Data processing method and device

Abstract

The invention discloses a data processing method and device. According to the method, under the condition that an SDP control center and an SDP client are successfully authorized based on a temporary SPA seed single packet, the security of target SPA seed transmission is sent to the SDP client by using the SDP control center. According to the invention, the SDP client sends the target SPA seed to the SIM card for storage, so that the security of the target SPA seed during storage can be improved. Therefore, according to the embodiment of the invention, the safety of using the SPA seeds can be improved.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a method and device for data processing. Background Art

[0002] With the development of new technologies such as cloud computing, mobile Internet, Internet of Things, and artificial intelligence, network security boundaries are gradually disintegrating. In order to protect secure access to network resources and adapt to complex and changing network environments, a zero-trust architecture based on software-defined perimeter (SDP) technology has emerged. The seed-based single packet authorization (SPA) technology is used in the zero-trust architecture as an important security measure.

[0003] In the current zero-trust architecture based on SDP technology, before the SDP client establishes a connection with the SDP control center, the SDP client needs to send a SPA data packet containing a SPA seed to the SDP control center. Only after passing the single-packet authorization authentication can the SDP client and the SDP control center be connected.

[0004] However, currently, SPA seeds are usually stored in a database, configuration file or registry of a client. Since the operating system usage environment corresponding to the client is complex, the SPA seeds are easily leaked.

[0005] Therefore, using SPA seeds is not very safe. Summary of the invention

[0006] The embodiments of the present disclosure provide a data processing method, apparatus, device, computer storage medium, and computer program product, which can improve the security of using SPA seeds.

[0007] In a first aspect, an embodiment of the present disclosure provides a data processing method, which is applied to an SDP client, and the method includes:

[0008] Establish a communication connection with the SDP control center;

[0009] Receive the temporary SPA seed sent by the SDP control center;

[0010] Sending a data packet corresponding to the temporary SPA seed to the SDP control center for single packet authorization authentication;

[0011] Receive the target SPA seed sent by the SDP control center;

[0012] A seed storage instruction is sent to the SIM card, where the seed storage instruction is used to instruct the SIM card to store the target SPA seed.

[0013] In one possible implementation, sending a seed storage instruction to a SIM card includes:

[0014] Based on the application protocol data unit APDU protocol and the preset SIM card application interface, a seed storage instruction including target parameters is sent to the SIM card.

[0015] In an achievable implementation, the target parameter includes a first field for recording an encryption algorithm and a second field for recording a target SPA seed, wherein the encryption algorithm is used to encrypt the target SPA seed when it is stored in the SIM card.

[0016] In one practicable implementation, after establishing a communication connection with the SDP control center, the method further includes:

[0017] A temporary session key corresponding to the communication connection is sent to the SIM card, where the temporary session key is used to encrypt a target SPA request packet including a target SPA seed.

[0018] In one possible implementation, after sending the seed storage instruction to the SIM card, the method further includes:

[0019] In response to the target control instruction, based on the application protocol data unit APDU protocol and the preset SIM card application interface, a seed reading instruction is sent to the SIM card, where the seed reading instruction is used to instruct the SIM card to send a target SPA request packet containing a target SPA seed;

[0020] Send the target SPA request packet to the SDP control center for single packet authorization authentication.

[0021] In a second aspect, an embodiment of the present disclosure provides a data processing method, characterized in that it is applied to a SIM card, and the method includes:

[0022] receiving a seed storage instruction sent by the SDP client, where the seed storage instruction includes a target SPA seed;

[0023] A corresponding operation is performed according to the seed storage instruction, and the operation is used to store the target SPA seed.

[0024] In one achievable implementation, the SIM card includes a management application, the seed storage instruction also includes identification information and an encryption algorithm of the management application, and corresponding operations are performed according to the seed storage instruction, including:

[0025] Encrypt the target SPA seed according to the encryption algorithm to obtain the encrypted target SPA seed;

[0026] Determining a corresponding management application based on identification information of the management application;

[0027] Use the management application to create a target file to store the encrypted target SPA seed.

[0028] In an achievable implementation, before receiving the seed storage instruction sent by the SDP client, the method further includes:

[0029] Receive the temporary session key sent by the SDP client;

[0030] Create a target container to store temporary session keys.

[0031] In one practicable implementation, creating a target container includes:

[0032] Resources are allocated to an object corresponding to the target container for creating the target container, the object including a session key RAM storage space.

[0033] In one feasible implementation, the session key RAM storage space includes a session key management storage area and a session key storage area. The session key management storage area is used to store relevant information corresponding to the temporary session key, and the session key storage area is used to store the temporary session key.

[0034] In one possible implementation, after executing the corresponding operation according to the seed storage instruction, the method further includes:

[0035] Receive the seed reading instruction sent by the SDP client;

[0036] Execute a corresponding target operation based on the seed read instruction to obtain a target SPA request packet including a target SPA seed;

[0037] A target SPA request packet is sent to the SDP client so that the SDP client can perform single-packet authorization authentication on the SDP control center based on the target SPA request packet.

[0038] In an achievable implementation, a corresponding target operation is performed based on the seed read instruction to obtain a target SPA request packet including a target SPA seed, including:

[0039] Execute a corresponding target operation based on the seed reading instruction to obtain an encrypted target SPA request packet including a target SPA seed encrypted based on a temporary session key;

[0040] Send the target SPA request packet to the SDP client, including:

[0041] Send an encrypted target SPA request packet to the SDP client.

