Processing method for a key and related device

Abstract

The application discloses a processing method for a key and a related device, and relates to the technical field of key management. The management of a first key is performed by a SIM card. When a first instruction for the first key is detected, the key type of the first key and the read-write type of the first instruction are determined, and the user authority level corresponding to the first instruction is determined based on the key type of the first key and the read-write type of the first instruction. Then, whether to execute the first instruction is determined according to the user identity information and the user authority level in the first instruction. In this way, the management of the first key is performed by the SIM card, and identity authentication is further performed when the first key is operated, so that the security of the first key can be effectively protected.

Description

Technical Field

[0001] This invention belongs to the field of key management technology, and in particular to a key processing method and related apparatus. Background Technology

[0002] With the development of science and technology, various applications can be installed on mobile devices. During the interaction between these applications and servers, some information may need to be transmitted in encrypted form. For example, payment applications and chat applications may need to transmit information related to user identity. To ensure information security, data may need to be transmitted in encrypted form during the data interaction between the application and the corresponding server.

[0003] During data transmission, it may be necessary to encrypt the data. This encryption process requires the use of a key to encrypt the data, demonstrating the crucial role of keys in encrypted data transmission. Summary of the Invention

[0004] The purpose of this invention is to provide a key processing method and related apparatus. Key management is performed through a SIM card. During the key reading and writing process, identity authentication is required. Furthermore, the user's operation can be determined based on the key type. In this way, by using a SIM card to store algorithm keys, the key storage process can be carried out in a hardware-secure manner, thereby improving the security of the key storage process.

[0005] In a first aspect, one embodiment of this application provides a method for processing a key, applied to a SIM card, and the method includes:

[0006] In response to detecting a first instruction for a first key, the key type of the first key and the read / write type of the first instruction are determined, wherein the key type includes at least a public key and a private key, and the first instruction includes user identification information;

[0007] Based on the type of the first key and the read / write type of the first instruction, the user permission level corresponding to the first instruction is determined.

[0008] Based on the aforementioned user identification information and user permission level, determine whether to execute the aforementioned first instruction.

[0009] Optionally, the user permission levels include a first level and a second level, wherein the first level is used to indicate that any user meets the permissions, and the second level is used to indicate that the target user meets the permissions.

[0010] Furthermore, the determination of the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction includes:

[0011] In the case where the first key indicates a public key and the first instruction indicates a read, the user's permission level is determined to be the first level.

[0012] In the case where the first key indicates the public key and the first instruction indicates write, the user permission level is determined to be the second level.

[0013] In the case where the first key indicates the private key and the first instruction indicates read or write, the user permission level is determined to be the second level.

[0014] Optionally, the aforementioned key type further includes a session key, and the determination of the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction includes:

[0015] In the case where the first key indicates the session key and the first instruction indicates read or write, the user permission level is determined to be the second level.

[0016] Optionally, the SIM card pre-stores a national cryptographic encryption algorithm. When the first key indicates a session key, and the user access level corresponding to the first instruction is level two, the method further includes:

[0017] The session key is encrypted using the aforementioned national cryptographic algorithm to obtain ciphertext information; and the ciphertext information is stored.

[0018] Optionally, the SIM card can provide multiple interfaces for data interaction with the terminal device, including at least an interface for writing files and an interface for reading files. Furthermore, the method also includes:

[0019] Based on the interface being invoked, determine the read / write type of the first instruction mentioned above.

[0020] Optionally, the terminal device includes a post-quantum encryption algorithm, and the first key includes the result of running the post-quantum encryption algorithm.

[0021] Optionally, the SIM card includes multiple storage spaces, and different storage spaces are used to store keys of different key types;

[0022] Furthermore, after the first instruction instructs the writing of the first key, and after determining that the first instruction has been executed, the method further includes:

[0023] Based on the key type of the first key, determine the storage space for storing the first key, and store the first key in the corresponding storage space.

