A super-SIM card-based authentication method, device and equipment

Abstract

The application provides a verification method, device and equipment based on a super SIM card, applied to the technical field of network security. The method comprises the following steps: a mobile terminal SDK acquires a first user identification code input by a user and an encrypted data packet of a client, and sends the first user identification code and the encrypted data packet to a super SIM card application. The encrypted data packet is generated by the client in response to an access demand of the user for a target service. The super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after verification, uses a super SIM card private key to sign the encrypted data packet to obtain first signature data, and returns the first signature data to the mobile terminal SDK. The mobile terminal SDK sends the first signature data and the encrypted data packet to a service platform for authentication. The client receives an authentication result returned by the service platform, and determines whether to authorize the user to access the target service based on the authentication result, so that the problems of low security and poor user experience of a traditional identity authentication method can be solved.

Description

A verification method, apparatus, and device based on a super SIM card. Technical Field

[0001] This application relates to the field of network security technology, and in particular to an authentication method, apparatus and device based on a super SIM card. Background Technology

[0002] With the rapid development of information technology, user authentication technology has become an important component of ensuring network security. Current mainstream authentication methods include account passwords, SMS verification codes, and biometrics. These methods are widely used in login verification for internet services, payment transactions, and various sensitive operations.

[0003] However, these mainstream authentication methods have the following problems in practical use. For example, password authentication is vulnerable to brute-force attacks, phishing attacks, or theft through social engineering. Furthermore, remembering complex passwords is a significant burden for users, leading many to choose simple, easy-to-remember but less secure passwords. While SMS verification codes improve security and convenience to some extent, they rely on network signals, may experience communication delays, and are susceptible to SIM card cloning or SMS hijacking, making it difficult to fully guarantee security.

[0004] Meanwhile, biometric technologies (such as fingerprint and facial recognition) have been widely used in recent years due to their uniqueness and resistance to forgery. However, these technologies are not without their flaws: on the one hand, biometric data is immutable, and its leakage poses a serious privacy risk; on the other hand, device compatibility issues and authentication failures due to changes in biometrics occur frequently, affecting user experience. Summary of the Invention

[0005] The purpose of this application is to provide a verification method, device, and equipment based on a super SIM card, which solves the problems of low security and poor user experience of traditional identity authentication methods.

[0006] In a first aspect, embodiments of this application provide a verification method based on a Super SIM card. The method includes: a mobile terminal SDK acquiring a first user identification code input by a user and an encrypted data packet from a client, and sending the first user identification code and the encrypted data packet to a Super SIM card application. The encrypted data packet is generated by the client in response to a user's access request for a target service. The Super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and upon successful verification, signs the encrypted data packet using the Super SIM card private key to obtain first signature data, returning the first signature data to the mobile terminal SDK. The mobile terminal SDK sends the first signature data and the encrypted data packet to a service platform for authentication. The client receives the authentication result returned by the service platform and determines whether to authorize the user to access the target service based on the authentication result.

[0007] This application provides an authentication method based on a Super SIM card. The mobile terminal SDK obtains a first user identification code input by the user and an encrypted data packet generated by the client in response to the user's request to access a target service, and sends both to the Super SIM card application. Upon receiving the data, the Super SIM card application verifies the first user identification code. If the verification is successful, it uses the Super SIM card private key to sign the encrypted data packet to obtain first signature data, which is then returned to the mobile terminal SDK. The mobile terminal SDK sends the signature data and the encrypted data packet to the service platform for authentication. The client determines whether to authorize the user to access the target service based on the authentication result returned by the service platform. This process, by employing two-way authentication between the Super SIM card application and the service platform, significantly reduces the success rate of intercepting man-in-the-middle attacks and ensures the security of identity verification. Furthermore, the authentication response time is short, meeting financial-grade real-time requirements.

[0008] One possible implementation involves the following steps for verifying the first user identification code: the Super SIM card application obtains a pre-stored second user identification code, determines whether the first user identification code and the second user identification code are consistent, and if they are consistent, the verification passes; if they are inconsistent, the verification fails.

[0009] In one possible implementation, before the mobile terminal SDK obtains the user-inputted first user identification code and the client's encrypted data packet, the method further includes: the client generating a first data packet based on a dynamic token, device fingerprint, timestamp, and service identifier; encrypting the first data packet using a pre-set digital certificate to obtain an encrypted data packet; encoding the encrypted data packet to obtain a QR code; and displaying the QR code. The mobile terminal scans the QR code and parses it to obtain the encrypted data packet. The mobile terminal receives and saves the user-inputted first user identification code.