[0042] In a third aspect, an embodiment of the present disclosure provides a data processing method, which is applied to an SDP control center. The method includes:

[0043] Establish a communication connection with the SDP client;

[0044] Sending a temporary SPA seed generated according to a preset temporary seed key and a count value to the SDP client;

[0045] Receive a data packet corresponding to a temporary SPA seed sent by an SDP client for single packet authorization authentication;

[0046] When the single-packet authorization authentication passes, the target SPA seed is sent to the SDP client so that the SDP client can send the target SPA seed to the SIM card.

[0047] In an achievable implementation, before sending the target SPA seed to the SDP client, the method further includes:

[0048] A target SPA seed is generated according to the pre-acquired target information, where the target information includes the SIM card identifier and the terminal hardware feature code.

[0049] In an achievable implementation, after sending the target SPA seed to the SDP client, the method further includes:

[0050] receiving a target SPA request packet including a target SPA seed sent by the SDP client, where the target SPA seed is obtained by the SDP client from the SIM card;

[0051] Perform single-packet authorization verification based on the target SPA request packet.

[0052] In a fourth aspect, an embodiment of the present disclosure provides a data processing device, which is applied to an SDP client, and the device includes:

[0053] A connection module, used to establish a communication connection with the SDP control center;

[0054] A receiving module, used for receiving a temporary SPA seed sent by the SDP control center;

[0055] A sending module, used for sending a data packet corresponding to a temporary SPA seed to an SDP control center for single packet authorization authentication;

[0056] The receiving module is also used to receive the target SPA seed sent by the SDP control center;

[0057] The sending module is further used to send a seed storage instruction to the SIM card, where the seed storage instruction is used to instruct the SIM card to store the target SPA seed.

[0058] In a fifth aspect, an embodiment of the present disclosure provides a data processing device, which is applied to a SIM card, and the device includes:

[0059] A receiving module, used for receiving a seed storage instruction sent by the SDP client, where the seed storage instruction includes a target SPA seed;

[0060] The execution module is used to execute a corresponding operation according to the seed storage instruction, and the operation is used to store the target SPA seed.

[0061] In a sixth aspect, an embodiment of the present disclosure provides a data processing device, which is applied to an SDP control center, and the device includes:

[0062] Establish a communication connection with the SDP client;

[0063] Sending a temporary SPA seed generated according to a preset temporary seed key and a count value to the SDP client;

[0064] Receive a data packet corresponding to a temporary SPA seed sent by an SDP client for single packet authorization authentication;

[0065] When the single-packet authorization authentication passes, the target SPA seed is sent to the SDP client so that the SDP client can send the target SPA seed to the SIM card.

[0066] In the seventh aspect, an embodiment of the present disclosure provides a data processing device, the device including a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement a data processing method such as any one of the first aspect, the second aspect, or the third aspect.

[0067] In an eighth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, which stores computer program instructions. When the computer program instructions are executed by a processor, a method for data processing as described in any one of the first aspect, the second aspect, or the third aspect is implemented.

[0068] In a ninth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements a data processing method as described in any one of the first aspect, the second aspect, or the third aspect.

[0069] The embodiments of the present disclosure provide a method, apparatus, device, computer storage medium and computer program product for data processing. The method establishes a communication connection with an SDP control center. A temporary SPA seed sent by the SDP control center is received. A data packet corresponding to the temporary SPA seed is sent to the SDP control center for single-packet authorization authentication. A target SPA seed sent by the SDP control center is received. A seed storage instruction is sent to a SIM card. In the embodiment of the present disclosure, when the SDP control center and the SDP client are successfully authorized based on a single packet of temporary SPA seeds, the security of the target SPA seed transmission sent by the SDP control center to the SDP client is improved. By sending the target SPA seed to the SIM card for storage by the SDP client, the security of the target SPA seed during storage can be improved. Therefore, the embodiments of the present disclosure can improve the security of using SPA seeds. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the following is a brief introduction to the drawings required for use in the embodiment of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0071] Figure 1 is a flowchart of a data processing method provided by an embodiment of the present disclosure;

[0072] Figure 2 is a flowchart of another data processing method provided by an embodiment of the present disclosure;

[0073] Figure 3 is a structural diagram of a data processing device provided by an embodiment of the present disclosure;

[0074] Figure 4 is a structural schematic diagram of another data processing device provided by an embodiment of the present disclosure;

[0075] Figure 5 is a structural schematic diagram of another data processing device provided by an embodiment of the present disclosure;

[0076] Figure 6 It is a structural diagram of a data processing device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0077] The features and exemplary embodiments of various aspects of the present invention will be described in detail below. In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present invention, rather than to limit the present invention. For those skilled in the art, the present invention can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present invention by illustrating examples of the present invention.

[0078] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0079] Before describing the technical solutions provided by the embodiments of the present disclosure, in order to facilitate understanding of the embodiments of the present disclosure, the present disclosure specifically describes the problems existing in the related technologies:

[0080] With the development of new technologies such as cloud computing, mobile Internet, Internet of Things, and artificial intelligence, network security boundaries are gradually disintegrating, internal and external threats are becoming more and more severe, and traditional border security architectures are difficult to cope with these threats. Therefore, the zero-trust architecture based on SDP technology came into being, and the seed-based SPA single-packet authorization technology is used in the zero-trust architecture as an important security means.

[0081] Currently, in the zero-trust architecture based on SDP technology, before the SDP client establishes a connection with the SDP control center, the SDP client needs to send a SPA data packet containing a SPA seed to the SDP control center. Only after passing the single-packet authorization authentication can the SDP client and the SDP control center be connected.

