Verification method, device and equipment based on super SIM (Subscriber Identity Module) card

Abstract

The invention provides a verification method, device and equipment based on a super SIM (Subscriber Identity Module) card, which are applied to the technical field of network security. The method comprises the following steps: a mobile terminal SDK obtains a first user identification code input by a user and an encrypted data packet of a client, and sends the first user identification code and the encrypted data packet to a super SIM card application; the encrypted data packet is generated by the client in response to an access demand of the user for the target service. And the super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, signs the encrypted data packet by using the super SIM card private key to obtain first signature data after the first user identification code passes the verification, and returns the first signature data to the mobile terminal SDK. And the mobile terminal SDK sends the first signature data and the encrypted data packet to a service platform for authentication. And the client receives the authentication result returned by the service platform, and determines whether to authorize the user to access the target service based on the authentication result, so that the problems of low security and poor user experience of a traditional identity authentication method can be solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a verification method, device and equipment based on a super SIM card. Background Art

[0002] With the rapid development of information technology, user identity authentication has become a crucial component of network security. Current mainstream authentication methods include account and password authentication, SMS verification codes, and biometrics. These methods are widely used for login verification, payment transactions, and various sensitive operations on internet services.

[0003] However, these mainstream authentication methods present the following challenges in practical use. For example, account and password authentication methods are susceptible to brute force attacks, phishing attacks, or theft through social engineering tactics. Furthermore, the burden of remembering complex passwords is high, leading many users to opt for simpler, easier-to-remember, but less secure passwords. While SMS verification codes improve authentication security and convenience to a certain extent, they rely on network signals, can experience communication delays, and face the risk of SIM card cloning or SMS hijacking, making them difficult to fully guarantee security.

[0004] At the same time, biometric technologies (such as fingerprint and facial recognition) have been widely used in recent years due to their uniqueness and resistance to forgery. However, these technologies are not without their flaws. For one thing, biometric data is immutable, and its leakage poses serious privacy risks. Furthermore, device compatibility issues and authentication failures due to biometric changes are common, impacting the user experience. Summary of the Invention

[0005] The purpose of this application is to provide a verification method, device and equipment based on a super SIM card to solve the problems of low security and poor user experience of traditional identity authentication methods.

[0006] In the first aspect, an embodiment of the present application provides a verification method based on a super SIM card, the method comprising: a mobile terminal SDK obtains a first user identification code input by a user and an encrypted data packet of a client, and sends the first user identification code and the encrypted data packet to a super SIM card application. The encrypted data packet is generated by the client in response to the user's access requirements for a target service. The super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after the verification is passed, uses the super SIM card private key to sign the encrypted data packet to obtain first signature data, and returns the first signature data to the mobile terminal SDK. The mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication. The client receives the authentication result returned by the service platform, and determines whether the user is authorized to access the target service based on the authentication result.

[0007] An embodiment of the present application provides a verification method based on a super SIM card, in which the mobile terminal SDK obtains the first user identification code input by the user and the encrypted data packet generated by the client in response to the user's need to access the target service, and sends the two to the super SIM card application. After receiving the first user identification code, the super SIM card application verifies the first user identification code. After the verification is passed, the encrypted data packet is signed with the super SIM card private key to obtain the first signature data, and then returned to the mobile terminal SDK. The mobile terminal SDK sends the signature data and the encrypted data packet to the service platform for authentication, and the client decides whether to authorize the user to access the target service based on the authentication result returned by the service platform. In this process, by adopting a two-way authentication method between the super SIM card application and the service platform, the success rate of man-in-the-middle attack interception can be significantly reduced, and the security of identity authentication can be guaranteed. At the same time, the authentication response time in the verification process is short, which can meet the financial-level real-time requirements.

[0008] In one possible implementation, the step of verifying the first user identification code includes: the super SIM card application obtains a pre-stored second user identification code, and determines whether the first user identification code is consistent with the second user identification code. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0009] In one possible implementation, before the mobile terminal SDK obtains the first user identification code input by the user and the encrypted data packet from the client, the method further includes: the client generating a first data packet based on the dynamic token, the device fingerprint, the timestamp, and the service identifier; encrypting the first data packet using a preset digital certificate to obtain an encrypted data packet; encoding the encrypted data packet to obtain a QR code; and displaying the QR code. The mobile terminal scans the QR code and parses the QR code to obtain the encrypted data packet. The mobile terminal receives and stores the first user identification code input by the user.

