Global digital authentication terminal device supporting eSIM and credit service method

Abstract

The invention discloses a global digital authentication terminal device supporting an eSIM, and the device comprises a password security chip which is used for executing global digital identity authentication, credit evidence storage and secure communication control, and a security module, an SM9 identification password algorithm module, an electronic seal engine, a multi-platform digital certificate management unit and a trusted execution environment are built in the password security chip; the eSIM module conforms to the standard of the global system for mobile communication (SGP). 22 and supports the switching of configuration files of a multi-operator subscriber identity module; wherein the eSIM module and the password security chip cooperatively operate, when a user initiates a security service, the password security chip generates a dynamic digital identity identifier based on an SM9 identifier cryptographic algorithm, and binds the dynamic digital identity identifier with an international mobile subscriber identity code in an eSIM configuration file; therefore, two-factor authentication of the communication identity and the digital identity is realized. The terminal device has the advantages of strong authentication and high compliance.

Description

Technical Field

[0001] This invention relates to the field of digital identity authentication technology, and more specifically to a digital authentication terminal device and a credit service method that supports an embedded user identification module. Background Technology

[0002] Current market solutions supporting embedded Subscriber Identity Modules (eSIM) (such as those from Apple, Samsung, and Huawei) primarily focus on mobile operator handover and IoT connection management, lacking support for high-security scenarios. For example, static authentication mechanisms are vulnerable to eSIM card exchange attacks; electronic signatures are not integrated with judicial evidence storage systems; and data sovereignty issues exist in international cross-border transactions.

[0003] Therefore, there is an urgent need for a comprehensive solution that combines efficient authentication, secure storage, and convenient maintenance.

[0004] It should be noted that the above description of the technical background is only for the purpose of providing a clear and complete explanation of the technical solutions of the present invention and facilitating understanding by those skilled in the art. It should not be assumed that the above technical solutions are known to those skilled in the art simply because they have been described in the background section of this invention. Summary of the Invention

[0005] The purpose of this invention is to overcome the above-mentioned shortcomings of the prior art and provide a digital authentication terminal device based on the collaborative operation of a cryptographic security chip and an eSIM module, which realizes functions such as dynamic digital identity generation, IPv6 secure communication, and biometric recognition, and provides high-performance assurance in different application scenarios.

[0006] This invention discloses a global digital authentication terminal device supporting eSIM, comprising: a cryptographic security chip for performing global digital identity authentication, credit storage, and secure communication control; and an eSIM module conforming to the GSMA SGP.22 RSP Technical Specification, supporting multi-operator user identification module profile switching; wherein, the eSIM module and the cryptographic security chip work together, and when a user initiates a secure service, the cryptographic security chip generates a dynamic digital identity identifier based on the SM9 identifier cryptographic algorithm issued by the State Cryptography Administration of China, and binds this identifier to the International Mobile Subscriber Identity (IMSI) in the eSIM profile to achieve two-factor authentication of communication identity and digital identity.

[0007] Furthermore, the cryptographic security chip incorporates a Secure Element (SE), the State Cryptography Administration's SM9 identifier cryptographic algorithm module, an electronic seal engine, a multi-platform digital certificate management unit, and a Trusted Execution Environment (TEE).

[0008] Furthermore, the eSIM module further supports IPv6 network layer authentication, including: before establishing a communication session, the cryptographic security chip generates a unique IPv6 interface identifier (IID), which is dynamically derived based on the user's digital credit management system credit certificate and the device fingerprint hash value; the eSIM module combines this IID with the prefix assigned by the operator to form a complete IPv6 address, and performs network layer verification through the Secure Neighbor Discovery Protocol (SEND); the cryptographic security chip signs the Cryptographically Generated Addresses (CGA) parameter in the SEND protocol and uses the SM2 elliptic curve public key cryptography algorithm of the State Cryptography Administration of China to verify the legitimacy of remote nodes, preventing IPv6 address spoofing and man-in-the-middle attacks; all IPv6 communication traffic is encrypted and packetized through the Trusted Execution Environment (TEE) built into the cryptographic security chip to ensure end-to-end security.