[0082] Given the importance of SPA seeds, how to safely store and use SPA seeds has become a focus of attention in the SDP architecture. At present, related technologies usually use end-side storage, where SPA seeds are stored in the database, configuration file, or registry of the SDP client, and soft encryption and decryption technology is used to ensure the security of seed storage and use.

[0083] However, storing SPA seeds in the database, configuration file or registry of the SDP client still poses great risks, because the operating system environment of the SDP client is complex and can easily lead to the leakage of SPA seeds. Secondly, SPA seeds need to be encrypted by source and channel during transmission. Once the keys of source encryption and channel encryption are leaked, the SPA seeds will also be leaked.

[0084] In summary, the safety of using SPA seeds is not high.

[0085] The embodiments of the present disclosure provide a data processing method, apparatus, device, computer storage medium, and computer program product, which can solve the above-mentioned technical problems existing in the related technologies.

[0086] The embodiment of the present disclosure establishes a communication connection with the SDP control center. Receives a temporary SPA seed sent by the SDP control center. Sends a data packet corresponding to the temporary SPA seed to the SDP control center for single-packet authorization authentication. Receives a target SPA seed sent by the SDP control center. Sends a seed storage instruction to the SIM card. In the case where the SDP control center and the SDP client are successfully authorized based on a single packet of temporary SPA seeds, the embodiment of the present disclosure utilizes the security of the transmission of the target SPA seed sent by the SDP control center to the SDP client. The security of the target SPA seed can be improved by sending the target SPA seed to the SIM card for storage by the SDP client. Therefore, the embodiment of the present disclosure can improve the security of using SPA seeds.

[0087] The following is an introduction to the data processing method provided by the embodiments of the present disclosure.

[0088] Figure 1 FIG. 1 is a flow chart showing a method for data processing provided by an embodiment of the present disclosure. Figure 1 The method may include the following steps S101-S190.

[0089] S101: The SDP client establishes a communication connection with the SDP control center.

[0090] In this embodiment, the SDP client establishes a communication connection with the SDP control center.

[0091] In one embodiment, the SDP client and the SDP control center may establish a communication connection based on a public key certificate.

[0092] In one example, the SDP client establishes a secure sockets layer (SSL) bidirectional encrypted channel with the SDP control center. The SDP client sends the SIM card public key certificate to the SDP control center, and the SDP control center sends the SDP control center public key certificate to the SDP client and verifies the legitimacy of the public key certificate. If the public key certificate verification is successful, the SDP client establishes a communication connection with the SDP control center.

[0093] S102: The SDP control center sends a temporary SPA seed generated according to a preset temporary seed key and a count value to the SDP client.

[0094] In this embodiment, after the SDP client establishes a communication connection with the SDP control center, the SDP control center generates a temporary SPA seed according to a preset temporary seed key and a count value, and then sends the temporary SPA seed to the SDP client.

[0095] Among them, the temporary SPA seed represents a temporary public seed.

[0096] In one embodiment, the SDP control center may use a time-based one-time password (HMAC-based One-time Password, HOTP) encryption algorithm to generate a temporary SPA seed from a temporary seed key and a count value.

[0097] S103: The SDP client receives the temporary SPA seed sent by the SDP control center.

[0098] In this embodiment, the SDP client uses a receiving component to receive the temporary SPA seed sent by the SDP control center.

[0099] S104: The SDP client sends a data packet corresponding to the temporary SPA seed to the SDP control center.

[0100] In this embodiment, after receiving the temporary SPA seed sent by the SDP control center, the SDP client generates a data packet corresponding to the temporary SPA seed and sends it to the SDP control center for single-packet authorization authentication in the SDP control center.

[0101] In the step flow of the embodiment of the present disclosure, the SDP client sends a temporary SPA seed to the SDP control center for single-packet authorization authentication, which can improve the security of subsequent transmission of the target SPA seed.

[0102] S105: When the single-packet authorization authentication is passed, the SDP control center sends the target SPA seed to the SDP client.

[0103] In this embodiment, after receiving the data packet sent by the SDP client, the SDP control center performs single packet authorization authentication based on the data packet. If the single packet authorization authentication passes, the SDP control center sends the target SPA seed to the client for the SDP client to send the target SPA seed to the SIM card.

[0104] Among them, the target SPA seed represents a private seed.

[0105] S106: The SDP client receives the target SPA seed sent by the SDP control center.

[0106] In this embodiment, the SDP client uses a receiving component to receive the target SPA seed sent by the SDP control center.

[0107] S107: The SDP client sends a seed storage instruction to the SIM card.

[0108] In this embodiment, after receiving the target SPA seed, the SDP client creates a seed storage command corresponding to the target SPA seed to instruct the SIM card to store the target SPA seed according to the seed storage instruction.

[0109] It is understandable that the environment of the SIM card is not complicated compared to the SDP client. By storing the target SPA seed in the SIM card, the leakage of the SPA seed can be avoided, thereby improving the security of the SPA seed.

[0110] S108: The SIM card receives the seed storage instruction sent by the SDP client.

[0111] In this embodiment, the SIM card receives the seed storage instruction sent by the SDP client.

[0112] The seed storage instruction includes a target SPA seed.

[0113] S109: The SIM card executes corresponding operations according to the seed storage instruction.

[0114] In this embodiment, after receiving the seed storage instruction sent by the SDP client, the SIM card performs corresponding operations according to the seed storage instruction.

[0115] Among them, the operation is used to store the target SPA seed.