[0010] In one possible implementation, after the mobile terminal SDK sends the first signature data and the encrypted data packet to the business platform for authentication, the method further includes: the business platform obtains the pre-stored super SIM card public key, and verifies the first signature data using the super SIM card public key based on the first signature data. If the verification result is verification passed, the business platform uses the preset digital certificate to decrypt the encrypted data packet to obtain a dynamic token, device fingerprint, timestamp and business identifier, and verifies the dynamic token, device fingerprint, timestamp and business identifier one by one. If all are verified, a verification result of verification passed is generated and returned to the client. Otherwise, a verification result of verification failure is generated and returned to the client. If the verification result is verification failure, the business platform terminates the business process.

[0011] In a possible implementation method, the verification method based on the super SIM card provided in the embodiment of the present application also includes a process of writing a digital certificate to the super SIM card, specifically including: the mobile terminal SDK generates a certificate request data packet, uses the super SIM card private key to sign the certificate request data packet to obtain second signature data, and sends the certificate request data packet and the second signature data to the business platform. The business platform receives the certificate request data packet and the second signature data, uses the preset super SIM card public key to verify the second signature data, and after the verification is passed, sends the certificate request data packet to the certificate issuing system, so that the certificate issuing system issues a digital certificate based on the certificate request data packet. The business platform receives the digital certificate sent by the certificate issuing system, and encrypts the digital certificate and transmits it to the mobile terminal SDK and the client. The mobile terminal SDK writes the digital certificate into the preset security area of ​​the super SIM card, and binds it to the device fingerprint, super SIM card private key and second user identification code of the super SIM card.

[0012] In one possible implementation, before sending the certificate request data packet and the second signature data to the service platform, the method further includes: the mobile terminal SDK reads the SIM card identification code of the super SIM card. The mobile terminal SDK uses the preset operator platform public key to encrypt the SIM card identification code to obtain a request message. The mobile terminal SDK sends the request message to the service platform through a two-way authentication channel. The service platform calls the verification interface of the operator platform to submit a request message to the operator platform, so that the operator platform uses the operator platform private key to decrypt the request message to obtain the SIM card identification code, and returns the super SIM card information corresponding to the SIM card identification code to the service platform. The super SIM card information includes the first mobile phone number. The service platform sends the super SIM card information to the mobile terminal SDK. The mobile terminal SDK receives the super SIM card information and obtains the second mobile phone number entered by the user. When the mobile terminal SDK determines that the second mobile phone number is consistent with the first mobile phone number, it generates a certificate request data packet and binds the first mobile phone number to the device fingerprint of the super SIM card.

[0013] In one possible implementation, the super SIM card information also includes a card type identification code and a service status code. The method further includes: upon determining that the card type identification code is a personal communication card and the service status code is normal, the service platform forwards the super SIM card information to the mobile terminal SDK.

[0014] In one possible implementation, the steps of encrypting and transmitting the digital certificate to the mobile terminal SDK and client include: the service platform encrypting the certificate content of the digital certificate using a preset encryption key to obtain certificate content-encrypted data; and encrypting the session key of the digital certificate using the super SIM card public key to obtain session key-encrypted data. The service platform sends the certificate content-encrypted data and the session key-encrypted data to the mobile terminal SDK. The service platform then sends the session key-encrypted data to the client.

[0015] In a second aspect, an embodiment of the present application provides a verification device based on a super SIM card, which may include an acquisition module, a signature module, a sending module and an authorization module.

[0016] The acquisition module is configured to acquire the first user identification code input by the user and the encrypted data packet sent by the client, and send the first user identification code and the encrypted data packet to the super SIM card application. The encrypted data packet is generated by the client in response to the user's access request for the target service.

[0017] The signature module is used to receive the first user identification code and the encrypted data packet, verify the first user identification code, and after the verification is passed, use the super SIM card private key to sign the encrypted data packet to obtain the first signature data, and return the first signature data to the mobile terminal SDK.

[0018] The sending module is used to send the first signature data and the encrypted data packet to the service platform for authentication.

[0019] The authorization module is used to receive the authentication result returned by the service platform and determine whether to authorize the user to access the target service based on the authentication result.

[0020] In a third aspect, embodiments of the present application provide a super SIM card-based verification device, which has the function of implementing the super SIM card-based verification method of the first aspect or any possible implementation of the first aspect. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

[0021] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on a computer, the computer can execute the super SIM card-based verification method of the above-mentioned first aspect or any possible implementation of the first aspect.

[0022] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the super SIM card-based verification method of the first aspect or any possible implementation method described above.

[0023] Among them, the technical effects brought about by any implementation method in the second to fifth aspects can refer to the technical effects brought about by the possible implementation method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the specific implementation methods or the description of the prior art. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0025] Figure 1 A schematic diagram of the structure of a super SIM card-based authentication system provided in an embodiment of the present application; Figure 2 A flowchart of a super SIM card-based verification method provided in an embodiment of the present application; Figure 3 Another flowchart of a super SIM card-based verification method provided in an embodiment of the present application; Figure 4 A schematic diagram of the structure of a super SIM card-based authentication device provided in an embodiment of the present application; Figure 5 Another structural diagram of a super SIM card-based verification system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0027] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments in the present application without creative work are within the scope of protection of the present application.

