex cryptographic algorithms. The interface module may include SPI, 7816, SWP and other interface modules for communication. Various interfaces of the interface module support the download, import, deletion and enumeration of the master public key and identification key of the national secret SM9 algorithm, and support the cryptographic operations such as signing, verification, encryption and decryption of the national secret SM9 algorithm.

[0039] Among them, the 7816 protocol enables the super SIM card to comply with the ISO / IEC 7816 standard to achieve communication with external devices. The super SIM card uses the APDU instruction set for key management and cryptographic operations. In addition, the JavaCard Applet is integrated on the super SIM card as the application of the super SIM card, which complies with the Java Card specification and runs on the smart card using Java Card technology, and is responsible for encapsulating and processing APDU instructions.

[0040] In the super SIM card key generation system supporting the national secret SM9 algorithm of this embodiment, the terminal device forwards information through the Internet of Things platform or communicates directly with the key generation center, providing a framework for the key generation center to participate in the generation of keys for the national secret SM9 algorithm, and the super SIM card adopts the root key to calculate the identification code, and the key generation center also adopts the root key to calculate the identification code, so that the terminal device installed with the super SIM card and the key generation center perform two-way identity authentication through the root key calculation identification code in the interaction during the key generation stage, ensuring the security and integrity of the communication during the key generation stage, that is, the super SIM card key generation system supporting the national secret SM9 algorithm of the embodiment of the present invention provides a key generation framework for the national secret SM9 algorithm, so that the national secret SM9 algorithm can be applied to the super SIM card, which is conducive to the use of the national secret SM9 algorithm for information encryption in the Internet of Things, and improves the network information security of the Internet of Things.

[0041] Furthermore, by associating and storing the key generation center identifier and the corresponding user keys and encryption operation parameters, a memory mechanism for associating user keys that support multiple key generation centers is implemented, and effective management and rapid retrieval of user keys and public parameters generated by different key generation centers are achieved, ensuring orderly storage of key data.

[0042] Furthermore, after power-on, the super SIM card can load the key data corresponding to the key generation center identifier into the cache, call the SE chip to pre-calculate the key encryption operation parameter G value (that is, the bilinear pairing generated by the master key and the public parameter calculation) and store it in the cache, reducing the repeated calculation of encryption operation parameters, providing performance improvement for cryptographic operations, and improving system operation efficiency.

[0043] Figure 6 FIG. 1 is a flowchart of a method for generating a super SIM card key supporting the national secret SM9 algorithm provided by an embodiment of the present invention. Figure 6 As shown, the super SIM card key generation method supporting the national secret SM9 algorithm according to an embodiment of the present invention specifically includes the following steps: S601. The terminal device generates a key generation instruction.

[0044] like Figure 1 As shown, the super SIM card key generation system supporting the national secret SM9 algorithm of an embodiment of the present invention includes a terminal device, a super SIM card installed in the terminal device, an Internet of Things platform and a key generation center, wherein the terminal device forwards information through the Internet of Things platform or directly communicates with the key generation center.

[0045] The terminal device can generate key generation instructions, such as Figure 2 As shown, in an optional embodiment, the terminal device includes an MCU and a communication module, and the MCU communicates with the super SIM card through the communication module, wherein the MCU is used to generate a key generation instruction and transparently transmit the key generation instruction to the super SIM card through the communication module.

[0046] S602: The super SIM card generates an SM2 temporary key pair in response to the key generation instruction and generates a first key request including a public key of the SM2 temporary key pair and a chip unique serial number, and calculates a first authentication code based on the first key request using a preset root key.

[0047] After receiving the key generation instruction, the super SIM card can respond to the key generation instruction to generate an SM2 temporary key pair and generate a first key request including the public key of the SM2 temporary key pair and the chip unique serial number, and use the preset root key to calculate the first authentication code for the first key request. Specifically, the root key preset in the super SIM card can be generated in the following way: the salt value (i.e., random number) permanently fixed in the super SIM card when the super SIM card is produced and the chip unique serial number (ICCID) are used to generate the key using the key derivation algorithm. Calculating the authentication code using the root key can be calculating the message digest of the first key request using HMAC (Hash-based Message Authentication Code). For example, the root key is defined as the key and the key request is defined as the message message, and the HMAC object is initialized using the hmac.new function, the key, message and hash function (such as SHA-256) are specified, and the hexdigest method is called to obtain the hexadecimal representation of HMAC as the authentication code.

[0048] S603: The terminal device generates a second key request including the first key request and the first authentication code in response to the first key request and sends it to the Internet of Things platform.

[0049] After the super SIM card generates the first key request and the first identification code, it can be transparently transmitted to the MCU through the communication module. The MCU responds to the first key request to generate a second key request including the first key request and the first identification code, and transparently transmits the second key request to the communication module. The communication module sends the second key request to the Internet of Things platform.

[0050] S604: The Internet of Things platform sends a second key request to a key generation center.