[0116] In the embodiment of the disclosure, when the SDP control center and the SDP client successfully authorize a single packet based on a temporary SPA seed, the SDP control center sends the target SPA seed to the SDP client to improve the security of the transmission. The SDP client sends the target SPA seed to the SIM card for storage, which can improve the security of the target SPA seed.

[0117] In one embodiment, before sending the target SPA seed to the SDP client, the data processing method may further include step S110.

[0118] S110: The SDP control center generates a target SPA seed according to the pre-acquired target information.

[0119] The target information includes the SIM card identification and the terminal hardware feature code.

[0120] In one example, the terminal hardware feature code may be a hardware feature code of the SDP client.

[0121] The SDP control center of the embodiment of the present disclosure generates a target SPA seed through pre-acquired target information, so as to facilitate subsequent sending to the SDP client for the SDP client to send to the SIM card.

[0122] In one embodiment, the SDP client sending the seed storage instruction to the SIM card may include step S1071.

[0123] S1071: The SDP client sends a seed storage instruction including target parameters to the SIM card based on the application protocol data unit APDU protocol and a preset SIM card application interface.

[0124] In the disclosed embodiment, after receiving the target SPA seed sent by the SDP control center, the SDP client sends a seed storage instruction including target parameters to the SIM card according to the application protocol data unit APDU protocol and a preset SIM card application interface.

[0125] The preset SIM card application interface represents a custom SIM card application interface, and the seed storage instruction represents a custom format command.

[0126] In an example, the definition format of the seed storage instruction may be as shown in Table 1, wherein the seed storage instruction may include a CLA parameter, an INS parameter, a P1 parameter, a P2 parameter, an Lc parameter, and an APP-DATA parameter. The value of the INS parameter may be 08, 02, or 12, 08 indicates storing the target SPA seed, 02 indicates storing the temporary session key, and 12 indicates reading the target SPA seed information. The Lc parameter indicates the data message length of the APP-DATA parameter.

[0127] Table 1

[0128]

[0129]

[0130] The embodiment of the present disclosure sends a seed storage instruction including target parameters to a SIM card through an application protocol data unit APDU protocol and a preset SIM card application interface, so that the SIM card can store the target SAP seed according to the parameters in the seed storage instruction.

[0131] In one embodiment, the target parameter APP-DATA parameter may include a first field for recording an encryption algorithm and a second field for recording a target SPA seed, where the encryption algorithm is used to encrypt the target SPA seed when it is stored in the SIM card. It may also include a key index used by the encryption algorithm, a seed file name, and identification information of a SIM card seed management application.

[0132] In an example, the definition format of the APP-DATA parameter can be as shown in Table 2, where AppId represents the identification information of the SIM card seed management application, and the type is INT type; ENC_TYPE represents the encryption algorithm, and the type is STRING type; INDEX represents the key index used by the encryption algorithm, and the type is INT type; Fname is an optional option, representing the seed file name. If it is empty, the card application customizes the file name, and the Fname type is STRING type; HOTP represents the SPA seed data, and the type is STRING type.

[0133] Table 2

[0134] Fields type AppId INT ENC_TYPE STRING INDEX INT Fname STRING HOTP STRING

[0135] In one embodiment, after the SDP client establishes a communication connection with the SDP control center, the data processing method may further include step S111.

[0136] S111: The SDP client sends a temporary session key corresponding to the communication connection to the SIM card.

[0137] The temporary session key is used to encrypt the target SPA request packet including the target SPA seed.

[0138] In this embodiment, after acquiring the temporary session key, the SDP client sends the temporary session key corresponding to the communication connection to the SIM card.

[0139] In one embodiment, the temporary session key is determined based on a negotiation between the SDP client and the SDP control center through messages sent.

[0140] In one example, the SDP client negotiates an encryption algorithm with the SDP control center to generate a temporary session key.

[0141] In the disclosed embodiment, a temporary session key corresponding to a communication connection is sent from an SDP client to a SIM card, so that the temporary session key can be stored in the SIM card, thereby preventing leakage of the temporary session key in the SDP client, so that the target SPA seed can be included based on the temporary session key, thereby improving the security of the target SPA seed during transmission.

[0142] In one embodiment, the SIM card includes a management application, the seed storage instruction also includes identification information and an encryption algorithm of the management application, and performing corresponding operations according to the seed storage instruction may include steps S1091-S1093.

[0143] S1091: The SIM card encrypts the target SPA seed according to an encryption algorithm to obtain an encrypted target SPA seed.

[0144] In the disclosed embodiment, the SIM card encrypts the target SPA seed according to the encryption algorithm in the seed storage instruction to obtain the encrypted target SPA seed.

[0145] In the disclosed embodiment, by encrypting the target SPA seed, the security of the target SPA seed when stored in the SIM card can be further improved.

[0146] S1092: The SIM card determines a corresponding management application based on the identification information of the management application.

[0147] In the embodiment of the present disclosure, the SIM card determines the corresponding management application according to the identification information of the management application in the seed storage instruction to store the target SPA seed in the management application.

[0148] S1093: The SIM card uses the management application to create a target file to store the encrypted target SPA seed.

[0149] In the embodiment of the present disclosure, after determining the management application, the SIM card uses the management application to create a target file to store the encrypted target SPA seed.

[0150] The SIM card of the embodiment of the present disclosure performs corresponding operations according to the seed storage instruction, and can store the target SPA seed in the designated management application to improve the security of the target SPA seed.