[0028] Currently, mainstream identity authentication methods include account passwords, SMS verification codes, and biometrics. However, these methods suffer from low security and poor user experience.

[0029] Based on this, an embodiment of the present application provides a verification method, device and equipment based on a super SIM card. The method includes the mobile terminal SDK obtaining a first user identification code input by the user and an encrypted data packet of the client, and sending the first user identification code and the encrypted data packet to the super SIM card application. The encrypted data packet is generated by the client in response to the user's access requirements for the target service. The super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after the verification is passed, uses the super SIM card private key to sign the encrypted data packet to obtain the first signature data, and returns the first signature data to the mobile terminal SDK. The mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication. The client receives the authentication result returned by the service platform, and determines whether to authorize the user to access the target service based on the authentication result.

[0030] The embodiment of the present application provides a verification method based on a super SIM card, in which the mobile terminal SDK obtains the first user identification code input by the user and the encrypted data packet generated by the client in response to the user's need to access the target service, and sends the two to the super SIM card application. After receiving the first user identification code, the super SIM card application verifies the first user identification code, and after the verification is passed, uses the super SIM card private key to sign the encrypted data packet to obtain the first signature data, and then returns the first signature data to the mobile terminal SDK. The mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication, and the client decides whether to authorize the user to access the target service based on the authentication result returned by the service platform. In this process, by adopting a two-way authentication method between the super SIM card application and the service platform, the success rate of man-in-the-middle attack interception can be significantly reduced, and the security of identity authentication can be guaranteed. At the same time, the authentication response time in this verification process is short, which can meet the real-time requirements of financial-level transactions.

[0031] The method provided in the embodiments of the present application will be described below with reference to specific drawings.

[0032] On the one hand, the embodiment of the present application provides a verification system based on a super SIM card. Figure 1As shown, the super SIM card-based authentication system 100 includes: a client 101 , a mobile terminal 102 , a super SIM card 103 and a service platform 104 .

[0033] Among them, client 101 is used to provide an interactive interface for the user to select the target service to be handled and initiate verification based on the target service. For example, client 101 can be a self-service terminal, etc. The user can select the target service to be handled through the interactive interface.

[0034] Specifically, when a user initiates an access request for the target service, the client 101 generates an encrypted data packet based on the target service access request, and encodes the encrypted data packet into a QR code according to a preset encoding method. The QR code can be displayed to the user through the client's device screen.

[0035] The mobile terminal 102 is installed with a super SIM card application, and the mobile terminal 102 can exchange data with the super SIM card 103 through the super SIM card application. The mobile terminal 102 can be a portable device such as a mobile phone used by the user in daily life.

[0036] Specifically, the user can use the scanning function of mobile terminal 102 to scan the QR code generated by client 101 to obtain the encrypted data packet transmitted by the client. Mobile terminal 102 is also configured to receive the first user identification code input by the user. After obtaining the encrypted data packet and the first user identification code, mobile terminal 102 sends the encrypted data packet and the first user identification code to the super SIM card application.

[0037] The super SIM card 103 is a SIM card with a security chip. The super SIM card's security unit stores a super SIM card private key. The super SIM card application is an application running on the super SIM card. After receiving the encrypted data packet and the first user identification code, the super SIM card application verifies the first user identification code. If the verification is successful, the super SIM card application signs the encrypted data packet using the super SIM card private key to obtain first signature data, and then returns the first signature data to the mobile terminal 102.

[0038] After receiving the first signature data, the mobile terminal 102 sends the first signature data and the encrypted data packet to the service platform 104 .

[0039] The service platform 104 may be a server platform for providing target services. The service platform 104 is configured to authenticate the user using the received first signature data and the encrypted data packet, and return the authentication result to the client 101 .

[0040] The client 101 is further configured to determine whether to authorize the user to access the target service based on the received authentication result.

[0041] It should be noted that the above Figure 1 The illustrated super SIM card-based authentication system 100 is merely an example of an application scenario of the present application solution, and is not intended to limit the application scenario of the present application solution.

[0042] On the one hand, the embodiment of the present application provides a verification method based on a super SIM card, which can be Figure 1 The illustrated super SIM card based authentication system 100 is executed. Figure 2 As shown, the method may include the following steps.

[0043] S201: The mobile terminal SDK obtains a first user identification code input by a user and an encrypted data packet from a client, and sends the first user identification code and the encrypted data packet to a super SIM card application.