[0009] Furthermore, the global digital authentication terminal device supporting eSIM also includes a multimodal biosensor, which includes a 4K video camera and a behavioral feature acquisition unit for performing liveness detection and continuous behavior verification.

[0010] Furthermore, the global digital authentication terminal device supporting eSIM also includes a data isolation module. The data isolation module is configured to encrypt sensitive data and store it in the secure element (SE) of the cryptographic security chip, and store non-sensitive data in the general storage area using Advanced Encryption Standard-256 (AES-256) encryption.

[0011] Furthermore, the global digital authentication terminal device supporting eSIM also includes a screen accessory, which is a quick-release screen accessory. The screen accessory adopts a composite structure of magnetic attraction and hot melt adhesive, allowing users to complete the screen replacement within one minute, without affecting the integrity and security of sensitive data within the password security chip during the replacement process.

[0012] Furthermore, eSIM-enabled global digital authentication terminal devices also include a screen accessory, which comprises a sapphire screen. The sapphire screen has high hardness and scratch-resistant properties, ensuring that the device can be used for a long time without being easily damaged.

[0013] Furthermore, the cryptographic security chip also features a circuit breaker mechanism. When a physical intrusion or unauthorized access is detected, a hardware-level self-destruct program is automatically triggered to permanently destroy the private key and sensitive information within the security module unit.

[0014] This invention also discloses a credit service method, comprising the following steps: S1, receiving a service request and invoking a five-dimensional credit package to initiate a credit assessment; S2, dynamic identity generation and eSIM secure channel establishment; S3, electronic signature and multimodal biometric verification; S4, judicial-grade blockchain evidence storage; S5, data localization and cross-border compliance management.

[0015] Furthermore, the five-dimensional credit package includes a personal credit sub-package, a corporate credit sub-package, an equipment credit sub-package, a digital asset credit sub-package, and a behavioral credit sub-package, which are used to support "zero-run, instant approval" fast government services in scenarios such as business establishment, rural subsidy application, and credit granting for micro and small enterprises.

[0016] The beneficial effects of this invention are as follows: sensitive data is stored in a hardware-level security module (SE), supporting China's data localization requirements while being compatible with the cross-border "Cloud Security Alliance (CSA) European General Data Protection Regulation (GDPR) Compliance Code of Conduct"; it has a built-in electronic seal engine targeting compliant countries, with signature records synchronously uploaded to the blockchain, possessing legal validity; it enables "zero-visit, instant approval" fast government services in scenarios such as government affairs, finance, and rural areas, with business registration completed in as little as one minute; and it allows direct connection to services through the built-in digital credit management system without the need for a third-party app, avoiding privacy leaks and data abuse. This invention possesses strong authentication, high compliance, easy maintenance, and irreplaceable ecosystem advantages, enabling a comprehensive, secure, reliable, efficient, and low-cost integrated digital authentication and credit service. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a global digital authentication terminal device supporting eSIM according to an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of a global digital authentication terminal device supporting eSIM in another embodiment of the present invention;

[0019] Figure 3 This is a flowchart of the credit service method in an embodiment of the present invention.

[0020] The reference numerals in the above figures are as follows:

[0021] 100, 200: Digital authentication terminal device

[0022] 101: Password Security Chip

[0023] 102: eSIM module

[0024] 203: Multimodal Biosensors

[0025] 205: Data Isolation Module

[0026] 209: Screen Accessories

[0027] S1~S5: Steps Detailed Implementation

[0028] To better understand this invention, the following embodiments are provided in conjunction with the accompanying drawings. It should be understood that the embodiments of this invention are for illustrative purposes only and not for limiting the invention; the scope of protection of this invention is defined solely by the claims. The embodiments provided are merely preferred embodiments and are not intended to limit the invention in any way. Those skilled in the art can make changes, equivalent substitutions, or modifications based on the content of this invention to form different implementations. However, any changes and modifications, and any equivalent substitutions made to the method of this invention without departing from the inventive concept are within the scope of protection of this invention.