[0151] In one embodiment, the corresponding application storage structure of the management application of the SIM card may include a device global configuration area EE, a device information EE storage area, and a device authentication key management area EE. The relevant configuration parameters corresponding to the device global configuration area EE include whether to support plain text update of device authentication keys and PIN keys, the maximum number of session keys supported by each container, the total space for storing session keys in each container, the maximum file space allowed to be created by each application, the maximum number of containers allowed to be created by each application, and the maximum number of files allowed to be created by each application. The relevant configuration parameters corresponding to the device information EE storage area include parameters such as data structure version number, standard version number, device manufacturer information, maximum number of certificates supported by the application, maximum number of files supported by the application, RFU (54 bytes), etc. The relevant configuration parameters corresponding to the device authentication key management area EE include parameters such as the remaining number of attempts for the device authentication key and the maximum number of attempts for the device authentication key.

[0152] In one embodiment, the SIM card can allocate resources for objects corresponding to the management application, namely, application ID, application name EE storage area, application administrator PIN object, application user PIN object, application container object array, application file object array, temporary buffer, etc. to create the management application. The temporary buffer includes information such as whether the application is opened, the user PIN verification status of the application, the administrator PIN verification status of the application, and whether the container under the application is opened.

[0153] In one embodiment, the management application of the SIM card may allocate resources for objects corresponding to the target file, namely, the file name EE storage area, the file content EE storage area and the file read and write permissions to create the target file.

[0154] In one embodiment, after the SIM card performs the corresponding operation according to the seed storage instruction, the SIM card can also send feedback information to the SDP client. The feedback information includes a status code, a file name, and a file index value. Among them, the status code consists of two parts such as SW1 and SW2, and the status code and the corresponding representation information are shown in Table 3.

[0155] Table 3

[0156] SW1 SW2 Display information 90 00 Correct execution 67 00 Length error (Lc is empty) 69 81 The referenced algorithm is not supported 6A 82 The referenced application does not exist 6A 83 The referenced index does not exist 6A 84 The corresponding key does not exist in the index

[0157] In one embodiment, before receiving the seed storage instruction sent by the SDP client, the method further includes, and may further include, step S112 and step S113.

[0158] S112: The SIM card receives the temporary session key sent by the SDP client.

[0159] In this embodiment, the SIM card receives the temporary session key sent by the SDP client.

[0160] S113: The SIM card creates a target container to store the temporary session key.

[0161] In this embodiment, the SIM card creates a target container to store the temporary session key.

[0162] The SIM card in the embodiment of the present disclosure can improve the security of the temporary session key during storage by storing the temporary session key in the target container.

[0163] In one embodiment, creating a target container may include step S1131.

[0164] S1131: The SIM card allocates resources to the object corresponding to the target container for creating the target container.

[0165] Among them, the object includes session key RAM storage space.

[0166] In this embodiment, the SIM card allocates resources to the object corresponding to the target container for creating the target container.

[0167] In one embodiment, the management application of the SIM card allocates resources to the object corresponding to the target container for creating the target container.

[0168] In one example, the management application of the SIM card can allocate resources to objects corresponding to the target container, namely, container ID, container name EE storage area, container type, asymmetric key object, certificate object array, session key RAM storage space, etc., for creating the target container.

[0169] The target container determines the corresponding space storage certificate according to the size of the container type. If it is an ECC container, a fixed 1K space storage certificate is applied for. If it is an RSA container, a fixed 2K space storage certificate is applied for.

[0170] In the embodiment of the present disclosure, by creating a target container, the target SPA seed can be stored in the target container.

[0171] In one embodiment, the session key RAM storage space includes a session key management storage area and a session key storage area. The session key management storage area is used to store relevant information corresponding to the temporary session key, and the session key storage area is used to store the temporary session key. The session key management storage area is used to store 2 bytes of key storage area used offset information and 8 bytes of key related information, so its space size is 2+8*keynum bytes. The session key storage area is used to store each temporary session key, and the size is determined by the space in the global configuration area.

[0172] In one embodiment, a flowchart of another data processing method is shown as follows: Figure 2 As shown, steps S201-S207 may be included.

[0173] S201: The SDP client sends a seed reading instruction to the SIM card in response to the target control instruction based on the application protocol data unit APDU protocol and a preset SIM card application interface.

[0174] The seed reading instruction is used to instruct the SIM card to send a target SPA request packet containing a target SPA seed.

[0175] In this embodiment, the SDP client sends a seed reading instruction to the SIM card in response to the target control instruction based on the application protocol data unit APDU protocol and a preset SIM card application interface.

[0176] In one example, the target control instruction may be generated by a user triggering the SDP client.

[0177] The definition format of the seed read instruction may be as shown in Table 4, wherein the seed read instruction may include a CLA parameter, an INS parameter, a P1 parameter, a P2 parameter, an Lc parameter, and an APP-DATA parameter. The value of the INS parameter may be 08, 02, or 12, 08 indicates storing the target SPA seed, 02 indicates storing the temporary session key, and 12 indicates reading the target SPA seed information. The Lc parameter indicates the data message length of the APP-DATA parameter.

[0178] Table 4

[0179] parameter length Value (Hex) CLA 1 80 INS 1 08 P1 1 XX P2 1 XX Lc 2 0X APP-DATA XXX XXX

[0180] Among them, the definition format and representation information of the APP-DATA parameter can be shown in Table 5.

[0181] Table 5

[0182] Fields type Display information AppId INT App ID TYPE STRING Decryption algorithm | Digest algorithm | Signature algorithm ENC_INDEX INT The key index used by the decryption algorithm SIG_INDEX INT Signature using private key index SES_INDEX INT Session Key Index SPA_INDEX INT Seed storage file index Spa_Pack STRING SPA authentication package data format

[0183] Among them, the definition format and representation information of the Spa_Pack field can be shown in Table 6.

