Data processing methods and apparatus

Abstract

This application discloses a data processing method and apparatus. The method, upon successful authorization between the SDP control center and the SDP client based on a temporary SPA seed single packet, utilizes the security of sending the target SPA seed from the SDP control center to the SDP client. Sending the target SPA seed to the SIM card for storage via the SDP client improves the security of the target SPA seed during storage. Therefore, the embodiments of this disclosure enhance the security of using SPA seeds.

Description

Technical Field

[0001] This field relates to the field of security technology, and in particular to a data processing method and apparatus. Background Technology

[0002] With the development of new technologies such as cloud computing, mobile internet, the Internet of Things, and artificial intelligence, network security boundaries are gradually disintegrating. In order to protect secure access to network resources and adapt to complex and ever-changing network environments, zero-trust architecture based on Software Defined Perimeter (SDP) technology has emerged. Seed-based Single Packet Authorization (SPA) technology is used as an important security measure in zero-trust architecture.

[0003] In the current zero-trust architecture based on SDP technology, before an SDP client establishes a connection with the SDP control center, the SDP client needs to send an SPA data packet containing the SPA seed to the SDP control center. Only after single-packet authorization authentication can the SDP client and the SDP control center connect.

[0004] However, currently SPA seeds are usually stored in the client's database, configuration file or registry. Due to the complex operating system environment of the client, SPA seeds are easily leaked.

[0005] Therefore, the safety of using SPA seeds is not high. Summary of the Invention

[0006] This disclosure provides a data processing method, apparatus, device, computer storage medium, and computer program product that can improve the security of using SPA seeds.

[0007] In a first aspect, embodiments of this disclosure provide a data processing method applied to an SDP client, the method comprising:

[0008] Establish a communication connection with the SDP control center;

[0009] Receive temporary SPA seeds sent by the SDP control center;

[0010] Send the data packet corresponding to the temporary SPA seed to the SDP control center for single packet authorization authentication;

[0011] Receive the target SPA seed sent by the SDP control center;

[0012] Send a seed storage command to the SIM card. The seed storage command is used to instruct the SIM card to store the target SPA seed.

[0013] In one feasible implementation, sending a seed storage command to the SIM card includes:

[0014] Based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface, a seed storage command including target parameters is sent to the SIM card.

[0015] In one feasible implementation, the target parameters include a first field for recording the encryption algorithm and a second field for recording the target SPA seed, the encryption algorithm being used to encrypt the target SPA seed when it is stored on the SIM card.

[0016] In one feasible implementation, after establishing a communication connection with the SDP control center, the method further includes:

[0017] Send a temporary session key corresponding to the communication connection to the SIM card. The temporary session key is used to encrypt the target SPA request packet, which includes the target SPA seed.

[0018] In one feasible implementation, after sending the seed storage command to the SIM card, the method further includes:

[0019] In response to the target control command, a seed read command is sent to the SIM card based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface. The seed read command is used to instruct the SIM card to send a target SPA request packet containing the target SPA seed.

[0020] Send a target SPA request packet to the SDP control center for single packet authorization authentication.

[0021] In a second aspect, embodiments of this disclosure provide a data processing method, characterized in that it is applied to a SIM card, and the method includes:

[0022] Receive seed storage instructions sent by the SDP client, the seed storage instructions including the target SPA seed;

[0023] The corresponding operation is executed according to the seed storage instruction. The operation is used to store the target SPA seed.

[0024] In one feasible implementation, the SIM card includes a management application, and the seed storage instruction further includes identification information and an encryption algorithm of the management application. The corresponding operation is performed according to the seed storage instruction, including:

[0025] The target SPA seed is encrypted using an encryption algorithm to obtain the encrypted target SPA seed;

[0026] The corresponding management application is determined based on the identification information of the management application;

[0027] Use the management application to create target files to store encrypted target SPA seeds.

[0028] In one feasible implementation, the method further includes, before receiving the seed storage instruction sent by the SDP client:

[0029] Receive the temporary session key sent by the SDP client;

[0030] Create a target container to store temporary session keys.

[0031] In one feasible implementation, creating the target container includes:

[0032] Allocate resources to the object corresponding to the target container for creating the target container. The object includes session key RAM storage space.

[0033] In one feasible implementation, the session key RAM storage space includes a session key management storage area and a session key storage area. The session key management storage area is used to store relevant information corresponding to temporary session keys, and the session key storage area is used to store temporary session keys.

[0034] In one feasible implementation, after performing the corresponding operation according to the seed storage instruction, the method further includes:

[0035] Receive seed read command sent by SDP client;

[0036] Based on the seed reading instruction, the corresponding target operation is executed to obtain the target SPA request packet including the target SPA seed;

[0037] Send a target SPA request packet to the SDP client so that the SDP client can perform single-packet authorization authentication to the SDP control center based on the target SPA request packet.

[0038] In one feasible implementation, the corresponding target operation is executed based on the seed read instruction to obtain a target SPA request packet including the target SPA seed, comprising:

[0039] Based on the seed reading instruction, the corresponding target operation is executed to obtain an encrypted target SPA request packet containing the target SPA seed, which is encrypted based on the temporary session key;

[0040] Send a target SPA request packet to the SDP client, including:

[0041] Send an encrypted target SPA request packet to the SDP client.