[0010] One possible implementation, after the mobile terminal SDK sends the first signature data and encrypted data packet to the business platform for authentication, further includes: the business platform obtaining a pre-stored super SIM card public key, and verifying the first signature data using the super SIM card public key. If the verification result is successful, the business platform uses a pre-installed digital certificate to decrypt the encrypted data packet to obtain a dynamic token, device fingerprint, timestamp, and service identifier. It then verifies each of these elements one by one. If all verifications are successful, a successful authentication result is generated and returned to the client; otherwise, a failed authentication result is generated and returned to the client. If the verification result is unsuccessful, the business platform terminates the business process.

[0011] One possible implementation of the verification method based on a Super SIM card provided in this application embodiment further includes a process of writing a digital certificate to the Super SIM card. Specifically, this includes: the mobile terminal SDK generating a certificate request data packet; signing the certificate request data packet using the Super SIM card private key to obtain second signature data; and sending the certificate request data packet and the second signature data to the service platform. The service platform receives the certificate request data packet and the second signature data, verifies the second signature data using a preset Super SIM card public key, and after successful verification, sends the certificate request data packet to the certificate issuing system so that the certificate issuing system can issue a digital certificate based on the certificate request data packet. The service platform receives the digital certificate sent by the certificate issuing system and encrypts and transmits the digital certificate to the mobile terminal SDK and the client. The mobile terminal SDK writes the digital certificate into a preset secure area of ​​the Super SIM card and binds it to the Super SIM card's device fingerprint, Super SIM card private key, and second user identification code.

[0012] One possible implementation, before sending the certificate request data packet and second signature data to the business platform, further includes: the mobile terminal SDK reading the SIM card identification code of the super SIM card. The mobile terminal SDK encrypts the SIM card identification code using a pre-set operator platform public key to obtain a request message. The mobile terminal SDK sends the request message to the business platform through a two-way authentication channel. The business platform calls the operator platform's verification interface to submit the request message to the operator platform, so that the operator platform decrypts the request message using its private key to obtain the SIM card identification code and returns the super SIM card information corresponding to the SIM card identification code to the business platform. The super SIM card information includes a first mobile phone number. The business platform sends the super SIM card information to the mobile terminal SDK. The mobile terminal SDK receives the super SIM card information and obtains the second mobile phone number entered by the user. If the mobile terminal SDK determines that the second mobile phone number matches the first mobile phone number, it generates a certificate request data packet and binds the first mobile phone number to the device fingerprint of the super SIM card.

[0013] One possible implementation is that the Super SIM card information also includes a card type identifier code and a service status code. The method further includes: if the service platform determines that the card type identifier code is a personal communication card and the service status code is normal, it executes the step of forwarding the Super SIM card information to the mobile terminal SDK.

[0014] One possible implementation involves the following steps for encrypting and transmitting a digital certificate to the mobile terminal SDK and client: The service platform encrypts the certificate content of the digital certificate using a preset encryption key to obtain encrypted certificate content data, and encrypts the session key of the digital certificate using the Super SIM card public key to obtain encrypted session key data. The service platform then sends the encrypted certificate content data and the encrypted session key data to the mobile terminal SDK. Finally, the service platform sends the encrypted session key data to the client.

[0015] Secondly, embodiments of this application provide a verification device based on a Super SIM card, which may include an acquisition module, a signature module, a sending module, and an authorization module.

[0016] The acquisition module is used to acquire the first user identification code input by the user and the encrypted data packet sent by the client, and then send the first user identification code and the encrypted data packet to the Super SIM card application. The encrypted data packet is generated by the client in response to the user's access request for the target service.

[0017] The signature module is used to receive the first user identification code and the encrypted data packet, verify the first user identification code, and after successful verification, use the super SIM card private key to sign the encrypted data packet to obtain the first signature data, and return the first signature data to the mobile terminal SDK.

[0018] The sending module is used to send the first signature data and the encrypted data packet to the business platform for authentication.

[0019] The authorization module is used to receive the authentication results returned by the business platform and determine whether to authorize the user to access the target business based on the authentication results.

[0020] Thirdly, embodiments of this application provide a verification device based on a Super SIM card. This Super SIM card-based verification device has the function of implementing the Super SIM card-based verification method of the first aspect or any possible implementation thereof. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described function.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, enable the computer to perform the verification method based on a super SIM card as described in the first aspect or any possible implementation thereof.

[0022] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, enable the computer to execute the verification method based on a super SIM card as described in the first aspect or any possible implementation thereof.

[0023] The technical effects of any of the second to fifth aspects can be referred to the technical effects of the possible implementations in the first aspect, and will not be repeated here. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0025] Figure 1 is a schematic diagram of a verification system based on a super SIM card provided in an embodiment of this application;

[0026] Figure 2 is a flowchart illustrating a verification method based on a Super SIM card provided in an embodiment of this application;

[0027] Figure 3 is another flowchart illustrating a verification method based on a super SIM card provided in an embodiment of this application;

[0028] Figure 4 is a schematic diagram of a verification device based on a super SIM card provided in an embodiment of this application;

[0029] Figure 5 is another structural schematic diagram of a verification system based on a super SIM card provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0031] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0032] Currently, mainstream identity authentication methods include account passwords, SMS verification codes, and biometrics. However, these methods suffer from low security and poor user experience.