[0184] Table 6

[0185]

[0186] S202: The SIM card receives a seed reading instruction sent by the SDP client.

[0187] In this embodiment, the SIM card receives the seed reading instruction sent by the SDP client.

[0188] S203: The SIM card executes a corresponding target operation based on the seed reading instruction, and obtains a target SPA request packet including a target SPA seed.

[0189] In this embodiment, the SIM card executes a corresponding target operation according to the received seed reading instruction, and obtains a target SPA request packet including a target SPA seed.

[0190] In one example, the SIM card performs the corresponding target operation based on the seed reading instruction, which may be: the SIM card analyzes and obtains the management application to be called, the method of performing cryptographic operations on the target SPA seed, the index of each key, the seed file index, etc. Then, the management application first calls the cryptographic operation capability of the SIM card to decrypt the file including the target SPA seed, and then adds the seed content to the hotp field of the target SPA request packet; secondly, the digest algorithm is used to perform a digest operation on the content of the target SPA request packet, and the digest data is signed using the specified private key.

[0191] S204: The SIM card sends a target SPA request packet to the SDP client so that the SDP client performs single-packet authorization authentication on the SDP control center based on the target SPA request packet.

[0192] In this embodiment, the SIM card sends a target SPA request packet to the SDP client so that the SDP client performs single-packet authorization authentication on the SDP control center based on the target SPA request packet.

[0193] S205: The SDP client sends a target SPA request packet to the SDP control center for single-packet authorization authentication.

[0194] In this embodiment, the SDP client sends a target SPA request packet to the SDP control center for single-packet authorization authentication.

[0195] S206: The SDP control center receives a target SPA request packet including a target SPA seed sent by the SDP client.

[0196] The target SPA seed is obtained by the SDP client from the SIM card.

[0197] In this embodiment, the SDP control center receives a target SPA request packet including a target SPA seed sent by the SDP client.

[0198] S207: The SDP control center performs single-packet authorization verification based on the target SPA request packet.

[0199] In this embodiment, the SDP control center performs single-packet authorization verification based on the target SPA request packet.

[0200] In one example, after receiving the target SPA request package, the SDP control center uses the public key certificate of the SIM card to verify the SDP single package authorization authentication data table of the target SPA request package, and uses the private certificate of the SDP control center to decrypt the seed ciphertext. After the SDP control center successfully verifies the signature and decrypts, it verifies each field of the Spa_Pack data packet. If they are all legal, the single package authorization authentication is passed.

[0201] In the disclosed embodiment, a seed reading instruction sent by an SDP client is received through a SIM card, and a target SPA request packet is sent to the SDP client so that the SDP client can perform single-packet authorization authentication on the SDP control center based on the target SPA request packet, thereby improving the security of generating the target SPA request packet.

[0202] In one embodiment, executing a corresponding target operation based on a seed read instruction to obtain a target SPA request packet including a target SPA seed may include step S2031.

[0203] S2031: The SIM card executes a corresponding target operation based on the seed reading instruction, and obtains an encrypted target SPA request packet including a target SPA seed encrypted based on a temporary session key.

[0204] In this embodiment, the SIM card executes the corresponding target operation based on the seed reading instruction, and obtains an encrypted target SPA request packet including the target SPA seed encrypted based on the temporary session key.

[0205] In one embodiment, sending the target SPA request packet to the SDP client may include step S2041.

[0206] S2041: The SIM card sends an encrypted target SPA request packet to the SDP client.

[0207] In this embodiment, after obtaining the encrypted target SPA request packet, the SIM card sends the encrypted target SPA request packet to the SDP client.

[0208] The disclosed embodiment encrypts the target SPA seed by using the temporary session key of the SIM card to obtain an encrypted target SPA request packet, and sends it to the SDP client, which can improve the security of the encrypted target SPA request packet during transmission.

[0209] like Figure 3 As shown, the embodiment of the present disclosure further provides a data processing device 300, which is applied to an SDP client. The data processing device 300 includes:

[0210] Establishing module 301, used to establish a communication connection with the SDP control center;

[0211] The receiving module 302 is used to receive a temporary SPA seed sent by the SDP control center;

[0212] The sending module 303 is used to send a data packet corresponding to the temporary SPA seed to the SDP control center for single packet authorization authentication;

[0213] The receiving module 302 is further used to receive the target SPA seed sent by the SDP control center;

[0214] The sending module 303 is further used to send a seed storage instruction to the SIM card, where the seed storage instruction is used to instruct the SIM card to store the target SPA seed.

[0215] In the case where the SDP control center and the SDP client successfully authorize a single packet based on a temporary SPA seed, the disclosed embodiment uses the security of the target SPA seed transmission sent by the SDP control center to the SDP client. The security of the target SPA seed can be improved by sending the target SPA seed to the SIM card for storage by the SDP client. Therefore, the disclosed embodiment can improve the security of using the SPA seed.

[0216] In some embodiments, the sending module 303 is specifically configured to:

[0217] Based on the application protocol data unit APDU protocol and the preset SIM card application interface, a seed storage instruction including target parameters is sent to the SIM card.

[0218] In some embodiments, the target parameter includes a first field for recording an encryption algorithm and a second field for recording a target SPA seed, the encryption algorithm being used to encrypt the target SPA seed when it is stored in the SIM card.