[0042] Thirdly, embodiments of this disclosure provide a data processing method applied to an SDP control center, the method comprising:

[0043] Establish a communication connection with the SDP client;

[0044] Send a temporary SPA seed generated based on a preset temporary seed key and a count value to the SDP client;

[0045] Receive the data packet corresponding to the temporary SPA seed sent by the SDP client for single packet authorization authentication;

[0046] If the single-packet authorization authentication is successful, the target SPA seed is sent to the SDP client so that the SDP client can send the target SPA seed to the SIM card.

[0047] In one feasible implementation, the method further includes, before sending the target SPA seed to the SDP client:

[0048] Based on the pre-acquired target information, a target SPA seed is generated. The target information includes the SIM card identifier and the terminal hardware feature code.

[0049] In one feasible implementation, after sending the target SPA seed to the SDP client, the method further includes:

[0050] Receive a target SPA request packet sent by the SDP client, which includes the target SPA seed. The target SPA seed is obtained by the SDP client from the SIM card.

[0051] Perform single-packet authorization verification based on the target SPA request packet.

[0052] Fourthly, embodiments of this disclosure provide a data processing apparatus applied to an SDP client, the apparatus comprising:

[0053] The connection module is used to establish a communication connection with the SDP control center.

[0054] The receiving module is used to receive temporary SPA seeds sent by the SDP control center;

[0055] The sending module is used to send data packets corresponding to temporary SPA seeds to the SDP control center for single packet authorization authentication.

[0056] The receiving module is also used to receive target SPA seeds sent by the SDP control center;

[0057] The sending module is also used to send a seed storage instruction to the SIM card, which instructs the SIM card to store the target SPA seed.

[0058] Fifthly, embodiments of this disclosure provide a data processing apparatus for use with a SIM card, the apparatus comprising:

[0059] The receiving module is used to receive the seed storage instruction sent by the SDP client. The seed storage instruction includes the target SPA seed.

[0060] The execution module is used to perform corresponding operations according to the seed storage instructions, and the operations are used to store the target SPA seed.

[0061] Sixthly, embodiments of this disclosure provide a data processing apparatus applied in an SDP control center, the apparatus comprising:

[0062] Establish a communication connection with the SDP client;

[0063] Send a temporary SPA seed generated based on a preset temporary seed key and a count value to the SDP client;

[0064] Receive the data packet corresponding to the temporary SPA seed sent by the SDP client for single packet authorization authentication;

[0065] If the single-packet authorization authentication is successful, the target SPA seed is sent to the SDP client so that the SDP client can send the target SPA seed to the SIM card.

[0066] In a seventh aspect, embodiments of this disclosure provide a data processing apparatus, the apparatus including a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement a data processing method as described in any one of the first, second, or third aspects.

[0067] Eighthly, embodiments of this disclosure provide a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement a data processing method as described in any one of the first, second, or third aspects.

[0068] In a ninth aspect, embodiments of this disclosure provide a computer program product, including a computer program that, when executed by a processor, implements a data processing method as described in any one of the first, second, or third aspects.

[0069] This disclosure provides a data processing method, apparatus, device, computer storage medium, and computer program product. The method establishes a communication connection with an SDP control center. It receives a temporary SPA seed sent by the SDP control center. It sends a data packet corresponding to the temporary SPA seed to the SDP control center for single-packet authorization authentication. It receives a target SPA seed sent by the SDP control center. It sends a seed storage instruction to the SIM card. This disclosure improves the security of transmitting the target SPA seed from the SDP control center to the SDP client when single-packet authorization based on the temporary SPA seed is successful between the SDP control center and the SDP client. Sending the target SPA seed to the SIM card for storage via the SDP client enhances the security of the target SPA seed during storage. Therefore, this disclosure improves the security of using SPA seeds. Attached Figure Description

[0070] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0071] Figure 1 This is a schematic flowchart of a data processing method provided in an embodiment of this disclosure;

[0072] Figure 2 This is a schematic flowchart of another data processing method provided in an embodiment of this disclosure;

[0073] Figure 3 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of this disclosure;

[0074] Figure 4 This is a schematic diagram of the structure of another data processing apparatus provided in an embodiment of this disclosure;

[0075] Figure 5 This is a schematic diagram of the structure of another data processing apparatus provided in an embodiment of this disclosure;

[0076] Figure 6 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this disclosure. Detailed Implementation

[0077] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely intended to explain the present invention and not to limit the present invention. For those skilled in the art, the present invention can be practiced without some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present invention by illustrating examples of the invention.

[0078] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0079] Before describing the technical solutions provided by the embodiments of this disclosure, in order to facilitate understanding of the embodiments of this disclosure, this disclosure will specifically explain the problems existing in the related technologies:

[0080] With the development of new technologies such as cloud computing, mobile internet, the Internet of Things, and artificial intelligence, network security boundaries are gradually crumbling, and internal and external threats are becoming increasingly severe. Traditional boundary security architectures are struggling to cope with these threats. Therefore, zero-trust architecture based on SDP technology has emerged, and seed-based SPA single-packet authorization technology is used as an important security measure in zero-trust architecture.

[0081] Currently, in a zero-trust architecture based on SDP technology, before the SDP client establishes a connection with the SDP control center, the SDP client needs to send an SPA data packet containing the SPA seed to the SDP control center. Only after single-packet authorization authentication can the SDP client and the SDP control center connect.