[0033] Based on this, embodiments of this application provide a verification method, apparatus, and device based on a Super SIM card. The method includes a mobile terminal SDK acquiring a first user identification code input by a user and an encrypted data packet from a client, and sending the first user identification code and the encrypted data packet to a Super SIM card application. The encrypted data packet is generated by the client in response to a user's access request for a target service. The Super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after successful verification, signs the encrypted data packet using the Super SIM card private key to obtain first signature data, which is then returned to the mobile terminal SDK. The mobile terminal SDK sends the first signature data and the encrypted data packet to a service platform for authentication. The client receives the authentication result returned by the service platform and determines whether to authorize the user to access the target service based on the authentication result.

[0034] The verification method based on a Super SIM card provided in this application involves a mobile terminal SDK acquiring a first user identification code input by the user and an encrypted data packet generated by the client in response to the user's request to access a target service, and sending both to a Super SIM card application. Upon receiving the Super SIM card application, the application verifies the first user identification code. If the verification is successful, the application uses the Super SIM card private key to sign the encrypted data packet to obtain first signature data, which is then returned to the mobile terminal SDK. The mobile terminal SDK sends the first signature data and the encrypted data packet to the service platform for authentication. The client determines whether to authorize the user to access the target service based on the authentication result returned by the service platform. This process, by employing two-way authentication between the Super SIM card application and the service platform, significantly reduces the success rate of intercepting man-in-the-middle attacks and ensures the security of identity verification. Furthermore, the short authentication response time in this verification process meets the real-time requirements of financial-grade transactions.

[0035] The methods provided in the embodiments of this application will now be described in conjunction with the specific accompanying drawings.

[0036] On one hand, this application provides a verification system based on a super SIM card. As shown in FIG1, the verification system 100 based on a super SIM card includes: a client 101, a mobile terminal 102, a super SIM card 103, and a service platform 104.

[0037] The client 101 provides an interactive interface for users to select the desired service and initiate verification based on that service. For example, the client 101 could be a self-service terminal. Users can select the desired service through this interface.

[0038] Specifically, when a user initiates an access request for the target service, the client 101 generates an encrypted data packet based on the access request and encodes the encrypted data packet into a QR code according to a preset encoding method. This QR code can be displayed to the user through the client's device screen.

[0039] The mobile terminal 102 has a Super SIM card application installed, and the mobile terminal 102 can interact with the Super SIM card 103 through the Super SIM card application. The mobile terminal 102 can be a portable device such as a mobile phone used by users in daily life.

[0040] Specifically, the user can use the scanning function of the mobile terminal 102 to scan the QR code generated by the client 101 to obtain the encrypted data packet transmitted by the client. The mobile terminal 102 is also used to receive the first user identification code input by the user. After obtaining the encrypted data packet and the first user identification code, the mobile terminal 102 sends the encrypted data packet and the first user identification code to the Super SIM card application.

[0041] The Super SIM card 103 is a SIM card with a security chip. The Super SIM card's secure unit stores the Super SIM card's private key. The Super SIM card application is an application running on the Super SIM card. Upon receiving an encrypted data packet and a first user identification code, the Super SIM card application verifies the first user identification code. After successful verification, it uses the Super SIM card's private key to sign the encrypted data packet, obtaining first signature data, and then returns the first signature data to the mobile terminal 102.

[0042] After receiving the first signature data, the mobile terminal 102 sends the first signature data and the encrypted data packet to the business platform 104.

[0043] The business platform 104 can be a server platform used to provide the target business. The business platform 104 is used to authenticate the user using the received first signature data and encrypted data packet, and return the authentication result to the client 101.

[0044] Client 101 is also used to determine whether to authorize a user to access the target service based on the received authentication result.

[0045] It should be noted that the verification system 100 based on the Super SIM card shown in Figure 1 above is only an example of the application scenario of the solution in this application, and is not a limitation on the application scenario of the solution in this application.

[0046] On one hand, this application provides a verification method based on a Super SIM card, which can be executed by the Super SIM card-based verification system 100 illustrated in FIG1. ​​As shown in FIG2, the method may include the following steps.

[0047] S201, the mobile terminal SDK obtains the first user identification code input by the user and the encrypted data packet from the client, and sends the first user identification code and the encrypted data packet to the Super SIM card application.

[0048] The encrypted data packet is generated by the client in response to the user's access request for the target service.