[0029] It should be noted that the following detailed description is exemplary and intended to further illustrate the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0030] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, and / or combinations thereof.

[0031] First, please refer to Figure 1 , Figure 1 This is a schematic diagram of a global digital authentication terminal device 100 supporting eSIM according to an embodiment of the present invention. Figure 1 As shown, the global digital authentication terminal device 100 supporting eSIM of the present invention includes a cryptographic security chip 101 and an eSIM module 102. The cryptographic security chip 101 is used to perform global digital identity authentication, credit storage, and secure communication control. The eSIM module 102 conforms to the GSMA SGP.22 specification and supports multi-carrier user identification module profile switching. Note that when a user initiates a secure service, the eSIM module 102 first establishes a 5G secure channel. The eSIM module 102 and the cryptographic security chip 101 work together to generate a dynamic digital identity based on the SM9 identifier cryptographic algorithm issued by the State Cryptography Administration, and bind this dynamic digital identity to the International Mobile Subscriber Identity (IMSI) in the eSIM profile to achieve two-factor authentication of communication identity and digital identity.

[0032] Please note that the cryptographic security chip 101 integrates a Security Module (SE), an SM9 identifier cryptographic algorithm module, an electronic seal engine, a multi-platform digital certificate management unit, and a Trusted Execution Environment (TEE). The eSIM module 102 supports IPv6 network layer authentication. Before establishing a communication session, the cryptographic security chip 101 generates a unique IPv6 interface identifier (IID). This IID is dynamically derived based on the user's digital credit management system credit certificate and the device fingerprint hash value. The eSIM module combines this IID with the prefix assigned by the operator to form a complete IPv6 address and performs network layer verification through the Secure Neighbor Discovery Protocol (SEND). Afterward, the cryptographic security chip 101 signs the Cryptographically Generated Address (CGA) parameter in the SEND protocol and uses the State Cryptography Administration's SM2 elliptic curve public key cryptography algorithm to verify the legitimacy of remote nodes, preventing IPv6 address spoofing and man-in-the-middle attacks. This ensures that all IPv6 communication traffic is encrypted and packetized through the cryptographic security chip's built-in Trusted Execution Environment (TEE), guaranteeing end-to-end security.

[0033] Please refer to Figure 2 , Figure 2 This is a schematic diagram of a global digital authentication terminal device 200 supporting eSIM according to another embodiment of the present invention. Figure 2 As shown, the global digital authentication terminal device 200 supporting eSIM of the present invention further includes a multimodal biosensor 203, a data isolation module 205, and a screen accessory 209. The multimodal biosensor 203 includes a 4K video camera and a behavior feature acquisition unit to perform liveness detection and continuous behavior verification, so that the false recognition rate (FAR) is ≤0.001%.

[0034] For example, the data isolation module 205 of the present invention is configured to encrypt sensitive data and store it in the security module (SE) of the cryptographic security chip 101, and to store non-sensitive data in the general storage area using Advanced Encryption Standard 256-bit (AES-256) encryption, but this is not a limitation of the present invention.

[0035] In addition, the screen accessory 209 in one embodiment of the present invention is a quick-release screen accessory. The quick-release screen accessory adopts a composite structure of magnetic attraction and hot melt adhesive, which allows non-professional users to complete the screen replacement within one minute, and the integrity and security of sensitive data in the password security chip 101 are not affected during the replacement process.

[0036] In another embodiment of the present invention, the screen accessory 209 may be a sapphire screen with high hardness and scratch resistance to ensure that the digital authentication terminal device 200 can be used for a long time without being easily damaged.

[0037] Please note that in another embodiment of the present invention, the multimodal biosensor 203 and the data isolation module 205 may also be integrated into the cryptographic security chip 101 in a software or hardware manner.