[0024] Secondly, another embodiment of this application provides a key processing apparatus applied to a SIM card, wherein the apparatus includes:

[0025] A type determination unit is configured to determine the key type of the first key and the read / write type of the first instruction in response to detecting a first instruction for the first key, wherein the key type includes at least a public key and a private key, and the first instruction includes user identification information;

[0026] The level determination unit is used to determine the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction.

[0027] The execution unit is used to determine whether to execute the first instruction based on the aforementioned user identity information and the aforementioned user permission level.

[0028] Thirdly, another embodiment of this application provides a storage medium storing a computer program, wherein the computer program is configured to execute the above-described key processing method at runtime.

[0029] Fourthly, another embodiment of this application provides an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the above-described key processing method.

[0030] Compared with the prior art, the present invention provides a key processing method and related apparatus. The management of the first key is performed by the SIM card. When a first instruction targeting the first key is detected, the key type of the first key and the read / write type of the first instruction can be determined. Based on the key type of the first key and the read / write type of the first instruction, the user permission level corresponding to the first instruction can be determined. Then, based on the user identity information and user permission level in the first instruction, it can be determined whether to execute the first instruction. In this way, the management of the first key can be performed by the SIM card, and further authentication is required when operating on the first key, thereby effectively protecting the security of the first key. Attached Figure Description

[0031] Figure 1 A flowchart illustrating a key processing method provided in an embodiment of the present invention;

[0032] Figure 2This is a schematic diagram illustrating the interaction between a terminal device and a SIM card in a key processing method provided by an embodiment of the present invention.

[0033] Figure 3 A connection diagram of a key processing device provided in an embodiment of the present invention;

[0034] Figure 4 A schematic diagram of the structure of a computer device provided in one embodiment of this application is shown. Detailed Implementation

[0035] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0036] As described in the background information above, data encryption may be necessary to ensure data security during data exchange. This encryption process requires a key, and proper key management is crucial because key leakage can lead to the leakage of the encrypted ciphertext, thereby compromising the security of the encrypted exchange process.

[0037] For example, in scenarios such as software authentication, payment, and chat, information related to user identity or other sensitive information may be involved. In these cases, encrypted transmission of this information may be necessary. That is, during data interaction between the application and the server, the exchanged data may need to be encrypted to better protect user privacy.

[0038] The keys used to encrypt data in related technologies are usually stored in the storage space of the rich execution environment of the terminal device. However, this method may face the risk of key leakage, which makes it easy for the encrypted transmitted ciphertext information to be cracked.

[0039] In this disclosure, key management is performed through a SIM card. During the reading and writing of the key, identity authentication is required. Furthermore, the user's operation can be determined based on the key type. By utilizing the SIM card to store the algorithm key, the key storage process can be carried out in a hardware-secure manner, thereby improving the security of the key storage process.

[0040] It should be understood here that the SIM card (Subscriber Identity Module) in this disclosure differs from a conventional SIM card. The main difference is that the SIM card in this disclosure has a separate session key generation capability, rather than simply having storage and identity verification capabilities like a conventional SIM card. That is, the SIM card in this disclosure may include a processing module and a storage module, and the processing module can access pre-stored data in the storage module. In this disclosure, the data stored in the storage module may include encryption algorithms such as post-quantum encryption algorithms and classical encryption algorithms, and may also include related algorithm programs for key generation, such as a random number generation module. This allows the SIM card to have both key generation and data encryption capabilities. The advantage of this is that the key can be stored more securely in the SIM card.

[0041] In this disclosure, the SIM card can be one of the following: a regular SIM card, an ISIM card, an ESIM card, a Super SIM card, a TF card, or an NM card.

[0042] Of course, in actual use, there are clients that carry SIM cards, and the clients can be in-vehicle devices, walkie-talkies, mobile phones, computers, smartwatches, IoT devices, wireless routers, drones, etc.