[0044] The encrypted data packet is generated by the client in response to the user's access demand for the target service.

[0045] In one possible implementation, when a user selects a target service on a client, the client obtains the service identifier corresponding to the target service and generates a first data packet based on the client's dynamic token, device fingerprint, timestamp, and the service identifier. The client encrypts the first data packet using a pre-set digital certificate to obtain an encrypted data packet. The client then encrypts the encrypted data packet using the pre-set session key in CTR encryption mode using the SM4 encryption algorithm and encodes the encrypted data packet to obtain a QR code. The client then displays the QR code on the client interface.

[0046] The device fingerprint may be a SM3 hash value of the international mobile equipment identity (IMEI) of the mobile terminal and the international mobile subscriber identity SIM-ID of the super SIM card.

[0047] During this process, the QR code can be configured with a refresh timer to ensure the timeliness of the QR code display. If the timer expires, it will automatically refresh. The refresh time can be 5 seconds per time. Compared with the traditional refresh time, this refresh time can reduce the risk of QR code screenshots and replays.

[0048] The dynamic token can be a one-time password (OTP) generated by the client during the authentication process. This ensures that the dynamic token expires immediately after use and cannot be reused, thus preventing replay attacks. The device fingerprint is used to identify the client device and prevent device counterfeiting. The timestamp verifies the validity of the encrypted data packet and prevents the reuse of expired encrypted data packets. The session key can be generated using the CTR encryption mode based on the SM4 encryption algorithm.

[0049] In this process, the client transmits the encrypted data packet through the QR code, ensuring that only the mobile terminal that scans the QR code can obtain the encrypted data packet, which can prevent the data from being intercepted or tampered with during transmission.

[0050] The user uses a mobile terminal to scan the QR code, which is then parsed to obtain an encrypted data packet. Simultaneously, the mobile terminal displays a pop-up input box for the first user identification code, where the user enters the first user identification code according to the prompts. After the user enters the first user identification code, the mobile terminal receives and stores the first user identification code.

[0051] The first user identification code may be a personal identification number (PIN) of the super SIM card, which can facilitate subsequent verification of the user's identity by the super SIM card.

[0052] After acquiring the first user identification code input by the user and the encrypted data packet from the client, the mobile terminal SDK sends the first user identification code and the encrypted data packet to the super SIM card application.

[0053] S202, the super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after the verification passes, uses the super SIM card private key to sign the encrypted data packet to obtain first signature data, and returns the first signature data to the mobile terminal SDK.

[0054] The Super SIM private key is pre-generated within the Super SIM card's security unit. Within the security unit, the Super SIM private key and its corresponding Super SIM public key are simultaneously generated and sent to the service platform, which receives and stores the Super SIM public key. Both the Super SIM private key and the Super SIM public key can be 256 bits in length, in compliance with the GM / T 0003.5-2012 standard.

[0055] This process improves the security and protection capabilities of Super SIM card private key storage by storing the Super SIM card private key in the Super SIM card's secure element, which has an evaluation assurance level 5+ (EAL5+) rating. Furthermore, compared to software storage solutions (for example, solutions that use a trusted execution environment (TEE) to store Super SIM card private keys), this process effectively resists complex attacks such as physical attacks, side-channel attacks, and malware attacks by storing the Super SIM card private key in the Super SIM card's secure element, ensuring the confidentiality, integrity, and non-repudiation of the private key during storage and use.

[0056] Specifically, the super SIM card application receives the first user identification code and the encrypted data packet, reads the pre-stored second user identification code from a designated security area, and determines whether the first user identification code is consistent with the second user identification code.

[0057] If the first user identification code is consistent with the second user identification code, the verification is successful, and the super SIM card application uses the super SIM card private key to sign the encrypted data packet to obtain first signature data, and returns the first signature data to the mobile terminal SDK.

[0058] If the first user identification code is inconsistent with the second user identification code, the verification fails, the super SIM card application returns an error code, and terminates the verification process.

[0059] S203: The mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication.

[0060] Specifically, after receiving the first signature data returned by the super SIM card application, the mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication.

[0061] After receiving the first signature data and the encrypted data packet, the service platform obtains the pre-stored super SIM card public key and uses the super SIM card public key to verify the first signature data.

[0062] If the business platform verifies the first signature data using the super SIM card public key and the result is verification passed, the business platform uses the preset digital certificate to decrypt the encrypted data packet to obtain the dynamic token, device fingerprint, timestamp and business identifier, and verifies the dynamic token, device fingerprint, timestamp and business identifier one by one. If all are verified, a verification result of verification passed is generated and returned to the client. Otherwise, a verification result of verification failed is generated and returned to the client. If the business platform verifies the first signature data using the super SIM card public key and the result is verification failed, the business platform terminates the business process.