[0049] One possible implementation involves the client selecting a desired service on the client side. The client then obtains the service identifier corresponding to that service and generates a first data packet based on the client's dynamic token, device fingerprint, timestamp, and the service identifier. The client encrypts this first data packet using a pre-set digital certificate to obtain an encrypted data packet. The client then uses a pre-set session key to encrypt the encrypted data packet using the SM4 encryption algorithm in CTR encryption mode and encodes it into a QR code. The client displays the QR code on its interface.

[0050] The device fingerprint can be obtained from the SM3 hash of the mobile terminal's International Mobile Equipment Identity (IMEI) and the Super SIM card's International Mobile Subscriber Identity (SIM-ID).

[0051] The QR code can be configured with a refresh time during this process to ensure its timely display; it will automatically refresh if the timeout period expires. This refresh time can be 5 seconds per refresh, which reduces the risk of QR code screenshots being replayed compared to traditional refresh times.

[0052] The dynamic token can be a one-time password (OTP) generated by the client and used during the authentication process. This ensures the token expires immediately after use and cannot be reused, preventing replay attacks. The device fingerprint identifies the client device, preventing forgery. The timestamp verifies the validity of encrypted data packets, preventing the reuse of expired packets. The session key can be a session key generated using the CTR encryption mode based on the SM4 encryption algorithm.

[0053] In this process, the client transmits encrypted data packets via QR codes, ensuring that only mobile terminals that have scanned the QR codes can obtain the encrypted data packets, thus preventing data from being intercepted or tampered with during transmission.

[0054] The user scans a QR code using their mobile device, which is then parsed to obtain an encrypted data packet. Simultaneously, the mobile device displays an input box for a first user identification code, which the user enters as prompted. After the user enters the first user identification code, the mobile device receives and saves it.

[0055] The first user identification code can be the personal identification number (PIN) of the Super SIM card, which can facilitate the Super SIM card to verify the user's identity in the future.

[0056] After obtaining the first user identification code input by the user and the encrypted data packet from the client, the mobile terminal SDK sends the first user identification code and the encrypted data packet to the Super SIM card application.

[0057] S202, the Super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after successful verification, uses the Super SIM card private key to sign the encrypted data packet to obtain the first signature data, and returns the first signature data to the mobile terminal SDK.

[0058] The Super SIM card private key is pre-generated within the Super SIM card's secure unit. Within the secure unit, both the Super SIM card private key and its corresponding Super SIM card public key are simultaneously generated. The Super SIM card public key is then sent to the service platform, which receives and stores it. The key length of both the Super SIM card private and public keys can be 256 bits, conforming to the GM / T 0003.5-2012 standard.

[0059] This process enhances the security and protection of the Super SIM card's private key by storing it in a secure unit within the Super SIM card, which boasts an Evaluation Assurance Level 5+ (EAL5+) rating. Furthermore, compared to software storage solutions (such as those using a Trusted Execution Environment (TEE) to store the Super SIM card's private key), this method effectively resists complex attacks such as physical attacks, side-channel attacks, and malware attacks, ensuring the confidentiality, integrity, and non-repudiation of the private key during storage and use.

[0060] Specifically, the Super SIM card application receives a first user identification code and an encrypted data packet. The Super SIM card application then reads a pre-stored second user identification code from a designated secure area and determines whether the first and second user identification codes match.

[0061] If the first user identification code matches the second user identification code, the verification is successful. The Super SIM card application uses the Super SIM card private key to sign the encrypted data packet to obtain the first signature data, and returns the first signature data to the mobile terminal SDK.

[0062] If the first user identification code and the second user identification code do not match, the verification will fail, the Super SIM card application will return an error code, and the verification process will be terminated.

[0063] S203, the mobile terminal SDK sends the first signature data and encrypted data packet to the business platform for authentication.

[0064] Specifically, after receiving the first signature data returned by the Super SIM card application, the mobile terminal SDK sends the first signature data and the encrypted data packet to the business platform for authentication.

[0065] After receiving the first signature data and the encrypted data packet, the business platform obtains the pre-stored Super SIM card public key and uses the Super SIM card public key to verify the first signature data.

[0066] If the business platform verifies the first signature data using the Super SIM card public key and the verification result is successful, the business platform uses a pre-installed digital certificate to decrypt the encrypted data packet to obtain a dynamic token, device fingerprint, timestamp, and service identifier. It then verifies each of these elements one by one. If all verifications are successful, a successful authentication result is generated and returned to the client; otherwise, a failed authentication result is generated and returned to the client. If the business platform verifies the first signature data using the Super SIM card public key and the verification result is unsuccessful, the business platform terminates the business process.