[0043] Please see Figure 1 , Figure 1 This is a flowchart illustrating the key processing method provided in an embodiment of the present invention, as shown below. Figure 1 The key processing method described above can be applied to SIM cards, and the key processing method may include the following steps:

[0044] Step 101: In response to detecting a first instruction for the first key, determine the key type of the first key and the read / write type of the first instruction.

[0045] Here, the key type can include at least a public key and a private key, and the first instruction can include user identification information.

[0046] As an example, the first key may or may not have been stored in the SIM card. For instance, the first instruction could instruct the first key to be written to the SIM card, or it could instruct the first key to be read from the SIM card. That is, whether the first key is read from the SIM card or written to the SIM card, the type of the first key needs to be determined in order to determine whether to execute the first instruction.

[0047] Step 102: Determine the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction.

[0048] As an example, user permission levels can indicate which specific users can issue the first command, thus allowing the user's identity information and user permission levels to determine whether to execute the first command.

[0049] For example, user permission levels can indicate that only users carrying specific identifiers to represent administrators can execute the first command, or they can indicate that all users can execute the first command. In other words, different commands and different key types may correspond to different permission levels.

[0050] Step 103: Based on the user's identity information and user permission level, determine whether to execute the first instruction.

[0051] As an example, the user identification information indicates that the user meets the user permission level, thus allowing the execution of the first instruction. For instance, if the user identification information indicates that the current user is an administrator, and the user permission level indicates that any user can perform the operation corresponding to the first instruction, then it can be determined that the first instruction will be executed.

[0052] As can be seen, in this disclosure, the management of the first key is handled by the SIM card. When a first instruction targeting the first key is detected, the key type of the first key and the read / write type of the first instruction can be determined. Based on the key type of the first key and the read / write type of the first instruction, the user permission level corresponding to the first instruction can be determined. Then, based on the user identification information and user permission level in the first instruction, it can be determined whether to execute the first instruction. This method allows the management of the first key to be handled by the SIM card, and further authentication is required when operating on the first key, thus effectively protecting the security of the first key.

[0053] In some embodiments, the user permission level may include a first level and a second level, wherein the first level indicates that any user meets the permission, and the second level indicates that the target user meets the permission;

[0054] Furthermore, step 102 above, "determining the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction," may specifically include:

[0055] If the first key indicates the public key and the first instruction indicates read, the user's permission level is determined to be the first level.

[0056] If the first key indicates the public key and the first instruction indicates write, the user's permission level is determined to be the second level.

[0057] If the first key indicates the private key and the first instruction indicates read or write, the user's permission level is determined to be the second level.

[0058] As an example, when the first key is a public key, because the public key can be made public, it can be determined that any user can read the public key, which reduces the computational resources required for the judgment process. Furthermore, since the public key can only be written to the target user, this also avoids writing an incorrect public key to the SIM card, thus preventing encryption errors.

[0059] As an example, when the first key is a private key, then both reading and writing can be determined to be valid only for the target user.

[0060] It should be understood that the target user here refers to the authorized user corresponding to the terminal device.

[0061] In other words, the key in this disclosure is stored in the SIM card, so that separate permissions can be set for reading and writing the key, thereby achieving more secure protection of the key.

[0062] In some embodiments, the key type may further include a session key, and step 102 above, "determining the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction," may specifically include:

[0063] If the first key indicates the session key and the first instruction indicates read or write, the permission level is determined to be the second level.

[0064] As an example, storing the session key in the first SIM card provides better protection for the session key. That is, by utilizing hardware resources to store the session key, leakage of the session key can be avoided, thus further protecting the security of the data interaction process.

[0065] As an example, a session key can be understood as the key agreed upon when a terminal device (a terminal device carrying a SIM card) needs to encrypt data during interaction with other devices.

[0066] It should be understood that all key storage can be done using the SIM card, which is equivalent to using a physical hardware protection strategy to protect the key.