[0063] Exemplarily, after the service platform uses a pre-set digital certificate to decrypt the encrypted data packet to obtain a dynamic token, device fingerprint, timestamp, and service identifier, it first calculates the difference between the current system timestamp and the timestamp of the encrypted data packet. If the difference is less than or equal to a preset timestamp threshold, such as 6 seconds, the timestamp verification is successful. This process ensures that the verification process is processed within a reasonable timeframe by verifying the device timestamp, preventing replay attacks. The service platform compares the device fingerprint with a pre-stored device fingerprint whitelist database. If the device fingerprint exists in the device fingerprint whitelist, the device fingerprint verification is successful. This process ensures that the verification request originates from a pre-authorized or trusted device, preventing access by unauthorized devices.

[0064] During this process, the encrypted data packet can also store the user's IP address and geographic location. The service platform can verify whether the user is on the whitelist based on their IP address. The service platform can also determine whether the user's location is abnormal based on their geographic location and historical location history. Furthermore, for each user, the service platform can record the number of requests made within a certain time window. If the user's request frequency exceeds a preset threshold, a risk warning is triggered, identifying and preventing abnormal or malicious access behavior, thereby improving the security of the verification process.

[0065] S204: The client receives the authentication result returned by the service platform, and determines whether to authorize the user to access the target service based on the authentication result.

[0066] Specifically, the client receives the authentication result returned by the service platform. If the authentication result is successful, the client authorizes the user to access the corresponding service resources. If the authentication result is unsuccessful, the client records the access anomaly and prompts the user to re-authenticate.

[0067] Furthermore, the method provided in the embodiment of the present application may further include S205-S208. For example, Figure 3 As shown, S205 - S208 may be executed before S201 .

[0068] S205 , the mobile terminal SDK generates a certificate request data packet, signs the certificate request data packet using the super SIM card private key to obtain second signature data, and sends the certificate request data packet and the second signature data to the service platform.

[0069] Specifically, the mobile terminal SDK first reads the Super SIM card's SIM card identification code. This SIM card identification code can be the integrated circuit card identity (ICCID), i.e., the SIM card number. The mobile terminal SDK encrypts the SIM card identification code and timestamp using the pre-set operator platform public key to generate a request message. The mobile terminal SDK sends the request message to the service platform via a bidirectional authentication channel, which can be an HTTPS bidirectional authentication channel.

[0070] The service platform calls the verification interface of the operator platform and submits a request message to the operator platform.

[0071] After receiving the request message, the operator platform decrypts it using its private key to obtain the SIM card identification code and timestamp. The operator platform first verifies the timestamp. If the timestamp deviates from the operator platform's current server timestamp by more than a preset time (e.g., 1 minute), the operator determines the request message is invalid. If the timestamp deviates from the operator platform's current server timestamp by less than a preset time, the operator platform returns the Super SIM card information corresponding to the SIM card identification code to the service platform.

[0072] The super SIM card information may include but is not limited to the first mobile phone number, the card type identification code and the service status code.

[0073] After receiving the Super SIM card information from the operator platform, the service platform verifies the Super SIM card type based on the card type identification code and the Super SIM card's current status based on the service identification code. If the service platform determines that the card type identification code indicates a personal communication card and the service status code indicates normal, it sends the Super SIM card information to the mobile terminal SDK.

[0074] When the business platform identifies the card type identification code as an IoT or overseas card, it will terminate the verification process.

[0075] The mobile terminal SDK receives the Super SIM card information and obtains the second mobile phone number entered by the user. If the mobile terminal SDK determines that the second mobile phone number is the same as the first mobile phone number, it generates a certificate request packet and binds the first mobile phone number to the device fingerprint of the Super SIM card. If the mobile terminal SDK determines that the second mobile phone number is inconsistent with the first mobile phone number, the mobile terminal SDK terminates the registration process.

[0076] The certificate request data packet may include the super SIM card public key, the first mobile phone number and the device fingerprint.

[0077] S206, the service platform receives the certificate request data packet and the second signature data, uses the preset super SIM card public key to verify the second signature data, and after the verification is passed, sends the certificate request data packet to the certificate issuing system, so that the certificate issuing system issues a digital certificate based on the certificate request data packet.

[0078] Specifically, the service platform receives a certificate request packet and the second signature data. It verifies the second signature data in the certificate signature packet using the super SIM card's public key. After verification, the service platform sends the certificate request packet to a certificate authority (CA). Upon receiving the certificate request packet and verifying the operator's real-name information, the CA issues a digital certificate based on the certificate request packet.

[0079] S207: The business platform receives the digital certificate sent by the certificate issuing system, and encrypts the digital certificate and transmits it to the mobile terminal SDK and the client.