[0067] For example, after the business platform decrypts the encrypted data packet using a pre-installed digital certificate to obtain the dynamic token, device fingerprint, timestamp, and business identifier, the business platform first calculates the difference between the current system timestamp and the timestamp of the encrypted data packet. If this difference is less than or equal to a preset timestamp threshold, such as 6 seconds, the timestamp verification is successful. This process, by verifying the device's timestamp, ensures that the verification process is processed within a reasonable timeframe, preventing replay attacks. The business platform then compares the device fingerprint with a pre-stored device fingerprint whitelist database. If the device fingerprint exists in the whitelist, the device fingerprint verification is successful. This process ensures that the verification request originates from a pre-authorized or trusted device, preventing unauthorized device access.

[0068] During this process, the encrypted data packet can also store the user's IP address and geographical location. The business platform can verify whether the user is on the whitelist based on their IP address. The business platform can also determine if the user's location is abnormal based on their geographical location and historical geographical location. Furthermore, for the same user, the business platform can record the number of requests made by that user within a certain time window. If the user's request frequency exceeds a preset threshold, a risk warning is triggered, which can identify and block abnormal or malicious access behavior, improving the security of the verification process.

[0069] S204: The client receives the authentication result returned by the business platform and determines whether to authorize the user to access the target business based on the authentication result.

[0070] Specifically, the client receives the authentication result returned by the business platform. If the authentication result is successful, the client authorizes the user to access the corresponding business resources. If the authentication result is unsuccessful, the client records the access exception and prompts the user to re-authenticate.

[0071] Furthermore, the method provided in this application embodiment may also include S205-S208. For example, as shown in FIG3, S205-S208 may be executed before S201.

[0072] S205, the mobile terminal SDK generates a certificate request data packet, uses the super SIM card private key to sign the certificate request data packet to obtain second signature data, and sends the certificate request data packet and second signature data to the business platform.

[0073] Specifically, the mobile terminal SDK first reads the SIM card identification code of the Super SIM card. This SIM card identification code can be the Integrated Circuit Card Identity (ICCID), i.e., the SIM card number. The mobile terminal SDK uses a pre-installed operator platform public key to encrypt the SIM card identification code and timestamp, generating a request message. The mobile terminal SDK then sends the request message to the service platform through a two-way authentication channel. This two-way authentication channel can be an HTTPS two-way authentication channel.

[0074] The business platform calls the verification interface of the operator platform to submit a request message to the operator platform.

[0075] Upon receiving the request message, the operator platform decrypts it using its private key to obtain the SIM card identification code and timestamp. The operator platform first verifies the timestamp. If the timestamp deviates from the operator platform's current server timestamp by more than a preset time (e.g., 1 minute), the operator determines the request message is invalid. If the timestamp deviates from the operator platform's current server timestamp by less than the preset time, the operator platform returns the Super SIM card information corresponding to the SIM card identification code to the service platform.

[0076] The Super SIM card information may include, but is not limited to, the first mobile phone number, card type identification code, and service status code.

[0077] After receiving the Super SIM card information from the operator platform, the service platform verifies the Super SIM card type based on the card type identifier code and verifies the Super SIM card's current status based on the service identifier code. If the service platform determines that the card type identifier code indicates a personal communication card and the service status code is normal, it sends the Super SIM card information to the mobile terminal SDK.

[0078] If the business platform identifies the card type identifier as an IoT card or an overseas card, it will terminate the verification process.

[0079] The mobile terminal SDK receives the Super SIM card information and obtains the second mobile phone number entered by the user. If the mobile terminal SDK determines that the second mobile phone number matches the first mobile phone number, it generates a certificate request data packet and binds the first mobile phone number to the Super SIM card's device fingerprint. If the mobile terminal SDK determines that the second mobile phone number does not match the first mobile phone number, it terminates the registration process.

[0080] The certificate request data packet may include the Super SIM card public key, the first mobile phone number, and the device fingerprint.

[0081] S206, the service platform receives the certificate request data packet and the second signature data, verifies the second signature data using the preset super SIM card public key, and after the verification is successful, sends the certificate request data packet to the certificate issuance system so that the certificate issuance system can issue a digital certificate based on the certificate request data packet.

[0082] Specifically, the service platform receives a certificate request data packet and second signature data. The service platform uses the Super SIM card public key to verify the second signature data in the certificate signing data packet. After successful verification, the service platform sends the certificate request data packet to the certificate authority (CA). Upon receiving the certificate request data packet and verifying the operator's real-name information, the certificate authority issues a digital certificate based on the certificate request data packet.

[0083] S207, the business platform receives the digital certificate sent by the certificate issuance system and transmits the digital certificate to the mobile terminal SDK and client in encryption.

[0084] Specifically, the business platform uses a preset encryption key to encrypt the certificate content of the digital certificate to obtain encrypted certificate content data, and uses the Super SIM card public key to encrypt the session key of the digital certificate to obtain encrypted session key data. For example, the business platform uses a dual encryption method: first, it encrypts the certificate content using the CTR encryption mode of the SM4 encryption algorithm to obtain encrypted certificate content data; then, it uses the Super SIM card public key to encrypt the session key to obtain encrypted session key data.