[0082] Given the importance of SPA seeds, secure storage and use of SPA seeds has become a key focus in SDP architectures. Currently, related technologies typically employ client-side storage, where SPA seeds are stored in the SDP client's database, configuration file, or registry, and software encryption / decryption techniques are used to ensure the security of seed storage and use.

[0083] However, storing SPA seeds in the SDP client's database, configuration file, or registry still carries significant risks because the operating system environment of the SDP client is complex, making it easy for SPA seeds to be leaked. Secondly, SPA seeds require source and channel encryption during transmission and use; if the keys for source and channel encryption are leaked, the SPA seeds will also be leaked.

[0084] In conclusion, the safety of using SPA seeds is not high.

[0085] This disclosure provides a data processing method, apparatus, device, computer storage medium, and computer program product, which can solve the aforementioned technical problems existing in the related art.

[0086] This embodiment establishes a communication connection with the SDP control center. It receives a temporary SPA seed from the SDP control center. It sends a data packet corresponding to the temporary SPA seed to the SDP control center for single-packet authorization authentication. It receives the target SPA seed from the SDP control center. It sends a seed storage command to the SIM card. This embodiment enhances the security of target SPA seed transmission from the SDP control center to the SDP client when single-packet authorization based on the temporary SPA seed is successful between the SDP control center and the SDP client. Sending the target SPA seed to the SIM card for storage via the SDP client improves the security of the target SPA seed. Therefore, this embodiment improves the security of using SPA seeds.

[0087] The data processing method provided in the embodiments of this disclosure will be described below.

[0088] Figure 1 A flowchart illustrating a data processing method provided in one embodiment of this disclosure is shown. Figure 1 The method may include the following steps S101-S190.

[0089] S101: The SDP client establishes a communication connection with the SDP control center.

[0090] In this embodiment, the SDP client establishes a communication connection with the SDP control center.

[0091] In one embodiment, the SDP client and the SDP control center can establish a communication connection based on a public key certificate.

[0092] In one example, the SDP client establishes a Secure Sockets Layer (SSL) bidirectional encrypted channel with the SDP control center. The SDP client sends its SIM card public key certificate to the SDP control center, and the SDP control center sends its own public key certificate to the SDP client, verifying the validity of the public key certificates. If the public key certificate verification is successful, the SDP client and the SDP control center establish a communication connection.

[0093] S102: The SDP control center sends a temporary SPA seed generated based on the preset temporary seed key and count value to the SDP client.

[0094] In this embodiment, after the SDP client establishes a communication connection with the SDP control center, the SDP control center generates a temporary SPA seed based on a preset temporary seed key and a count value, and then sends the temporary SPA seed to the SDP client.

[0095] Among them, temporary SPA seeds represent temporary public seeds.

[0096] In one embodiment, the SDP control center can use a time-based one-time password (HMAC-based One-time Password, HOTP) encryption algorithm to generate a temporary SPA seed from the temporary seed key and the count value.

[0097] S103: The SDP client receives a temporary SPA seed sent by the SDP control center.

[0098] In this embodiment, the SDP client uses the receiving component to receive the temporary SPA seed sent by the SDP control center.

[0099] S104: The SDP client sends a data packet corresponding to the temporary SPA seed to the SDP control center.

[0100] In this embodiment, after receiving the temporary SPA seed sent by the SDP control center, the SDP client generates a data packet corresponding to the temporary SPA seed and sends it to the SDP control center for single-packet authorization authentication.

[0101] In the steps of this embodiment, the SDP client sends a temporary SPA seed to the SDP control center for single-packet authorization authentication, which can improve the security of subsequent transmission of the target SPA seed.

[0102] S105: The SDP control center sends the target SPA seed to the SDP client after the single packet authorization authentication is successful.

[0103] In this embodiment, after receiving a data packet from the SDP client, the SDP control center performs single-packet authorization authentication based on the data packet. If the single-packet authorization authentication is successful, the SDP control center sends a target SPA seed to the client for the SDP client to send the target SPA seed to the SIM card.

[0104] Among them, the target SPA seed represents a private seed.

[0105] S106: The SDP client receives the target SPA seed sent by the SDP control center.

[0106] In this embodiment, the SDP client uses the receiving component to receive the target SPA seed sent by the SDP control center.

[0107] S107: The SDP client sends a seed storage command to the SIM card.

[0108] In this embodiment, after receiving the target SPA seed, the SDP client creates a seed storage command corresponding to the target SPA seed to instruct the SIM card to store the target SPA seed according to the seed storage instruction.

[0109] Understandably, the environment of a SIM card is not as complex as that of an SDP client. By storing the target SPA seed on the SIM card, the leakage of the SPA seed can be avoided, thereby improving the security of the SPA seed.

[0110] S108: The SIM card receives the seed storage command sent by the SDP client.

[0111] In this embodiment, the SIM card receives a seed storage instruction sent by the SDP client.

[0112] The seed storage instruction includes the target SPA seed.

[0113] S109: The SIM card performs the corresponding operation according to the seed storage instruction.

[0114] In this embodiment, after receiving the seed storage instruction sent by the SDP client, the SIM card performs the corresponding operation according to the seed storage instruction.