[0219] In some embodiments, the sending module 303 is specifically configured to:

[0220] A temporary session key corresponding to the communication connection is sent to the SIM card, where the temporary session key is used to encrypt a target SPA request packet including a target SPA seed.

[0221] In some embodiments, the sending module 303 is specifically configured to:

[0222] In response to the target control instruction, based on the application protocol data unit APDU protocol and the preset SIM card application interface, a seed reading instruction is sent to the SIM card, where the seed reading instruction is used to instruct the SIM card to send a target SPA request packet containing a target SPA seed;

[0223] Send the target SPA request packet to the SDP control center for single packet authorization authentication.

[0224] Figure 3Each module / unit in the device shown has the function of realizing Figure 1 to Figure 2 The functions of each step executed by the application system in the present invention can achieve the corresponding technical effects. For the sake of brevity, they will not be repeated here.

[0225] like Figure 4 As shown, the embodiment of the present disclosure further provides a data processing device 400, which is applied to a SIM card. The data processing device 400 includes:

[0226] The receiving module 401 is used to receive a seed storage instruction sent by the SDP client, where the seed storage instruction includes a target SPA seed;

[0227] The execution module 402 is used to execute a corresponding operation according to the seed storage instruction, and the operation is used to store the target SPA seed.

[0228] In some embodiments, the data processing device 400 further includes an encryption module, which is used to encrypt the target SPA seed according to an encryption algorithm to obtain an encrypted target SPA seed;

[0229] Determining a corresponding management application based on identification information of the management application;

[0230] Use the management application to create a target file to store the encrypted target SPA seed.

[0231] In some embodiments, the receiving module 401 is specifically configured to:

[0232] Receive the temporary session key sent by the SDP client;

[0233] Create a target container to store temporary session keys.

[0234] In some embodiments, the data processing apparatus 400 includes a creation module, and the creation module is used to allocate resources to an object corresponding to the target container for creating the target container, and the object includes a session key RAM storage space.

[0235] In some embodiments, the session key RAM storage space includes a session key management storage area and a session key storage area, the session key management storage area is used to store relevant information corresponding to the temporary session key, and the session key storage area is used to store the temporary session key.

[0236] In some embodiments, the receiving module 401 is specifically configured to:

[0237] Receive the seed reading instruction sent by the SDP client;

[0238] Execute a corresponding target operation based on the seed read instruction to obtain a target SPA request packet including a target SPA seed;

[0239] A target SPA request packet is sent to the SDP client so that the SDP client can perform single-packet authorization authentication on the SDP control center based on the target SPA request packet.

[0240] In some embodiments, the execution module 402 is specifically configured to:

[0241] Execute a corresponding target operation based on the seed reading instruction to obtain an encrypted target SPA request packet including a target SPA seed encrypted based on a temporary session key;

[0242] Send the target SPA request packet to the SDP client, including:

[0243] Send an encrypted target SPA request packet to the SDP client.

[0244] Figure 4 Each module / unit in the device shown has the function of realizing Figure 1 to Figure 2 The functions of each step executed by the application system in the present invention can achieve the corresponding technical effects. For the sake of brevity, they will not be repeated here.

[0245] like Figure 5 As shown, the embodiment of the present disclosure further provides a data processing device 500, which is applied to the SDP control center. The data processing device 500 includes:

[0246] Establishing module 501, used to establish a communication connection with the SDP client;

[0247] A sending module 502 is used to send a temporary SPA seed generated according to a preset temporary seed key and a count value to the SDP client;

[0248] The receiving module 503 is used to receive a data packet corresponding to a temporary SPA seed sent by the SDP client to perform single packet authorization authentication;

[0249] The sending module 502 is further configured to send the target SPA seed to the SDP client when the single packet authorization authentication is passed, so that the SDP client can send the target SPA seed to the SIM card.

[0250] In some embodiments, the data processing device 500 includes a generation module, and the generation module is used to generate a target SPA seed according to pre-acquired target information, and the target information includes a SIM card identifier and a terminal hardware feature code.

[0251] In some embodiments, the receiving module 503 is specifically configured to:

[0252] receiving a target SPA request packet including a target SPA seed sent by the SDP client, where the target SPA seed is obtained by the SDP client from the SIM card;

[0253] Perform single-packet authorization verification based on the target SPA request packet.

[0254] Figure 5 Each module / unit in the device shown has the function of realizing Figure 1 to Figure 2 The functions of each step executed by the application system in the present invention can achieve the corresponding technical effects. For the sake of brevity, they will not be repeated here.

[0255] Figure 6 A schematic diagram of the hardware structure of data processing provided by an embodiment of the present disclosure is shown.

[0256] The data processing device may include a processor 601 and a memory 602 storing computer program instructions.

[0257] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0258] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 602 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory.

[0259] The memory 602 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present disclosure.

[0260] The processor 601 implements any one of the data processing methods in the above embodiments by reading and executing computer program instructions stored in the memory 602 .

[0261] In one example, the data processing device may further include a communication interface 603 and a bus 604. Figure 6 As shown, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 604 and communicate with each other.

[0262] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0263] Bus 604 includes hardware, software or both, and couples the components of online data flow billing equipment to each other. For example, but not limitation, the bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), Hyper Transport (HT) interconnection, Industry Standard Architecture (ISA) bus, InfiniBand interconnection, Low Pin Count (LPC) bus, Memory bus, Micro Channel Architecture (MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association Local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 604 may include one or more buses. Although the embodiment of the present invention describes and shows a specific bus, the present invention considers any suitable bus or interconnection. In addition, in conjunction with the method for data processing in the above-mentioned embodiment, the embodiment of the present application also provides a computer storage medium to realize. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the data processing methods in the above embodiments is implemented.