[0085] The business platform sends encrypted certificate content and encrypted session key data to the mobile terminal SDK. The business platform then sends encrypted session key data to the client.

[0086] S208, the mobile terminal SDK writes the digital certificate into the preset security area of ​​the Super SIM card and binds it with the Super SIM card's device fingerprint, Super SIM card private key, and second user identification code.

[0087] Specifically, after receiving the digital certificate, the mobile terminal SDK writes the digital certificate into the preset security area of ​​the Super SIM card and binds it with the Super SIM card's device fingerprint, Super SIM card private key, and second user identification code.

[0088] Furthermore, 30 days before the certificate expires, user authorization can be automatically obtained. With user authorization, the certificate reissue process is triggered to complete the automatic renewal of the certificate. At the same time, the business platform can automatically synchronize the certificate revocation list in the certificate issuance system to synchronize the certificate revocation status.

[0089] The above primarily describes the solutions provided in this application from the perspective of the device's working principle. It is understood that, in order to achieve the above functions, the verification device based on the Super SIM card includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the algorithm steps of the examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0090] This application embodiment can divide the super SIM card-based verification device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module.

[0091] It should be noted that the module division in this embodiment is illustrative and only represents a logical functional division; other division methods may exist in actual implementation. Figure 4 illustrates a possible configuration of the Super SIM card-based verification device described above and in the embodiments, where each functional module is divided according to its corresponding function. As shown in Figure 4, the Super SIM card-based verification device 400 may include: an acquisition module 401, a signature module 402, a sending module 403, and an authorization module 404.

[0092] The acquisition module 401 is used to support the verification device 400 based on the super SIM card to execute S201 in the verification method based on the super SIM card shown in FIG2.

[0093] The signature module 402 is used to support the Super SIM card-based verification device 400 in executing S202 of the Super SIM card-based verification method illustrated in FIG2.

[0094] The sending module 403 is used to support the Super SIM card-based verification device 400 in executing S203 of the Super SIM card-based verification method illustrated in FIG2.

[0095] The authorization module 404 is used to support the Super SIM card-based verification device 400 in executing S204 of the Super SIM card-based verification method illustrated in FIG2.

[0096] In one possible implementation, the device can also be used by a super SIM card application to obtain a pre-stored second user identification code, determine whether the first user identification code and the second user identification code are consistent, and if they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0097] In one possible implementation, the device can also be used by the client to generate a first data packet based on a dynamic token, device fingerprint, timestamp, and service identifier; encrypt the first data packet using a pre-set digital certificate to obtain an encrypted data packet; encode the encrypted data packet to obtain a QR code; and display the QR code. The mobile terminal scans the QR code, parses it, and obtains the encrypted data packet. The mobile terminal receives and saves the first user identification code entered by the user.

[0098] In one possible implementation, the device can also be used by the business platform to obtain a pre-stored super SIM card public key, and verify the first signature data using the super SIM card public key. If the verification result is successful, the business platform uses a pre-installed digital certificate to decrypt the encrypted data packet to obtain a dynamic token, device fingerprint, timestamp, and service identifier. It then verifies each of these elements one by one. If all verifications are successful, a successful authentication result is generated and returned to the client; otherwise, a failed authentication result is generated and returned to the client. If the verification result is unsuccessful, the business platform terminates the business process.

[0099] In one possible implementation, the device can also be used by the mobile terminal SDK to generate a certificate request data packet, sign the certificate request data packet using the super SIM card private key to obtain second signature data, and send the certificate request data packet and second signature data to the service platform. The service platform receives the certificate request data packet and second signature data, verifies the second signature data using a pre-set super SIM card public key, and after successful verification, sends the certificate request data packet to the certificate issuing system so that the certificate issuing system can issue a digital certificate based on the certificate request data packet. The service platform receives the digital certificate sent by the certificate issuing system, encrypts the digital certificate, and transmits it to the mobile terminal SDK and client. The mobile terminal SDK writes the digital certificate into a preset secure area of ​​the super SIM card and binds it with the super SIM card's device fingerprint, super SIM card private key, and second user identification code.

[0100] In one possible implementation, the device can also be used by the mobile terminal SDK to read the SIM card identification code of the Super SIM card. The mobile terminal SDK encrypts the SIM card identification code using a pre-set operator platform public key to obtain a request message. The mobile terminal SDK sends the request message to the service platform through a two-way authentication channel. The service platform calls the operator platform's verification interface to submit the request message to the operator platform, enabling the operator platform to decrypt the request message using its private key to obtain the SIM card identification code and return the Super SIM card information corresponding to the SIM card identification code to the service platform. The Super SIM card information includes a first mobile phone number. The service platform sends the Super SIM card information to the mobile terminal SDK. The mobile terminal SDK receives the Super SIM card information and obtains the second mobile phone number entered by the user. If the mobile terminal SDK determines that the second mobile phone number matches the first mobile phone number, it generates a certificate request data packet and binds the first mobile phone number to the device fingerprint of the Super SIM card.