[0115] The operation is used to store the target SPA seed.

[0116] This embodiment of the disclosure, when the SDP control center and the SDP client successfully authorize a single packet based on a temporary SPA seed, utilizes the security of transmitting the target SPA seed from the SDP control center to the SDP client. Sending the target SPA seed to the SIM card for storage via the SDP client enhances the security of the target SPA seed.

[0117] In one embodiment, the data processing method may further include step S110 before sending the target SPA seed to the SDP client.

[0118] S110: The SDP control center generates a target SPA seed based on the pre-acquired target information.

[0119] The target information includes the SIM card identifier and the terminal hardware feature code.

[0120] In one example, the terminal hardware signature could be the hardware signature of the SDP client.

[0121] In this embodiment, the SDP control center generates a target SPA seed by pre-acquired target information, which is then sent to the SDP client for transmission from the SDP client to the SIM card.

[0122] In one embodiment, sending a seed storage instruction from an SDP client to a SIM card may include step S1071.

[0123] S1071: The SDP client sends a seed storage command, including target parameters, to the SIM card based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface.

[0124] In this embodiment of the disclosure, after receiving the target SPA seed sent by the SDP control center, the SDP client sends a seed storage instruction including the target parameters to the SIM card according to the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface.

[0125] Among them, the preset SIM card application interface represents the custom SIM card application interface, and the seed storage instruction represents the custom format command.

[0126] In one example, the seed storage command definition format can be as shown in Table 1. The seed storage command can include the CLA parameter, INS parameter, P1 parameter, P2 parameter, Lc parameter, and APP-DATA parameter. The INS parameter can have a value of 08, 02, or 12. 08 indicates storing the target SPA seed, 02 indicates storing the temporary session key, and 12 indicates reading the target SPA seed information. The Lc parameter indicates the length of the data packet for the APP-DATA parameter.

[0127] Table 1

[0128]

[0129]

[0130] This embodiment of the disclosure sends a seed storage instruction, including target parameters, to the SIM card through the Application Protocol Data Unit (APDU) protocol and a preset SIM card application interface, enabling the SIM card to store the target SAP seed according to the parameters in the seed storage instruction.

[0131] In one embodiment, the target parameter APP-DATA may include a first field for recording the encryption algorithm and a second field for recording the target SPA seed, wherein the encryption algorithm is used to encrypt the target SPA seed when it is stored on the SIM card. It may also include a key index used by the encryption algorithm, the seed file name, and identification information of the SIM card seed management application.

[0132] In one example, the definition format of the APP-DATA parameter can be as shown in Table 2. AppId represents the identification information of the SIM card seed management application and is of type INT; ENC_TYPE represents the encryption algorithm and is of type STRING; INDEX represents the key index used by the encryption algorithm and is of type INT; Fname is optional and represents the seed file name. If it is empty, the file name is defined by the card application and is of type STRING; HOTP represents the SPA seed data and is of type STRING.

[0133] Table 2

[0134] AppId INT ENC_TYPE STRING INDEX INT Fname STRING HOTP STRING

[0135] In one embodiment, after the SDP client establishes a communication connection with the SDP control center, the data processing method may further include step S111.

[0136] S111: The SDP client sends a temporary session key corresponding to the communication connection to the SIM card.

[0137] The temporary session key is used to encrypt the target SPA request packet, which includes the target SPA seed.

[0138] In this embodiment, after obtaining the temporary session key, the SDP client sends the temporary session key corresponding to the communication connection to the SIM card.

[0139] In one embodiment, the temporary session key is determined based on the negotiation between the SDP client and the SDP control center through messages.

[0140] In one example, the SDP client negotiates an encryption algorithm with the SDP control center to generate a temporary session key.

[0141] In this embodiment of the disclosure, the temporary session key corresponding to the communication connection is sent to the SIM card by the SDP client. This enables the temporary session key to be stored in the SIM card, preventing the temporary session key from being leaked by the SDP client. This allows subsequent access to the target SPA seed based on the temporary session key, thereby improving the security of the target SPA seed during transmission.

[0142] In one embodiment, the SIM card includes a management application, and the seed storage instruction further includes the identification information and encryption algorithm of the management application. Performing the corresponding operation according to the seed storage instruction may include steps S1091-S1093.

[0143] S1091: The SIM card encrypts the target SPA seed according to the encryption algorithm to obtain the encrypted target SPA seed.

[0144] In this embodiment of the disclosure, the SIM card encrypts the target SPA seed according to the encryption algorithm in the seed storage instruction to obtain the encrypted target SPA seed.

[0145] In this embodiment of the disclosure, by encrypting the target SPA seed, the security of the target SPA seed when stored in the SIM card can be further improved.

[0146] S1092: The SIM card determines the corresponding management application based on the identification information of the management application.

[0147] In this embodiment of the disclosure, the SIM card determines the corresponding management application based on the identification information of the management application in the seed storage instruction, so as to store the target SPA seed to the management application.

[0148] S1093: The SIM card uses a management application to create a target file to store the encrypted target SPA seed.

[0149] In this embodiment of the disclosure, after determining the management application, the SIM card uses the management application to create a target file to store the encrypted target SPA seed.