[0067] It should be understood that the private key and public key can be used during the key encapsulation stage to agree on a session key between the terminal device and another interactive device. In this disclosure, the private key, public key, and session key can all be stored in the SIM card, which can achieve hardware-level encryption and access control of the key.

[0068] In some embodiments, the SIM card may pre-store the national cryptographic encryption algorithm. When the first key indicates the session key and the user privilege level corresponding to the first instruction is the second level, the above method may further include:

[0069] The session key is encrypted using the national cryptographic algorithm to obtain ciphertext information; and the ciphertext information is stored.

[0070] As an example, storing the session key in encrypted form can further enhance security. For instance, when the session key needs to be obtained, the encrypted information must be used to decrypt the encrypted private key before the session key can be retrieved. In other words, users must not only meet the permission level requirements for obtaining the session key, but also the permission level requirements for obtaining the private key.

[0071] This approach not only makes the key protection process more secure but also allows for more flexible permission settings. For example, this method allows for lower permissions to the encrypted key's ciphertext information, while only guaranteeing the permission level of the private key used to decrypt the ciphertext information.

[0072] As an example, Chinese national cryptographic algorithms can include SM2, SM3 (hash algorithm), SM4 (symmetric encryption algorithm), etc. Therefore, the Chinese national cryptographic algorithms stored in a SIM card can be limited according to the actual situation.

[0073] In some implementations, any key written to the SIM card can be encrypted before storage, which further ensures the security of the key stored on the SIM card.

[0074] In some embodiments, the SIM card may provide multiple interfaces for data interaction with the terminal device, the multiple interfaces including at least an interface for writing files and an interface for reading files, and the above method may further include:

[0075] Determine the read / write type of the first instruction based on the interface being called.

[0076] As an example, a SIM card can provide multiple interfaces to interact with a terminal device. When the terminal device needs to execute different types of instructions, it can call different interfaces. In this way, the SIM card can easily determine the read / write type of the first instruction.

[0077] It should be understood that since the SIM itself already has a read / write interface for data interaction with terminal devices, the method disclosed herein does not require additional interface improvements and can utilize existing interfaces.

[0078] In some embodiments, the terminal device may include a post-quantum encryption algorithm, and the first key includes the result of running the post-quantum encryption algorithm.

[0079] As an example, the results of running a post-quantum algorithm may include: a quantum private key, a quantum public key, and a session key.

[0080] It should be understood that the SIM card in this disclosure, as an indispensable hardware component in the communication process of terminal devices, not only provides communication authentication functions but also performs encrypted computation and key storage functions. Because the SIM card has physical security protection, it can prevent malicious software or external attackers from obtaining keys or encrypted information remotely, thereby ensuring the security of communication.

[0081] As an example, post-quantum algorithms can be understood as a hybrid of standard lattice-based cryptographic algorithms (Kyber, a family of lattice-based cryptographic constructions) and ECC (Elliptic Curve Cryptography) type algorithms. Of course, the specific choice between lattice-based and ECC type algorithms can be made based on the actual situation.

[0082] In some implementations, the session key in this disclosure can be generated using a hybrid encryption algorithm, which can be understood as a hybrid encryption algorithm combining post-quantum algorithms and traditional public-key algorithms; the specific generation method can be reasonably set according to the actual situation. In this way, encrypting the first data using a hybrid algorithm can effectively resist various attacks from quantum computers, making it difficult to crack the encrypted user information, thereby improving the security of application data protection.

[0083] It should be understood that post-quantum algorithms or hybrid encryption algorithms are typically used to process highly sensitive information, such as key generation, encrypted communication, and privacy protection. The results generated by hybrid encryption algorithms can also be stored on the SIM card, leveraging the hardware-level isolation and encryption features provided by the SIM card to prevent session keys from being tampered with or leaked.

[0084] In some embodiments, a SIM card may include multiple storage spaces, and different storage spaces may be used to store keys of different key types;

[0085] Furthermore, after the first instruction instructs the writing of the first key, and after determining that the first instruction has been executed, the above method may further include:

[0086] Based on the key type of the first key, determine the storage space for storing the first key, and store the first key in the corresponding storage space.