[0101] In one possible implementation, the Super SIM card information also includes a card type identifier and a service status code. This device can also be used by the service platform to forward the Super SIM card information to the mobile terminal SDK when it determines that the card type identifier is a personal communication card and the service status code is normal.

[0102] In one possible implementation, the device can also be used by a business platform to encrypt the certificate content of a digital certificate using a preset encryption key to obtain encrypted certificate content data, and to encrypt the session key of the digital certificate using the Super SIM card public key to obtain encrypted session key data. The business platform then sends the encrypted certificate content data and the encrypted session key data to the mobile terminal SDK. Finally, the business platform sends the encrypted session key data to the client.

[0103] It should be noted that all relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0104] The verification device 400 based on the Super SIM card provided in this application embodiment is used to execute the verification method based on the Super SIM card shown in FIG2 above, and thus can achieve the same effect as the verification method based on the Super SIM card above.

[0105] This application also provides a verification device based on a Super SIM card, which can execute the verification method and related steps based on a Super SIM card in the above method embodiments.

[0106] This application also provides a computer-readable storage medium storing instructions that, when executed, perform the verification method and related steps based on the Super SIM card in the above method embodiments.

[0107] This application also provides a computer program product that, when run on a computer, causes the computer to execute the verification method and related steps based on the Super SIM card described in the above method embodiments.

[0108] In some embodiments, the methods shown in this application can be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of art.

[0109] This application embodiment also provides a verification system 100 based on a super SIM card, as shown in FIG5. The verification system 100 based on a super SIM card includes at least one processor 501 and at least one interface circuit 502.

[0110] As an example, when the Super SIM-based authentication system 100 includes one processor and one interface circuit, the processor can be processor 501 (or processor 501 shown in the solid box in Figure 5) (or processor 501 shown in the dashed box), and the interface circuit can be interface circuit 502 (or interface circuit 502 shown in the solid box in Figure 5). When the Super SIM-based authentication system 100 includes two processors and two interface circuits, the two processors include processor 501 (shown in the solid box in Figure 5) and processor 501 (shown in the dashed box), and the two interface circuits include interface circuit 502 (shown in the solid box in Figure 5) and interface circuit 502 (shown in the dashed box). No limitation is made in this regard.

[0111] The processor 501 and the interface circuit 502 can be interconnected via a line. For example, the interface circuit 502 can be used to receive signals. Alternatively, the interface circuit 502 can be used to send signals to other devices (such as the processor 501). For instance, the interface circuit 502 can read computer instructions stored in memory and send those instructions to the processor 501. The processor 501 executes the instructions and, in conjunction with input / output devices, implements the steps in the above embodiments, such as the steps performed in any of the method embodiments shown in FIG. 2 or FIG. 3. Of course, this super SIM card-based verification system may also include other discrete components, which are not specifically limited in this application embodiment.

[0112] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0113] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0114] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0115] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0116] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to it, or all or part of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0117] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A verification method based on a Super SIM card, characterized in that, The method includes: a mobile terminal SDK acquiring a first user identification code input by a user and an encrypted data packet from a client, and sending the first user identification code and the encrypted data packet to a Super SIM card application; the encrypted data packet is generated by the client in response to a user's access request for a target service; the Super SIM card application receives the first user identification code and the encrypted data packet, verifies the first user identification code, and after successful verification, signs the encrypted data packet using the Super SIM card private key to obtain first signature data, and returns the first signature data to the mobile terminal SDK; the mobile terminal SDK sends the first signature data and the encrypted data packet to a service platform for authentication; the client receives the authentication result returned by the service platform, and determines whether to authorize the user to access the target service based on the authentication result; the method also includes a process of writing a digital certificate to the Super SIM card, specifically including: The mobile terminal SDK generates a certificate request data packet, signs the certificate request data packet using the Super SIM card private key to obtain second signature data, and sends the certificate request data packet and the second signature data to the service platform. The service platform receives the certificate request data packet and the second signature data, verifies the second signature data using a preset Super SIM card public key, and after successful verification, sends the certificate request data packet to the certificate issuance system so that the certificate issuance system issues the digital certificate based on the certificate request data packet. The service platform receives the digital certificate sent by the certificate issuance system, encrypts and transmits the digital certificate to the mobile terminal SDK and the client. The mobile terminal SDK writes the digital certificate into a preset security area of ​​the Super SIM card and binds it with the Super SIM card's device fingerprint, the Super SIM card private key, and a pre-stored second user identification code.