[0150] In this embodiment of the present disclosure, the SIM card performs corresponding operations according to the seed storage instruction, which can store the target SPA seed to the specified management application to improve the security of the target SPA seed.

[0151] In one embodiment, the application storage structure of the SIM card management application may include a device global configuration area (EE), a device information EE storage area, and a device authentication key management area (EE). The relevant configuration parameters for the device global configuration area (EE) include whether plaintext updates of the device authentication key and PIN key are supported, the maximum number of session keys supported per container, the total space for storing session keys in each container, the maximum file space allowed per application, the maximum number of containers allowed per application, and the maximum number of files allowed per application. The relevant configuration parameters for the device information EE storage area include the data structure version number, standard version number, device manufacturer information, the maximum number of certificates supported by the application, the maximum number of files supported by the application, and RFU (54 bytes). The relevant configuration parameters for the device authentication key management area (EE) include the remaining number of attempts for the device authentication key and the maximum number of attempts for the device authentication key.

[0152] In one embodiment, the SIM card can allocate resources to create a management application, including the application ID, application name EE storage area, application administrator PIN object, application user PIN object, application container object array, application file object array, and temporary buffer. The temporary buffer further includes information such as whether the application is open, the application's user PIN verification status, the application's administrator PIN verification status, and whether the container under the application is open.

[0153] In one embodiment, the SIM card management application can allocate resources to create the target file for the objects corresponding to the target file, namely the file name EE storage area, the file content EE storage area, and the file read / write permissions.

[0154] In one embodiment, after the SIM card performs the corresponding operation according to the seed storage instruction, the SIM card can also send feedback information to the SDP client. The feedback information includes a status code, file name, and file index value. The status code consists of two parts, such as SW1 and SW2, and the status code and its corresponding representation information are shown in Table 3.

[0155] Table 3

[0156] 90 00 Execute correctly 67 00 Length error (Lc is empty) 69 81 Algorithms that do not support references 6A 82 The referenced application does not exist. 6A 83 The referenced index does not exist. 6A 84 The corresponding key in the index does not exist.

[0157] In one embodiment, before receiving the seed storage instruction sent by the SDP client, the method may further include steps S112 and S113.

[0158] S112: The SIM card receives the temporary session key sent by the SDP client.

[0159] In this embodiment, the SIM card receives a temporary session key sent by the SDP client.

[0160] S113: The SIM card creates a target container to store the temporary session key.

[0161] In this embodiment, the SIM card creates a target container to store a temporary session key.

[0162] The SIM card in this disclosure improves the security of the temporary session key during storage by storing the temporary session key in the target container.

[0163] In one embodiment, creating the target container may include step S1131.

[0164] S1131: The SIM card allocates resources to the object corresponding to the target container for the purpose of creating the target container.

[0165] The objects include the session key RAM storage space.

[0166] In this embodiment, the SIM card allocates resources to the object corresponding to the target container for the purpose of creating the target container.

[0167] In one embodiment, the SIM card management application allocates resources to the object corresponding to the target container for creating the target container.

[0168] In one example, the SIM card management application can allocate resources for creating the target container, including the container ID, container name EE storage area, container type, asymmetric key object, certificate object array, session key RAM storage space, etc.

[0169] The target container requests a storage certificate based on its type and size. For ECC containers, a 1K storage certificate is requested, while for RSA containers, a 2K storage certificate is requested.

[0170] In this embodiment of the disclosure, by creating a target container, the target SPA seed can be stored in the target container.

[0171] In one embodiment, the session key RAM storage space includes a session key management storage area and a session key storage area. The session key management storage area stores relevant information corresponding to temporary session keys, while the session key storage area stores temporary session keys. The session key management storage area stores 2 bytes of key storage area used offset information and 8 bytes of key-related information, so its size is 2 + 8 * keynum bytes. The session key storage area stores each temporary session key, and its size is determined by the space in the global configuration area.

[0172] In one embodiment, a flowchart of another data processing method is shown below. Figure 2 As shown, steps S201-S207 may be included.

[0173] S201: In response to the target control command, the SDP client sends a seed read command to the SIM card based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface.

[0174] The seed read instruction is used to instruct the SIM card to send a target SPA request packet containing the target SPA seed.

[0175] In this embodiment, the SDP client responds to the target control command by sending a seed read command to the SIM card based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface.

[0176] In one example, target control instructions can be generated by the user in the SDP client.

[0177] The definition format of the seed read command is shown in Table 4. The seed read command can include the CLA parameter, INS parameter, P1 parameter, P2 parameter, Lc parameter, and APP-DATA parameter. The INS parameter can have a value of 08, 02, or 12. 08 indicates storing the target SPA seed, 02 indicates storing the temporary session key, and 12 indicates reading the target SPA seed information. The Lc parameter indicates the length of the data packet for the APP-DATA parameter.

[0178] Table 4

[0179] CLA 1 80 INS 1 08 P1 1 XX P2 1 XX Lc 2 0X APP-DATA XXX XXX

[0180] The definition format and representation information of the APP-DATA parameter can be shown in Table 5.

[0181] Table 5

[0182] AppId INT Application ID TYPE STRING Decryption Algorithm | Digest Algorithm | Signature Algorithm ENC_INDEX INT The key index used by the decryption algorithm SIG_INDEX INT Signatures use private key indexes SES_INDEX INT Session key index SPA_INDEX INT Seed storage file index Spa_Pack STRING SPA certification package data format

[0183] The definition format and representation information of the Spa_Pack field are shown in Table 6.