[0038] For example, in another embodiment of the present invention, the cryptographic security chip 101 has a circuit breaker mechanism that automatically triggers a hardware-level self-destruct program when physical intrusion or unauthorized access is detected, permanently destroying the private key and sensitive information within the security module (SE) unit. However, this is only one embodiment of the present invention and is not a limitation thereof.

[0039] Please refer to Figure 3 ,like Figure 3 As shown, this invention provides a credit service method based on the aforementioned global digital authentication terminal device supporting eSIM. This credit service method is automatically executed by the internal hardware of the digital authentication terminal device 100, without requiring the user to install any third-party applications. Its core lies in using the cryptographic security chip 101 as the root of trust and decision engine, and the eSIM module 102 as the secure communication channel provider. The two work closely together to complete a five-step loop of "assessment – ​​authentication – signing – evidence storage – compliant transmission".

[0040] The specific steps are as follows: S1, Receive service request and call the five-dimensional credit package to start credit assessment; S2, Dynamic identity generation and eSIM security channel establishment; S3, Electronic signature and multimodal biometric confirmation; S4, Judicial-grade blockchain evidence storage; S5, Data localization and cross-border compliance management.

[0041] In step S1, the present invention can receive user requests for government, financial or cross-border services through a digital credit management interaction engine. The cryptographic security chip 101 will then call the five-dimensional credit package to conduct multi-dimensional credit assessment. The five-dimensional credit package includes a personal credit sub-package (including Bank of China credit summary, real-name authentication status, etc.), an enterprise credit sub-package (including unified social credit code, tax records, etc.), an equipment credit sub-package (including device integrity, SE status, etc.), a digital asset credit sub-package (including digital RMB balance, non-fungible token ownership, etc.), and a behavioral credit sub-package (including historical performance rate, operation frequency, etc.) to support "zero-run, instant approval" fast government services in scenarios such as business establishment, rural subsidy application and micro and small enterprise credit granting.

[0042] If the evaluation result meets the preset threshold, the eSIM module 102 is activated to establish an encrypted communication channel (step S2). For example, if the credit score is ≥ the preset threshold (e.g., 80 points), the cryptographic security chip 101 executes the SM9 identifier cryptographic algorithm to generate a one-time dynamic decentralized identity (DID) using "digital credit management system credit certificate + timestamp + device fingerprint". Then, the eSIM module 102 is triggered to switch to the user identification module configuration file of the corresponding service scenario (e.g., "government service platform" or "cross-border finance"). Then, the DID is bound to the International Mobile Subscriber Identity (IMSI) in the current user identification module configuration file at the hardware layer to form a two-factor token. IPv6 secure communication is started simultaneously, and the cryptographic security chip 101 performs dynamic identity authentication and electronic seal signing (step S3).

[0043] In addition, this invention will synchronize the hash value, biometric verification record and timestamp of the signed content evidence data to the judicial compliance blockchain (step S4). The evidence data includes electronic signature results, 4K face image hash value (China State Cryptography Administration SM3 cryptographic hash algorithm), dynamic DID, IMSI, IPv6 address, and operation timestamp (UTC+8, timed and calibrated by China Beidou satellite navigation system).

[0044] After the data is encrypted using the SM4 block cipher algorithm (China State Cryptography Administration), it is uploaded to the "certificate chain" through the blockchain interface (built into the cryptographic security chip 101). At the same time, it ensures that all sensitive data complies with local regulations for localized control (step S5). The cryptographic security chip 101 automatically performs a security assessment and check. If the data contains "important data" (such as corporate financial reports, personal biometrics, etc.), it is blocked from leaving the country and can only be processed locally. If it is general commercial data (such as order amount, logistics number, etc.), it is encrypted with "SM4 (within China) + AES-256 (outside China)" and then transmitted to the overseas node via the eSIM module 102.