[0264] An embodiment of the present application also provides a computer program product, including a computer program, which implements any one of the data processing methods in the above embodiments when the computer program is executed by a processor.

[0265] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0266] The functional blocks shown in the above structural block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), appropriate firmware, plug-in, function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or communication link by a data signal carried in a carrier. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (Read-Only Memory, ROM), flash memory, erasable read-only memory (Erasable ReadOnly Memory, EROM), floppy disks, compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical discs, hard disks, optical fiber media, radio frequency (Radio Frequency, RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0267] It should also be noted that the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in a different order from the embodiments, or several steps can be performed simultaneously.

[0268] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0269] The above is only a specific implementation of the present invention. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be covered within the protection scope of the present invention.

Claims

1. A method for data processing, characterized in that: Applied to the SDP client, the method comprises: Establish a communication connection with the SDP control center; Receiving a temporary SPA seed sent by the SDP control center; Sending a data packet corresponding to the temporary SPA seed to the SDP control center for single packet authorization authentication; Receiving a target SPA seed sent by the SDP control center; A seed storage instruction is sent to the SIM card, where the seed storage instruction is used to instruct the SIM card to store the target SPA seed.

2. The method according to claim 1, characterized in that: The step of sending a seed storage instruction to the SIM card comprises: Based on the application protocol data unit APDU protocol and the preset SIM card application interface, a seed storage instruction including target parameters is sent to the SIM card.

3. The method according to claim 2, characterized in that The target parameter includes a first field for recording an encryption algorithm and a second field for recording the target SPA seed, wherein the encryption algorithm is used to encrypt the target SPA seed when it is stored in the SIM card.

4. The method according to claim 1, characterized in that: After establishing a communication connection with the SDP control center, the method further includes: A temporary session key corresponding to the communication connection is sent to the SIM card, where the temporary session key is used to encrypt a target SPA request packet including the target SPA seed.

5. The method according to any one of claims 1 to 4, characterized in that: After sending the seed storage instruction to the SIM card, the method further includes: In response to the target control instruction, based on the application protocol data unit APDU protocol and the preset SIM card application interface, a seed reading instruction is sent to the SIM card, wherein the seed reading instruction is used to instruct the SIM card to send a target SPA request packet containing the target SPA seed; The target SPA request packet is sent to the SDP control center for single packet authorization authentication.

6. A method of data processing, characterized in that: Applied to a SIM card, the method comprises: Receiving a seed storage instruction sent by the SDP client, wherein the seed storage instruction includes a target SPA seed; A corresponding operation is performed according to the seed storage instruction, where the operation is used to store the target SPA seed.

7. The method according to claim 6, characterized in that The SIM card includes a management application, the seed storage instruction also includes identification information and an encryption algorithm of the management application, and performing corresponding operations according to the seed storage instruction includes: Encrypting the target SPA seed according to the encryption algorithm to obtain an encrypted target SPA seed; Determining a corresponding management application based on the identification information of the management application; A target file is created using the management application to store the encrypted target SPA seed.

8. The method according to claim 6, characterized in that Before receiving the seed storage instruction sent by the SDP client, the method further includes: Receiving a temporary session key sent by the SDP client; A target container is created to store the temporary session key.

9. The method according to claim 8, characterized in that The step of creating a target container includes: Resources are allocated to an object corresponding to the target container for creating the target container, wherein the object includes a session key RAM storage space.

10. The method according to claim 9, characterized in that The session key RAM storage space includes a session key management storage area and a session key storage area. The session key management storage area is used to store relevant information corresponding to the temporary session key, and the session key storage area is used to store the temporary session key.

11. The method according to claim 8, characterized in that After performing the corresponding operation according to the seed storage instruction, the method further includes: Receiving a seed reading instruction sent by the SDP client; Execute a corresponding target operation based on the seed read instruction to obtain a target SPA request packet including the target SPA seed; The target SPA request packet is sent to the SDP client so that the SDP client performs single-packet authorization authentication on the SDP control center based on the target SPA request packet.

12. The method according to claim 11, characterized in that The executing a corresponding target operation based on the seed reading instruction to obtain a target SPA request packet including the target SPA seed includes: Execute a corresponding target operation based on the seed reading instruction to obtain an encrypted target SPA request packet including the target SPA seed encrypted based on the temporary session key; The sending the target SPA request packet to the SDP client includes: Send the encrypted target SPA request packet to the SDP client.

13. A method of data processing, characterized in that: Applied to the SDP control center, the method includes: Establish a communication connection with the SDP client; Sending a temporary SPA seed generated according to a preset temporary seed key and a count value to the SDP client; Receiving a data packet corresponding to the temporary SPA seed sent by the SDP client to perform single packet authorization authentication; In a case where the single packet authorization authentication passes, a target SPA seed is sent to the SDP client so that the SDP client sends the target SPA seed to the SIM card.

14. The method according to claim 13, characterized in that Before sending the target SPA seed to the SDP client, the method further includes: The target SPA seed is generated according to the pre-acquired target information, wherein the target information includes a SIM card identifier and a terminal hardware feature code.

15. The method according to claim 13, characterized in that After sending the target SPA seed to the SDP client, the method further includes: receiving a target SPA request packet including the target SPA seed sent by the SDP client, where the target SPA seed is obtained by the SDP client from the SIM card; Single packet authorization verification is performed based on the target SPA request packet.

Images