[0184] Table 6

[0185]

[0186] S202: The SIM card receives a seed read command sent by the SDP client.

[0187] In this embodiment, the SIM card receives a seed read command sent by the SDP client.

[0188] S203: The SIM card executes the corresponding target operation based on the seed reading instruction to obtain the target SPA request packet including the target SPA seed.

[0189] In this embodiment, the SIM card performs the corresponding target operation according to the received seed reading instruction to obtain a target SPA request packet including the target SPA seed.

[0190] In one example, the SIM card's execution of the corresponding target operation based on the seed read command could be as follows: The SIN card analyzes and obtains the management application to be invoked, the method of cryptographic operation on the target SPA seed, the index of each key, the seed file index, etc. Next, the management application first uses the SIM card's cryptographic operation capabilities to decrypt the file containing the target SPA seed, and then adds the seed content to the HOTP field of the target SPA request packet; secondly, it uses a hash algorithm to perform a hash operation on the content of the target SPA request packet, and signs the hash data using a specified private key.

[0191] S204: The SIM card sends a target SPA request packet to the SDP client so that the SDP client can perform single-packet authorization authentication with the SDP control center based on the target SPA request packet.

[0192] In this embodiment, the SIM card sends a target SPA request packet to the SDP client so that the SDP client can perform single-packet authorization authentication of the SDP control center based on the target SPA request packet.

[0193] S205: The SDP client sends a target SPA request packet to the SDP control center for single packet authorization authentication.

[0194] In this embodiment, the SDP client sends a target SPA request packet to the SDP control center for single packet authorization authentication.

[0195] S206: The SDP control center receives a target SPA request packet, including the target SPA seed, sent by the SDP client.

[0196] The target SPA seed is obtained by the SDP client from the SIM card.

[0197] In this embodiment, the SDP control center receives a target SPA request packet, which includes the target SPA seed, sent by the SDP client.

[0198] S207: The SDP control center performs single-packet authorization verification based on the target SPA request packet.

[0199] In this embodiment, the SDP control center performs single-packet authorization verification based on the target SPA request packet.

[0200] In one example, after receiving the target SPA request packet, the SDP control center uses the SIM card's public key certificate to verify the signature of the SDP single-packet authorization authentication data table in the target SPA request packet, and uses the SDP control center's private certificate to decrypt the seed ciphertext. Once the SDP control center successfully verifies the signature and decrypts, it verifies each field of the Spa_Pack data packet; if all fields are valid, the single-packet authorization authentication is successful.

[0201] In this embodiment of the disclosure, a seed reading instruction sent by an SDP client is received via a SIM card, and a target SPA request packet is sent to the SDP client for the SDP client to perform single-packet authorization authentication of the SDP control center based on the target SPA request packet, which can improve the security of generating the target SPA request packet.

[0202] In one embodiment, executing the corresponding target operation based on the seed reading instruction to obtain a target SPA request packet including the target SPA seed may include step S2031.

[0203] S2031: The SIM card executes the corresponding target operation based on the seed reading instruction to obtain an encrypted target SPA request packet containing the target SPA seed, which is encrypted based on the temporary session key.

[0204] In this embodiment, the SIM card performs the corresponding target operation based on the seed reading instruction to obtain an encrypted target SPA request packet containing the target SPA seed, which is encrypted based on the temporary session key.

[0205] In one embodiment, sending a target SPA request packet to an SDP client may include step S2041.

[0206] S2041: The SIM card sends an encrypted target SPA request packet to the SDP client.

[0207] In this embodiment, after receiving the encrypted target SPA request packet, the SIM card sends the encrypted target SPA request packet to the SDP client.

[0208] The embodiments disclosed herein encrypt the target SPA seed using the temporary session key of the SIM card to obtain an encrypted target SPA request packet, which is then sent to the SDP client, thereby improving the security of the encrypted target SPA request packet during transmission.

[0209] like Figure 3 As shown, this disclosure also provides a data processing apparatus 300, applied to an SDP client. The data processing apparatus 300 includes:

[0210] Establish module 301 to establish a communication connection with the SDP control center;

[0211] Receiver module 302 is used to receive temporary SPA seeds sent by the SDP control center;

[0212] The sending module 303 is used to send a data packet corresponding to the temporary SPA seed to the SDP control center for single packet authorization authentication.

[0213] The receiving module 302 is also used to receive the target SPA seed sent by the SDP control center;

[0214] The sending module 303 is also used to send a seed storage instruction to the SIM card, which instructs the SIM card to store the target SPA seed.

[0215] This embodiment of the disclosure enhances the security of target SPA seed transmission from the SDP control center to the SDP client when the SDP control center and the SDP client successfully authorize a single packet based on a temporary SPA seed. Sending the target SPA seed to the SIM card for storage via the SDP client improves the security of the target SPA seed. Therefore, this embodiment of the disclosure improves the security of using SPA seeds.

[0216] In some embodiments, the sending module 303 is specifically used for:

[0217] Based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface, a seed storage command including target parameters is sent to the SIM card.

[0218] In some embodiments, the target parameters include a first field for recording an encryption algorithm and a second field for recording a target SPA seed, wherein the encryption algorithm is used to encrypt the target SPA seed when it is stored on a SIM card.