[0051] Specifically, after receiving the second key request, the Internet of Things platform sends the second key request to the key generation center.

[0052] S605. The key generation center responds to the second key request, obtains the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, and generates a root key through a key derivation algorithm, and uses the root key to calculate the second authentication code for the first key request. When the second authentication code matches the first authentication code, a user key is generated and the public key of the SM2 temporary key pair in the first key request is used to encrypt the user key to obtain the user key ciphertext.

[0053] The key generation center first obtains the corresponding salt value from the relationship table according to the chip unique serial number in the first key request and generates a root key through a key derivation algorithm, and then uses the root key to calculate the second authentication code for the first key request. Specifically, the root key generation center generates the root key in the following manner: the super SIM card manufacturer provides a relationship table between the chip unique serial number (ICCID) and the salt value (i.e., a random number), obtains the salt value from the relationship table according to the chip unique serial number, and combines the chip unique serial number to generate a key through a key derivation algorithm. If the second authentication code is equal to the first authentication code, it is determined that the authentication is successful. The key generation method in the national secret SM9 can be used to generate the user key, and the encryption algorithm in the national secret SM2 can be used to encrypt the user key. This embodiment does not limit the algorithm for generating the user key by the key generation center. If the second authentication code is not equal to the first authentication code, it is determined that the identity authentication has not passed, and an alarm message that the identity authentication has not been notified can be returned to the Internet of Things platform.

[0054] S606: The key generation center uses the root key to calculate the third authentication code for the key package consisting of the user key ciphertext and the key generation center identifier, and sends the key package and the third authentication code to the Internet of Things platform.

[0055] In one embodiment, the key generation center packages the user key ciphertext and the key generation center identifier into a key package, calculates a third authentication code based on the key package using the root key, and sends the key package and the third authentication code to the Internet of Things platform.

[0056] S607, the IoT platform sends the key package and the third authentication code to the terminal device Specifically, after receiving the key package and the third authentication code, the Internet of Things platform sends the key package and the third authentication code to the key terminal device.

[0057] S607: The terminal device forwards the key package and the third authentication code to the super SIM card.

[0058] Specifically, the communication module on the terminal device may first send the key package including the user key and the key generation center identifier and the third authentication code to the MCU, and the MCU transmits the code to the super SIM card via the communication module by parsing the instruction.

[0059] S608. The super SIM card uses the root key to calculate the fourth authentication code of the key package. When the fourth authentication code matches the third authentication code, the private key of the SM2 temporary key pair is used to decrypt the user key ciphertext in the key package to obtain the user key, and the user key and the key generation center identifier in the key package are stored in the memory.

[0060] Specifically, the super SIM card calculates the fourth identification code through the root key pair key package. When the fourth identification code matches the third identification code, the private key of the SM2 temporary key pair is used to decrypt the user key ciphertext in the key package to obtain the user key, and the user key and the key generation center identifier in the key package are stored in the memory.

[0061] It should be noted that, for the method embodiment, since it is basically similar to the system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment.

[0062] The super SIM card key generation method supporting the national secret SM9 algorithm provided in the embodiment of the present invention is applied to the super SIM card key generation system supporting the national secret SM9 algorithm provided in the embodiment of the present invention, so that the super SIM card key generation method supporting the national secret SM9 algorithm has corresponding beneficial effects.

[0063] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0064] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0065] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0066] The above embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention patent shall be subject to the attached claims.

[0067] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A super SIM card key generation system supporting the national secret SM9 algorithm, characterized in that: Specifically comprising a terminal device, a super SIM card installed in the terminal device, an Internet of Things platform and a key generation center, wherein the terminal device communicates with the key generation center through the Internet of Things platform; The terminal device is used to generate a key generation instruction; The super SIM card is used to generate an SM2 temporary key pair in response to the key generation instruction, generate a first key request including a public key of the SM2 temporary key pair and a preset chip unique serial number, and calculate a first authentication code for the first key request using a preset root key; The terminal device is used to generate a second key request including the first key request and a first authentication code in response to the first key request and send the second key request to the Internet of Things platform; The Internet of Things platform is used to send the second key request to the key generation center; The key generation center is used to respond to the second key request, obtain the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, and generate a root key through a key derivation algorithm, and use the root key to calculate the second authentication code for the first key request. When the second authentication code matches the first authentication code, a user key is generated and the public key of the SM2 temporary key pair in the first key request is used to encrypt the user key to obtain a user key ciphertext, and then the root key is used to calculate a third authentication code for a key package consisting of the user key ciphertext and the key generation center identifier, and the key package and the third authentication code are sent to the Internet of Things platform; The Internet of Things platform is used to send the key package and the third authentication code to the terminal device; The terminal device is used to forward the key package and the third authentication code to the super SIM card; The super SIM card is used to use the root key to calculate the fourth identification code of the key package. When the fourth identification code matches the third identification code, the private key of the SM2 temporary key pair is used to decrypt the user key ciphertext in the key package to obtain the user key, and the user key and the key generation center identifier in the key package are stored in the memory.