[0080] Specifically, the service platform uses a preset encryption key to encrypt the digital certificate's content to obtain certificate content-encrypted data, and then uses the super SIM card's public key to encrypt the digital certificate's session key to obtain session key-encrypted data. For example, the service platform uses double encryption: first, using the SM4 encryption algorithm's CTR encryption mode to encrypt the certificate content to obtain certificate content-encrypted data. Then, using the super SIM card's public key, the session key is encrypted to obtain session key-encrypted data.

[0081] The service platform sends the certificate content encrypted data and the session key encrypted data to the mobile terminal SDK. The service platform sends the session key encrypted data to the client.

[0082] S208 , the mobile terminal SDK writes the digital certificate into a preset security area of ​​the super SIM card, and binds it to the device fingerprint, super SIM card private key, and second user identification code of the super SIM card.

[0083] Specifically, after receiving the digital certificate, the mobile terminal SDK writes the digital certificate into a preset security area of ​​the super SIM card and binds it with the device fingerprint, super SIM card private key and second user identification code of the super SIM card.

[0084] Furthermore, 30 days before a certificate expires, user authorization can be automatically obtained. Once authorized, the certificate reissue process is triggered to complete the automatic renewal of the certificate. At the same time, the business platform can automatically synchronize the certificate revocation list in the certificate issuance system to synchronize the certificate revocation status.

[0085] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the working principle of the device. It can be understood that in order to realize the above functions, the verification device based on the super SIM card includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0086] In the embodiments of the present application, the functional modules of the super SIM card-based authentication device can be divided according to the above-mentioned method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into a single processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.

[0087] It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. In actual implementation, there may be other division methods. Figure 4 FIG. 1 shows a possible schematic diagram of the composition of the authentication device based on the super SIM card involved in the above and embodiments. Figure 4 As shown, the super SIM card-based verification device 400 may include: an acquisition module 401 , a signature module 402 , a sending module 403 and an authorization module 404 .

[0088] The acquisition module 401 is used to support the verification device 400 based on the super SIM card to execute Figure 2 S201 in the authentication method based on the super SIM card is illustrated.

[0089] Signature module 402, used to support the super SIM card-based verification device 400 to execute Figure 2 S202 in the authentication method based on the super SIM card is illustrated.

[0090] The sending module 403 is used to support the verification device 400 based on the super SIM card to execute Figure 2 S203 in the authentication method based on the super SIM card is illustrated.

[0091] Authorization module 404, used to support the super SIM card-based verification device 400 to execute Figure 2 S204 in the authentication method based on the super SIM card is illustrated.

[0092] In a possible implementation, the device can also be used for the super SIM card application to obtain a pre-stored second user identification code, and determine whether the first user identification code is consistent with the second user identification code. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0093] In one possible implementation, the device can also be configured to generate a first data packet on a client based on a dynamic token, a device fingerprint, a timestamp, and a service identifier; encrypt the first data packet using a preset digital certificate to obtain an encrypted data packet; encode the encrypted data packet to obtain a QR code; and display the QR code. A mobile terminal scans the QR code, parses the QR code to obtain the encrypted data packet; and receives and stores the first user identification code entered by the user.

[0094] In a possible implementation method, the device can also be used by the service platform to obtain a pre-stored super SIM card public key, and verify the first signature data using the super SIM card public key based on the first signature data. If the verification result is verification passed, the service platform uses the preset digital certificate to decrypt the encrypted data packet to obtain a dynamic token, device fingerprint, timestamp and service identifier, and verifies the dynamic token, device fingerprint, timestamp and service identifier one by one. If all are verified, a verification result of verification passed is generated and returned to the client. Otherwise, a verification result of verification failure is generated and returned to the client. If the verification result is verification failure, the service platform terminates the service process.

[0095] In a possible implementation method, the device can also be used for the mobile terminal SDK to generate a certificate request data packet, use the super SIM card private key to sign the certificate request data packet to obtain the second signature data, and send the certificate request data packet and the second signature data to the business platform. The business platform receives the certificate request data packet and the second signature data, uses the preset super SIM card public key to verify the second signature data, and after the verification is passed, sends the certificate request data packet to the certificate issuing system so that the certificate issuing system issues a digital certificate based on the certificate request data packet. The business platform receives the digital certificate sent by the certificate issuing system, and encrypts the digital certificate and transmits it to the mobile terminal SDK and the client. The mobile terminal SDK writes the digital certificate into the preset security area of ​​the super SIM card, and binds it to the device fingerprint of the super SIM card, the super SIM card private key and the second user identification code.