[0219] In some embodiments, the sending module 303 is specifically used for:

[0220] Send a temporary session key corresponding to the communication connection to the SIM card. The temporary session key is used to encrypt the target SPA request packet, which includes the target SPA seed.

[0221] In some embodiments, the sending module 303 is specifically used for:

[0222] In response to the target control command, a seed read command is sent to the SIM card based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface. The seed read command is used to instruct the SIM card to send a target SPA request packet containing the target SPA seed.

[0223] Send a target SPA request packet to the SDP control center for single packet authorization authentication.

[0224] Figure 3Each module / unit in the illustrated device has the ability to implement Figures 1 to 2 The functions of each step performed by the application system and the corresponding technical effects it achieves are described briefly and will not be elaborated here.

[0225] like Figure 4 As shown, this disclosure also provides a data processing apparatus 400 for use with a SIM card. The data processing apparatus 400 includes:

[0226] The receiving module 401 is used to receive the seed storage instruction sent by the SDP client, the seed storage instruction including the target SPA seed;

[0227] The execution module 402 is used to perform corresponding operations according to the seed storage instruction, and the operations are used to store the target SPA seed.

[0228] In some embodiments, the data processing apparatus 400 further includes an encryption module, which is used to encrypt the target SPA seed according to an encryption algorithm to obtain an encrypted target SPA seed.

[0229] The corresponding management application is determined based on the identification information of the management application;

[0230] Use the management application to create target files to store encrypted target SPA seeds.

[0231] In some embodiments, the receiving module 401 is specifically used for:

[0232] Receive the temporary session key sent by the SDP client;

[0233] Create a target container to store temporary session keys.

[0234] In some embodiments, the data processing apparatus 400 includes a creation module for allocating resources to an object corresponding to a target container for creating the target container, the object including session key RAM storage space.

[0235] In some embodiments, the session key RAM storage space includes a session key management storage area and a session key storage area. The session key management storage area is used to store relevant information corresponding to temporary session keys, and the session key storage area is used to store temporary session keys.

[0236] In some embodiments, the receiving module 401 is specifically used for:

[0237] Receive seed read command sent by SDP client;

[0238] Based on the seed reading instruction, the corresponding target operation is executed to obtain the target SPA request packet including the target SPA seed;

[0239] Send a target SPA request packet to the SDP client so that the SDP client can perform single-packet authorization authentication to the SDP control center based on the target SPA request packet.

[0240] In some embodiments, the execution module 402 is specifically used for:

[0241] Based on the seed reading instruction, the corresponding target operation is executed to obtain an encrypted target SPA request packet containing the target SPA seed, which is encrypted based on the temporary session key;

[0242] Send a target SPA request packet to the SDP client, including:

[0243] Send an encrypted target SPA request packet to the SDP client.

[0244] Figure 4 Each module / unit in the illustrated device has the ability to implement Figures 1 to 2 The functions of each step performed by the application system and the corresponding technical effects it achieves are described briefly and will not be elaborated here.

[0245] like Figure 5 As shown, this disclosure also provides a data processing apparatus 500, applied in an SDP control center. The data processing apparatus 500 includes:

[0246] Establish module 501 to establish a communication connection with the SDP client;

[0247] Sending module 502 is used to send a temporary SPA seed generated according to a preset temporary seed key and a count value to the SDP client;

[0248] The receiving module 503 is used to receive the data packet corresponding to the temporary SPA seed sent by the SDP client for single packet authorization authentication;

[0249] The sending module 502 is also used to send the target SPA seed to the SDP client when the single packet authorization authentication is successful, so that the SDP client can send the target SPA seed to the SIM card.

[0250] In some embodiments, the data processing apparatus 500 includes a generation module, which generates a target SPA seed based on pre-acquired target information, the target information including a SIM card identifier and a terminal hardware feature code.

[0251] In some embodiments, the receiving module 503 is specifically used for:

[0252] Receive a target SPA request packet sent by the SDP client, which includes the target SPA seed. The target SPA seed is obtained by the SDP client from the SIM card.

[0253] Perform single-packet authorization verification based on the target SPA request packet.

[0254] Figure 5 Each module / unit in the illustrated device has the ability to implement Figures 1 to 2 The functions of each step performed by the application system and the corresponding technical effects it achieves are described briefly and will not be elaborated here.

[0255] Figure 6 A schematic diagram of the hardware structure for data processing provided in an embodiment of this disclosure is shown.

[0256] The data processing device may include a processor 601 and a memory 602 storing computer program instructions.

[0257] Specifically, the processor 601 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0258] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 602 may include removable or non-removable (or fixed) media. Where appropriate, memory 602 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 602 is non-volatile solid-state memory.

[0259] Memory 602 may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0260] The processor 601 implements any of the data processing methods described in the above embodiments by reading and executing computer program instructions stored in the memory 602.

[0261] In one example, the data processing device may further include a communication interface 603 and a bus 604. Wherein, for example... Figure 6 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 604 and complete communication with each other.

[0262] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0263] Bus 604 includes hardware, software, or both, that couples components of an online data flow metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 604 may include one or more buses. Although specific buses are described and illustrated in embodiments of the invention, the invention contemplates any suitable bus or interconnect. Additionally, in conjunction with the data processing methods described in the above embodiments, embodiments of this application also provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, they implement any of the data processing methods in the above embodiments.