2. The super SIM card key generation system supporting the national secret SM9 algorithm according to claim 1 is characterized in that: The terminal device includes an MCU and a communication module, and the MCU communicates with the super SIM card through the communication module; The MCU is used to generate a key generation instruction, and transparently transmit the key generation instruction to the super SIM card through the communication module; The communication module is used to transparently transmit the first key request and the first authentication code generated by the super SIM card to the MCU; The MCU is also used to generate a network request instruction in response to the first key request and send it to the communication module; The communication module is also used to generate a second key request including the first key request and the first authentication code in response to the network request instruction and send the second key request to the Internet of Things platform.

3. The super SIM card key generation system supporting the national secret SM9 algorithm according to claim 2 is characterized in that: The key generation center is used to respond to the second key request, obtain the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, and generate a root key through a key derivation algorithm, and use the root key to calculate the second authentication code for the first key request. When the second authentication code matches the first authentication code, a user key is generated and the public key of the SM2 temporary key pair in the first key request is used to encrypt the user key to obtain a user key ciphertext, and then the root key is used to calculate a third authentication code for a key package consisting of the user key ciphertext and the key generation center identifier, and the key package and the third authentication code are sent to the Internet of Things platform; The Internet of Things platform is also used to send the key package and the third authentication code to the communication module.

4. The super SIM card key generation system supporting the national secret SM9 algorithm according to claim 3 is characterized in that: The communication module is also used to forward the key package and the third authentication code to the MCU; The MCU is also used to generate a parsing instruction including a key package and the third authentication code, and transparently transmit the parsing instruction to the super SIM card through the communication module; The super SIM card is also used to respond to the parsing instruction and use the root key to calculate the key package to obtain a fourth identification code, and when the fourth identification code matches the third identification code, use the private key of the SM2 temporary key pair to decrypt the user key ciphertext in the key package to obtain the user key, and store the user key and the key generation center identifier in the key package in the memory.

5. The super SIM card key generation system supporting the national secret SM9 algorithm according to any one of claims 1 to 4, characterized in that: The calculation algorithm of the first authentication code, the second authentication code, the third authentication code and the fourth authentication code is a hash algorithm using a root key.

6. The super SIM card key generation system supporting the national secret SM9 algorithm according to any one of claims 1 to 4, characterized in that: The Internet of Things platform communicates with the key generation center through a secure channel.

7. The super SIM card key generation system supporting the national secret SM9 algorithm according to claim 4, characterized in that: The super SIM card includes an application layer and a hardware layer, the hardware layer includes a non-volatile memory, and the application layer is used to store the user key and the key generation center identifier in the non-volatile memory.

8. The super SIM card key generation system supporting the national secret SM9 algorithm according to claim 7, characterized in that: The application layer is also used to store the key generation center identifier and key operation parameters in the non-volatile memory.

9. The super SIM card key generation system supporting the national secret SM9 algorithm according to claim 8, characterized in that: The hardware layer also includes a random access memory, and the application layer is further used for: The user key and the key operation parameters are loaded from the non-volatile memory into the random access memory according to the received key generation center identifier.

10. A super SIM card key generation method supporting the national secret SM9 algorithm, characterized in that: The super SIM card key generation system supporting the national secret SM9 algorithm as described in any one of claims 1 to 9 specifically comprises the following steps: The terminal device generates a key generation instruction; The super SIM card generates an SM2 temporary key pair in response to the key generation instruction, generates a first key request including a public key of the SM2 temporary key pair and a preset chip unique serial number, and calculates a first authentication code for the first key request using a preset root key; The terminal device generates, in response to the first key request, a second key request including the first key request and a first authentication code and sends the second key request to the Internet of Things platform; The Internet of Things platform sends the second key request to a key generation center; The key generation center responds to the second key request, obtains the corresponding salt value from the relationship table according to the chip unique serial number in the first key request, generates a root key through a key derivation algorithm, uses the root key to calculate the second authentication code for the first key request, and when the second authentication code matches the first authentication code, generates a user key and uses the public key of the SM2 temporary key pair in the first key request to encrypt the user key to obtain a user key ciphertext, and then uses the root key to calculate a third authentication code for a key package consisting of the user key ciphertext and the key generation center identifier, and sends the key package and the third authentication code to the Internet of Things platform; The Internet of Things platform sends the key package and the third authentication code to the terminal device; The terminal device forwards the key package and the third authentication code to the super SIM card; The super SIM card uses the root key to calculate the fourth identification code for the key package. When the fourth identification code matches the third identification code, the private key of the SM2 temporary key pair is used to decrypt the user key ciphertext in the key package to obtain the user key, and the user key and the key generation center identifier in the key package are stored in the memory.

Images