[0096] In one possible implementation, the device can also be used by the mobile terminal SDK to read the SIM card identification code of the super SIM card. The mobile terminal SDK uses the preset operator platform public key to encrypt the SIM card identification code to obtain a request message. The mobile terminal SDK sends the request message to the service platform through a two-way authentication channel. The service platform calls the verification interface of the operator platform to submit a request message to the operator platform, so that the operator platform uses the operator platform private key to decrypt the request message to obtain the SIM card identification code, and returns the super SIM card information corresponding to the SIM card identification code to the service platform. The super SIM card information includes the first mobile phone number. The service platform sends the super SIM card information to the mobile terminal SDK. The mobile terminal SDK receives the super SIM card information and obtains the second mobile phone number entered by the user. When the mobile terminal SDK determines that the second mobile phone number is consistent with the first mobile phone number, it generates a certificate request data packet and binds the first mobile phone number to the device fingerprint of the super SIM card.

[0097] In one possible implementation, the super SIM card information also includes a card type identification code and a service status code. The device can also be used for the service platform to forward the super SIM card information to the mobile terminal SDK when the service platform determines that the card type identification code is a personal communication card and the service status code is normal.

[0098] In one possible implementation, the device can also be used by the service platform to encrypt the certificate content of the digital certificate using a preset encryption key to obtain certificate content-encrypted data, and to encrypt the digital certificate session key using the super SIM card public key to obtain session key-encrypted data. The service platform sends the certificate content-encrypted data and the session key-encrypted data to the mobile terminal SDK. The service platform then sends the session key-encrypted data to the client.

[0099] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0100] The super SIM card-based verification device 400 provided in the embodiment of the present application is used to perform the above Figure 2 The super SIM card-based authentication method shown can therefore achieve the same effect as the above-mentioned super SIM card-based authentication method.

[0101] An embodiment of the present application further provides a super SIM card-based verification device, which can execute the super SIM card-based verification method and related steps in the above method embodiment.

[0102] An embodiment of the present application also provides a computer-readable storage medium having instructions stored thereon, which, when executed, execute the super SIM card-based verification method and related steps in the above method embodiment.

[0103] An embodiment of the present application further provides a computer program product, which, when executed on a computer, enables the computer to execute the super SIM card-based verification method and related steps in the above method embodiment.

[0104] In some embodiments, the methods described herein may be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of manufacture.

[0105] The embodiment of the present application also provides a verification system 100 based on a super SIM card, such as Figure 5 As shown, the super SIM card-based authentication system 100 includes at least one processor 501 and at least one interface circuit 502 .

[0106] As an example, when the super SIM card-based authentication system 100 includes a processor and an interface circuit, the processor may be Figure 5 The processor 501 shown in the solid line frame (or the processor 501 shown in the dotted line frame) may be Figure 5 The interface circuit 502 shown in the solid line frame (or the interface circuit 502 shown in the dotted line frame). When the super SIM card-based authentication system 100 includes two processors and two interface circuits, the two processors include Figure 5 The processor 501 shown in the solid line frame and the processor 501 shown in the dotted line frame, the two interface circuits include Figure 5 The interface circuit 502 shown in the solid line frame and the interface circuit 502 shown in the dotted line frame are not limited to this.

[0107] The processor 501 and the interface circuit 502 can be interconnected via a line. For example, the interface circuit 502 can be used to receive signals. For another example, the interface circuit 502 can be used to send signals to other devices (such as the processor 501). For example, the interface circuit 502 can read computer instructions stored in the memory and send the computer instructions to the processor 501. The processor 501 executes the instructions and, in conjunction with the input and output devices, implements the various steps in the above embodiments, such as implementing Figure 2 or Figure 3 Of course, the super SIM card-based authentication system may also include other discrete components, which are not specifically limited in the embodiments of the present application.

[0108] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0109] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0110] The units described as separate components may or may not be physically separate, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0111] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0112] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the contributing part or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0113] The above content is only a specific embodiment of this application, but the scope of protection of this application is not limited to this. Any changes or replacements within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A verification method based on a super SIM card, characterized in that: The method comprises: The mobile terminal SDK obtains a first user identification code input by the user and an encrypted data packet from the client, and sends the first user identification code and the encrypted data packet to the super SIM card application; the encrypted data packet is generated by the client in response to the user's access demand for the target service; The super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after verification, uses the super SIM card private key to sign the encrypted data packet to obtain first signature data, and returns the first signature data to the mobile terminal SDK; The mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication; The client receives the authentication result returned by the service platform, and determines whether to authorize the user to access the target service based on the authentication result.

2. The method according to claim 1, characterized in that The step of verifying the first user identification code includes: The super SIM card application obtains a pre-stored second user identification code and determines whether the first user identification code is consistent with the second user identification code. If they are consistent, the verification is successful; if they are inconsistent, the verification is failed.