[0264] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the data processing methods described in the above embodiments.

[0265] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0266] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0267] It should also be noted that the exemplary embodiments mentioned in this invention describe methods or systems based on a series of steps or apparatus. However, this invention is not limited to the order of the steps described above; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0268] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0269] The above are merely specific embodiments of the present invention. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the protection scope of the present invention.

Claims

1. A data processing method, characterized in that, Applied to SDP clients, the method includes: Establish a communication connection with the SDP control center; Receive the temporary SPA seed sent by the SDP control center; Send a data packet corresponding to the temporary SPA seed to the SDP control center for single-packet authorization authentication; The system receives a target SPA seed sent by the SDP control center. The target SPA seed is generated by the SDP control center based on pre-acquired target information, which includes the SIM card identifier and the terminal hardware feature code. Based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface, a seed storage instruction including target parameters is sent to the SIM card. The seed storage instruction is used to instruct the SIM card to store the target SPA seed, and the seed storage instruction includes the target SPA seed.

2. The method according to claim 1, characterized in that, The target parameters include a first field for recording the encryption algorithm and a second field for recording the target SPA seed. The encryption algorithm is used to encrypt the target SPA seed when it is stored on the SIM card.

3. The method according to claim 1, characterized in that, After establishing a communication connection with the SDP control center, the method further includes: A temporary session key corresponding to the communication connection is sent to the SIM card. The temporary session key is used to encrypt the target SPA request packet including the target SPA seed.

4. The method according to any one of claims 1 to 3, characterized in that, After sending the seed storage instruction to the SIM card, the method further includes: In response to the target control command, a seed read command is sent to the SIM card based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface. The seed read command is used to instruct the SIM card to send a target SPA request packet containing the target SPA seed. Send the target SPA request packet to the SDP control center for single packet authorization authentication.

5. A data processing method, characterized in that, Applied to a SIM card, the method includes: The system receives a seed storage instruction sent by the SDP client based on the Application Protocol Data Unit (APDU) protocol and a preset SIM card application interface. The seed storage instruction includes a target SPA seed, which is generated by the SDP control center based on pre-acquired target information, including the SIM card identifier and the terminal hardware feature code. The corresponding operation is executed according to the seed storage instruction, and the operation is used to store the target SPA seed; The SIM card includes a management application, and the seed storage instruction further includes the identification information and encryption algorithm of the management application. The step of performing the corresponding operation according to the seed storage instruction includes: The target SPA seed is encrypted according to the encryption algorithm to obtain the encrypted target SPA seed; The corresponding management application is determined based on the identification information of the management application; The management application is used to create a target file to store the encrypted target SPA seed.

6. The method according to claim 5, characterized in that, Before receiving the seed storage instruction sent by the SDP client, the method further includes: Receive the temporary session key sent by the SDP client; Create a target container to store the temporary session key.

7. The method according to claim 6, characterized in that, The creation of the target container includes: Resources are allocated to the object corresponding to the target container for creating the target container, the object including session key RAM storage space.

8. The method according to claim 7, characterized in that, The session key RAM storage space includes a session key management storage area and a session key storage area. The session key management storage area is used to store relevant information corresponding to the temporary session key, and the session key storage area is used to store the temporary session key.

9. The method according to claim 6, characterized in that, After performing the corresponding operation according to the seed storage instruction, the method further includes: Receive the seed read command sent by the SDP client; Based on the seed reading instruction, the corresponding target operation is executed to obtain a target SPA request packet including the target SPA seed; The target SPA request packet is sent to the SDP client so that the SDP client can perform single-packet authorization authentication of the SDP control center based on the target SPA request packet.

10. The method according to claim 9, characterized in that, The step of executing the corresponding target operation based on the seed reading instruction to obtain a target SPA request packet including the target SPA seed includes: Based on the seed reading instruction, the corresponding target operation is executed to obtain an encrypted target SPA request packet containing the target SPA seed, which is encrypted based on the temporary session key; Sending the target SPA request packet to the SDP client includes: Send the encrypted target SPA request packet to the SDP client.

11. A data processing method, characterized in that, Applied to SDP control centers, the method includes: Establish a communication connection with the SDP client; Send a temporary SPA seed generated based on a preset temporary seed key and a count value to the SDP client; Receive the data packet corresponding to the temporary SPA seed sent by the SDP client to perform single packet authorization authentication; If the single-packet authorization authentication is successful, a target SPA seed is sent to the SDP client so that the SDP client can send a seed storage instruction including target parameters to the SIM card based on the Application Protocol Data Unit (APDU) protocol and the preset SIM card application interface. The seed storage instruction includes the target SPA seed. The method further includes, prior to sending the target SPA seed to the SDP client: The target SPA seed is generated based on the pre-acquired target information, which includes the SIM card identifier and the terminal hardware feature code.

12. The method according to claim 11, characterized in that, After sending the target SPA seed to the SDP client, the method further includes: Receive a target SPA request packet sent by the SDP client, which includes the target SPA seed, wherein the target SPA seed is obtained by the SDP client from the SIM card; Perform single-packet authorization verification based on the target SPA request packet.

Images