[0045] For example, if a region wants to pilot the "one-license-for-all" reform, firstly, the legal entity can select "enterprise registration" through the digital credit management system. The multimodal biosensor 203 reads the ID card OCR information, the password security chip 101 compares the 4K face, and calls the enterprise credit sub-package (step S1). If the credit score of 92 meets the preset threshold (e.g., 80), the eSIM module 102 is activated to establish an encrypted communication channel, and the system switches to the "regional government 5G service platform user identification module configuration file". The dynamic DID is bound to the IMSI, and the IPv6 channel is established after SEND verification (step S2). The password security chip 101 then electronically signs the company's articles of association (step S3), and then stores the evidence on the blockchain (step S4). The digital authentication terminal device 200 automatically generates a business license PDF and pushes it to the mobile phone (step S5). In this embodiment, the entire operation process can be completed within one minute, and the data is 100% localized with an error rate of <0.001%.

[0046] For example, if used for confirming rural homestead rights, agricultural residents can first scan their household registration book and initiate a "rights confirmation application" through the digital credit management system. The password security chip 101 integrates personal credit sub-packages and behavioral credit sub-packages (including social security records over the years, etc.) (step S1). If the credit score of 90 meets the preset threshold (e.g., 80), the eSIM module 102 is activated to connect to the China Telecom "Digital Village" service platform (step S2). On the screen displayed on the sapphire screen 209, the user clicks the security key to confirm (step S3). The signed record can then be uploaded to the blockchain and synchronized to the local natural resources bureau (step S4). The subsidy can then be directly transferred to the digital RMB wallet through government operations (step S5).

[0047] For another example, if a cross-border e-commerce business requires real-time financing, the user first selects "Financing Application" in the backend. The password security chip 101 integrates a five-dimensional credit package (including customs import and export data, platform sales records, etc.) (step S1). The credit model outputs a credit line of 500,000 RMB (meeting the preset threshold). The eSIM module 102 then switches to the "Cross-border Financial User Identification Module Configuration File" (step S2). For example, if the cooperating operator is the Paris branch of the Bank of China, the eSIM module 102 establishes an IPv6 secure channel to the French risk control server and supports mutual recognition of the EU's Electronic Identification, Authentication and Trust Services (eIDAS). Then, the loan contract is electronically signed (step S3), and the evidence is stored on the blockchain (step S4). After that, the funds can be disbursed to the digital RMB wallet within seconds (step S5). In this way, the effect of "instant approval and instant loan" for cross-border e-commerce can be achieved.

[0048] This invention stores sensitive data in a hardware-level security module to support China's data localization requirements, while also ensuring cross-border GDPR compliance. It incorporates a built-in electronic seal engine targeting compliant countries, with signature records synchronously uploaded to the blockchain, possessing legal validity. This invention enables "zero-contact, instant approval" fast government services in scenarios such as government affairs, finance, and rural areas, allowing business registration to be completed in as little as one minute. This invention provides direct access to services through its built-in digital credit management system without requiring a third-party app, avoiding privacy leaks and data misuse. This invention provides a comprehensive, secure, reliable, efficient, and low-cost integrated digital authentication and credit service.

[0049] The embodiments of the present invention described above can be implemented in various hardware, software codes, or combinations thereof. For example, embodiments of the present invention can also be program code executing the above methods in a Digital Signal Processor (DSP). The present invention can also relate to various functions executed by a computer processor, digital signal processor, microprocessor, or Field Programmable Gate Array (FPGA). The processor described above can be configured to perform specific tasks according to the present invention, which are accomplished by executing machine-readable software code or firmware code defining the specific methods disclosed in the present invention. The software code or firmware code can be developed into different programming languages ​​and different formats or forms. The software code can also be compiled for different target platforms. However, the different code styles, types, and languages ​​of the software code performing tasks according to the present invention and other types of configuration code do not depart from the spirit and scope of the present invention.

[0050] Therefore, those skilled in the art should recognize that although embodiments of the present invention have been shown and described in detail herein, many other variations or modifications conforming to the principles of the present invention can be directly determined or derived from the disclosure of the present invention without departing from the spirit and scope of the invention. Thus, the scope of the present invention should be understood and recognized as covering all such other variations or modifications.