[0087] As an example, dividing the storage space into multiple locations makes key management easier, and it also makes it easier to determine the type of the first instruction. For instance, when the first instruction indicates that a key needs to be retrieved from the first storage space (e.g., which can be used to store a private key), the type of the first key can be determined to be a private key.

[0088] In other words, this method can determine the type of the first key relatively quickly.

[0089] To facilitate understanding of the ideas in this disclosure, it can be combined with... Figure 2 To explain, Figure 2 This can be understood as a schematic diagram of the interaction between the SIM card and the terminal device disclosed herein. Figure 2 As can be seen, the terminal device and the SIM card can interact, and the SIM card can provide different storage containers to store different types of keys, or keys required for different interaction needs. That is, in this disclosure, some keys may be generated on the terminal device, but after the terminal device generates the keys, it can send the keys to the SIM card for storage, thus ensuring the security of the keys.

[0090] This method, which uses a SIM card to store the PQC algorithm key, solves the problem that the standard SIM card interface does not provide PQC algorithm key storage functionality. Furthermore, using a SIM card for PQC algorithm key storage offers higher security compared to directly using the phone's internal storage. In other words, this disclosed method fully utilizes the SIM card's hardware storage and access control functions, thereby achieving more secure key storage.

[0091] See Figure 3 , Figure 3 This is a schematic diagram of a key processing device according to an embodiment of the present invention. The key processing device 300 is applied to a SIM card, and the device 300 includes:

[0092] The type determination unit 301 is configured to determine the key type of the first key and the read / write type of the first instruction in response to detecting a first instruction for the first key, wherein the key type includes at least a public key and a private key, and the first instruction includes user identification information.

[0093] The level determination unit 302 is used to determine the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction.

[0094] Execution unit 303 is used to determine whether to execute the first instruction based on the aforementioned user identification information and user permission level.

[0095] In some embodiments, the user permission levels include a first level and a second level, wherein the first level is used to indicate that any user meets the permissions, and the second level is used to indicate that the target user meets the permissions.

[0096] Furthermore, the determination of the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction includes:

[0097] In the case where the first key indicates a public key and the first instruction indicates a read, the user's permission level is determined to be the first level.

[0098] In the case where the first key indicates the public key and the first instruction indicates write, the user permission level is determined to be the second level.

[0099] In the case where the first key indicates the private key and the first instruction indicates read or write, the user permission level is determined to be the second level.

[0100] In some embodiments, the key type further includes a session key, and the level determination unit 302 may also be used to: determine the user permission level as a second level when the first key indicates a session key and the first instruction indicates read or write.

[0101] In some embodiments, the SIM card pre-stores a national cryptographic algorithm. When the first key indicates a session key and the user permission level corresponding to the first instruction is the second level, the device 300 can also be used to: encrypt the session key using the national cryptographic algorithm to obtain ciphertext information; and store the ciphertext information.

[0102] In some embodiments, the SIM card can provide multiple interfaces to interact with the terminal device, the multiple interfaces including at least an interface for writing files and an interface for reading files, and the device 300 can also be used to: determine the read / write type of the first instruction based on the invoked interface.

[0103] In some embodiments, the terminal device includes a post-quantum encryption algorithm, and the first key includes the result of running the post-quantum encryption algorithm.

[0104] In some embodiments, the SIM card includes multiple storage spaces, and different storage spaces are used to store keys of different key types;

[0105] Furthermore, the aforementioned device 300 is specifically used to: determine the storage space for storing the first key according to the key type of the first key, and to store the first key in the corresponding storage space.

[0106] Figure 4 A schematic diagram of the structure of a computer device provided in one embodiment of this application is shown, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the functions of the computer system of the key processing method in any of the above embodiments.