2. The method according to claim 1, characterized in that, The step of verifying the first user identification code includes: the Super SIM card application obtains a pre-stored second user identification code, and determines whether the first user identification code and the second user identification code are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

3. The method according to claim 1, characterized in that, Before the step of the mobile terminal SDK obtaining the first user identification code input by the user and the encrypted data packet from the client, the method further includes: the client generating a first data packet based on a dynamic token, device fingerprint, timestamp, and service identifier; encrypting the first data packet using a pre-set digital certificate to obtain an encrypted data packet; encoding the encrypted data packet to obtain a QR code; and displaying the QR code; the mobile terminal scanning the QR code and parsing the QR code to obtain the encrypted data packet; and the mobile terminal receiving and saving the first user identification code input by the user.

4. The method according to claim 1, characterized in that, After the step of the mobile terminal SDK sending the first signature data and the encrypted data packet to the business platform for authentication, the method further includes: the business platform obtaining a pre-stored super SIM card public key, and verifying the first signature data using the super SIM card public key based on the first signature data; if the verification result is successful, the business platform decrypts the encrypted data packet using a pre-set digital certificate to obtain a dynamic token, device fingerprint, timestamp, and service identifier, and verifies the dynamic token, device fingerprint, timestamp, and service identifier one by one; if all verifications are successful, a successful authentication result is generated and returned to the client; otherwise, a failed authentication result is generated and returned to the client; if the verification result is unsuccessful, the business platform terminates the business process.

5. The method according to claim 1, characterized in that, Before sending the certificate request data packet and the second signature data to the service platform, the method further includes: the mobile terminal SDK reading the SIM card identification code of the super SIM card; the mobile terminal SDK encrypting the SIM card identification code using a preset operator platform public key to obtain a request message; the mobile terminal SDK sending the request message to the service platform through a two-way authentication channel; the service platform calling the verification interface of the operator platform to submit the request message to the operator platform, so that the operator platform decrypts the request message using the operator platform private key to obtain the SIM card identification code, and returns the super SIM card information corresponding to the SIM card identification code to the service platform; the super SIM card information includes a first mobile phone number; the service platform sending the super SIM card information to the mobile terminal SDK; the mobile terminal SDK receiving the super SIM card information and obtaining the second mobile phone number input by the user; the mobile terminal SDK generating the certificate request data packet when it determines that the second mobile phone number is consistent with the first mobile phone number, and binding the first mobile phone number to the device fingerprint of the super SIM card.

6. The method according to claim 5, characterized in that, The super SIM card information also includes a card type identifier code and a service status code; the method further includes: when the service platform determines that the card type identifier code is a personal communication card and the service status code is in a normal state, it performs the step of forwarding the super SIM card information to the mobile terminal SDK.

7. The method according to claim 1, characterized in that, The step of encrypting and transmitting the digital certificate to the mobile terminal SDK and the client includes: the service platform encrypting the certificate content of the digital certificate using a preset encryption key to obtain encrypted certificate content data, and encrypting the session key of the digital certificate using the Super SIM card public key to obtain encrypted session key data; the service platform sending the encrypted certificate content data and the encrypted session key data to the mobile terminal SDK; and the service platform sending the encrypted session key data to the client.

8. A verification device based on a super SIM card, characterized in that, The device includes: an acquisition module, configured to acquire a first user identification code input by a user and an encrypted data packet sent by a client, and send the first user identification code and the encrypted data packet to a Super SIM card application; the encrypted data packet is generated by the client in response to the user's access request for a target service; a signature module, configured to receive the first user identification code and the encrypted data packet, verify the first user identification code, and after successful verification, sign the encrypted data packet using a Super SIM card private key to obtain first signature data, and return the first signature data to the mobile terminal SDK; a sending module, configured to send the first signature data and the encrypted data packet to a service platform for authentication; and an authorization module, configured to receive the authentication result returned by the service platform, and determine whether to authorize the user to access the target service based on the authentication result; the signature module is further configured to... A certificate request data packet is generated, and the certificate request data packet is signed using the Super SIM card private key to obtain second signature data. The certificate request data packet and the second signature data are then sent to the service platform. The sending module is further configured to receive the certificate request data packet and the second signature data, verify the second signature data using a preset Super SIM card public key, and, upon successful verification, send the certificate request data packet to the certificate issuing system so that the certificate issuing system can issue a digital certificate based on the certificate request data packet. The module also receives the digital certificate sent by the certificate issuing system, encrypts and transmits the digital certificate to the mobile terminal SDK and the client, and writes the digital certificate into a preset security area of ​​the Super SIM card, binding it with the Super SIM card's device fingerprint, the Super SIM card private key, and a pre-stored second user identification code.

9. A verification device based on a super SIM card, characterized in that, The verification device based on the Super SIM card includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, and the processor executing the machine-executable instructions to implement the verification method based on the Super SIM card as described in any one of claims 1 to 7.

Images