Claims

1. A global digital authentication terminal device supporting eSIM, comprising: A cryptographic security chip is used to perform global digital identity authentication, credit storage and secure communication control. The cryptographic security chip has a built-in security module, SM9 identifier cryptographic algorithm module, electronic seal engine, multi-platform digital certificate management unit and trusted execution environment. One eSIM module, compliant with the GSM Association SGP.22 specification, supports switching between multiple operator user identification module configuration files; The eSIM module works in conjunction with the cryptographic security chip. When a user initiates a security service, the cryptographic security chip generates a dynamic digital identity based on the SM9 identifier cryptographic algorithm and binds this identity to the International Mobile Subscriber Identity in the eSIM configuration file to achieve two-factor authentication of communication identity and digital identity.

2. The global digital authentication terminal device supporting eSIM according to claim 1, characterized in that, The eSIM module further supports IPv6 network layer authentication, including: Before establishing a communication session, the cryptographic security chip generates a unique IPv6 interface identifier, which is dynamically derived based on the user's digital credit management system credit certificate and the device fingerprint hash value. The eSIM module combines the interface identifier with the prefix assigned by the operator to form a complete IPv6 address, and performs network layer verification through the secure neighbor discovery protocol. The cryptographic security chip signs the encrypted generated address parameters in the SEND protocol and uses the SM2 elliptic curve public key cryptography algorithm to verify the legitimacy of the remote node, preventing IPv6 address spoofing and man-in-the-middle attacks. All IPv6 communication traffic is encrypted and packaged through the Trusted Execution Environment built into the cryptographic security chip to ensure end-to-end security.

3. The global digital authentication terminal device supporting eSIM according to claim 1, characterized in that: It also includes a multimodal biosensor, which includes a 4K video camera and a behavioral feature acquisition unit for performing liveness detection and continuous behavior verification.

4. The global digital authentication terminal device supporting eSIM according to claim 1, characterized in that, It also includes a screen accessory, which is a quick-release screen accessory and adopts a composite structure of magnetic attraction and hot melt adhesive.

5. The global digital authentication terminal device supporting eSIM according to claim 1, characterized in that: It also includes a screen accessory, which is a sapphire screen.

6. The global digital authentication terminal device supporting eSIM according to any one of claims 1 to 5, characterized in that: It also includes a data isolation module, which is configured to encrypt sensitive data and store it in the security module of the cryptographic security chip, and store non-sensitive data in a general storage area using Advanced Encryption Standard 256-bit encryption.

7. The global digital authentication terminal device supporting eSIM according to any one of claims 1 to 5, characterized in that, The cryptographic security chip further features a circuit breaker mechanism. When a physical intrusion or unauthorized access is detected, a hardware-level self-destruct program is automatically triggered to permanently destroy the private key and sensitive information within the security module unit.

8. The global digital authentication terminal device supporting eSIM according to claim 6, characterized in that, The cryptographic security chip further features a circuit breaker mechanism. When a physical intrusion or unauthorized access is detected, a hardware-level self-destruct program is automatically triggered to permanently destroy the private key and sensitive information within the security module unit.

9. A credit service method applied to a globally digitally authenticated terminal device supporting eSIM as described in any one of claims 1 to 8, comprising the following steps: S1. Receive the service request and invoke the five-dimensional credit package to initiate a credit assessment; S2, Dynamic Identity Generation and eSIM Secure Channel Establishment; S3, Electronic signatures and multimodal biometric verification; S4, judicial-grade blockchain evidence storage; S5, Data Localization and Cross-border Compliance Management.

10. The credit service method according to claim 9, characterized in that, The five-dimensional credit package includes: a personal credit sub-package, a corporate credit sub-package, a device credit sub-package, a digital asset credit sub-package, and a behavioral credit sub-package.

Images