[0107] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a computer, causes the computer to perform the functions of the computer system for the key processing method in any of the above embodiments.

[0108] This application also provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the functions of the computer system for key processing methods in any of the above embodiments.

[0109] It is understood that the specific examples in this application are only intended to help those skilled in the art better understand the implementation methods of this application, and are not intended to limit the scope of the invention.

[0110] It is understood that in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not limit the implementation process of the embodiments of this application in any way.

[0111] It is understood that the various implementation methods described in this application can be implemented individually or in combination, and the implementation methods in this application are not limited in this respect.

[0112] Unless otherwise stated, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The term "and / or" as used in this application includes any and all combinations of one or more of the associated listed items. The singular forms "a," "the," and "the" as used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0113] It is understood that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiments can be completed by the integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0114] It is understood that the memory in the embodiments of this application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Specifically, non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM). It should be noted that the memory in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0115] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0116] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the aforementioned method implementations, and will not be repeated here.

[0117] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0118] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0119] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0120] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0121] The above are merely specific embodiments of this application, but the scope of protection of this invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A method for processing keys, characterized in that, Applied to a SIM card, and the method includes: In response to detecting a first instruction for a first key, the key type of the first key and the read / write type of the first instruction are determined, wherein the key type includes at least a public key and a private key, and the first instruction includes user identification information; When the first key indicates a public key and the first instruction indicates a read, the user's permission level is determined to be a first level; when the first key indicates a public key and the first instruction indicates a write, the user's permission level is determined to be a second level; when the first key indicates a private key and the first instruction indicates a read or write, the user's permission level is determined to be a second level; wherein, the first level is used to indicate that any user meets the permissions, and the second level is used to indicate that the target user meets the permissions. Based on the user's identity information and the user's permission level, determine whether to execute the first instruction.

2. The method according to claim 1, characterized in that, The key type also includes a session key, and the step of determining the user permission level corresponding to the first instruction based on the type of the first key and the read / write type of the first instruction includes: If the first key indicates a session key and the first instruction indicates read or write, the user's permission level is determined to be the second level.

3. The method according to claim 2, characterized in that, The SIM card pre-stores a national cryptographic encryption algorithm. When the first key indicates a session key and the user permission level corresponding to the first instruction is level two, the method further includes: The session key is encrypted using the national cryptographic encryption algorithm to obtain ciphertext information; and the ciphertext information is stored.

4. The method according to claim 1, characterized in that, The SIM card can provide multiple interfaces for data interaction with terminal devices, including at least an interface for writing files and an interface for reading files. The method further includes: The read / write type of the first instruction is determined based on the interface being invoked.

5. The method according to claim 4, characterized in that, The terminal device includes a post-quantum encryption algorithm, and the first key includes the result of running the post-quantum encryption algorithm.

6. The method according to claim 1, characterized in that, The SIM card includes multiple storage spaces, and different storage spaces are used to store keys of different key types; And, after the first instruction instructs the writing of the first key, and after determining that the first instruction has been executed, the method further includes: Based on the key type of the first key, determine the storage space for storing the first key, and store the first key in the corresponding storage space.

7. A key processing apparatus, characterized in that, Applied to a SIM card, and the device includes: A type determination unit is configured to determine the key type of the first key and the read / write type of the first instruction in response to detecting a first instruction for the first key, wherein the key type includes at least a public key and a private key, and the first instruction includes user identification information; The level determination unit is configured to determine the user's permission level as a first level when the first key indicates a public key and the first instruction indicates a read; determine the user's permission level as a second level when the first key indicates a public key and the first instruction indicates a write; and determine the user's permission level as a second level when the first key indicates a private key and the first instruction indicates a read or write; wherein the first level is used to indicate that any user meets the permissions, and the second level is used to indicate that the target user meets the permissions. An execution unit is configured to determine whether to execute the first instruction based on the user identity information and the user permission level.

8. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 6 when it is run.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 6.

Images