3. The method according to claim 1, characterized in that Before the step of the mobile terminal SDK acquiring the first user identification code input by the user and the encrypted data packet of the client, the method further includes: The client generates a first data packet based on the dynamic token, the device fingerprint, the timestamp, and the service identifier, encrypts the first data packet using a preset digital certificate to obtain an encrypted data packet, encodes the encrypted data packet to obtain a QR code, and displays the QR code; The mobile terminal scans the QR code and parses the QR code to obtain the encrypted data packet; The mobile terminal receives and stores a first user identification code input by a user.

4. The method according to claim 1, wherein After the mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication, the method further includes: The service platform obtains a pre-stored super SIM card public key, and verifies the first signature data using the super SIM card public key based on the first signature data; If the verification result is verification passed, the service platform uses the preset digital certificate to decrypt the encrypted data packet to obtain a dynamic token, a device fingerprint, a timestamp, and a service identifier, and verifies the dynamic token, the device fingerprint, the timestamp, and the service identifier one by one. If all are verified successfully, a verification result of verification passed is generated and returned to the client; otherwise, a verification failure result is generated and returned to the client; If the verification result is failure, the business platform terminates the business process.

5. The method according to claim 1, wherein The method further includes a process of writing a digital certificate into the super SIM card, specifically comprising: The mobile terminal SDK generates a certificate request data packet, signs the certificate request data packet using the super SIM card private key to obtain second signature data, and sends the certificate request data packet and the second signature data to the service platform; The service platform receives the certificate request data packet and the second signature data, verifies the second signature data using a preset super SIM card public key, and after the verification passes, sends the certificate request data packet to the certificate issuing system, so that the certificate issuing system issues the digital certificate based on the certificate request data packet; The business platform receives the digital certificate sent by the certificate issuing system, and encrypts and transmits the digital certificate to the mobile terminal SDK and the client; The mobile terminal SDK writes the digital certificate into a preset security area of ​​the super SIM card and binds it to the device fingerprint of the super SIM card, the super SIM card private key and the second user identification code.

6. The method according to claim 5, characterized in that Before sending the certificate request data packet and the second signature data to the service platform, the method further includes: The mobile terminal SDK reads the SIM card identification code of the super SIM card; The mobile terminal SDK encrypts the SIM card identification code using a preset operator platform public key to obtain a request message; The mobile terminal SDK sends the request message to the service platform through a two-way authentication channel; The service platform calls the verification interface of the operator platform to submit the request message to the operator platform, so that the operator platform uses the operator platform private key to decrypt the request message to obtain the SIM card identification code, and returns the super SIM card information corresponding to the SIM card identification code to the service platform; the super SIM card information includes the first mobile phone number; The service platform sends the super SIM card information to the mobile terminal SDK; The mobile terminal SDK receives the super SIM card information and obtains the second mobile phone number input by the user; When the mobile terminal SDK determines that the second mobile phone number is consistent with the first mobile phone number, it generates the certificate request data packet and binds the first mobile phone number to the device fingerprint of the super SIM card.

7. The method according to claim 6, characterized in that The super SIM card information also includes a card type identification code and a service status code; the method further includes: The service platform executes the step of forwarding the super SIM card information to the mobile terminal SDK when determining that the card type identification code is a personal communication card and the service status code is a normal state.

8. The method according to claim 5, characterized in that The step of encrypting and transmitting the digital certificate to the mobile terminal SDK and the client comprises: The service platform encrypts the certificate content of the digital certificate using a preset encryption key to obtain certificate content encrypted data, and encrypts the session key of the digital certificate using the super SIM card public key to obtain session key encrypted data; The service platform sends the certificate content encrypted data and the session key encrypted data to the mobile terminal SDK; The service platform sends the session key encrypted data to the client.

9. A verification device based on a super SIM card, characterized in that: The device comprises: an acquisition module, configured to acquire a first user identification code input by a user and an encrypted data packet sent by a client, and send the first user identification code and the encrypted data packet to a super SIM card application; the encrypted data packet is generated by the client in response to a user's access request for a target service; a signature module, configured to receive the first user identification code and the encrypted data packet, verify the first user identification code, and upon successful verification, sign the encrypted data packet using the super SIM card private key to obtain first signature data, and return the first signature data to the mobile terminal SDK; A sending module, configured to send the first signature data and the encrypted data packet to a service platform for authentication; The authorization module is used to receive the authentication result returned by the service platform and determine whether to authorize the user to access the target service based on the authentication result.

10. A verification device based on a super SIM card, characterized in that: The super SIM card-based authentication device includes a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the super SIM card-based authentication method according to any one of claims 1 to 8.

Images