Quantum key based profile management method and profile management system

Abstract

This application provides a configuration file management method and system based on quantum key distribution, comprising: an eSIM data management platform coordinating two-way authentication between an eSIM terminal and a quantum key management platform; upon completion, the eSIM data management platform and the eSIM terminal establish a first secure communication channel and send a configuration file request to the SM-DP+ platform, receiving the returned target configuration file; the eSIM data management platform encrypts the target configuration file to obtain an encrypted configuration file; a message authentication code is generated based on the target message authentication key; the encrypted configuration file and the message authentication code are encapsulated into encapsulated configuration file data, and the encapsulated configuration file data is sent to the eSIM terminal; the eSIM terminal decrypts the received encrypted configuration file to recover and save the target configuration file. This method can improve the confidentiality, integrity, and tamper resistance of configuration files during download and transmission.

Description

Technical Field

[0001] This application relates to the field of eSIM terminal communication technology, and in particular to a configuration file management method and configuration file management system based on quantum key distribution. Background Technology

[0002] With the rapid growth of IoT devices, eSIM technology is widely used in smartphones, smart wearables, and industrial terminals to enable remote configuration and device access management. In this scenario, eSIM terminals typically download configuration files from a data platform to activate communication functions.

[0003] Existing methods for downloading and managing eSIM profiles primarily rely on traditional encryption techniques to ensure data integrity and transmission security, such as symmetric key encryption or public key infrastructure for authentication and data encryption / decryption. However, on the one hand, the key negotiation process is vulnerable to man-in-the-middle attacks and is difficult to defend against the cracking threats posed by quantum computing; on the other hand, profiles are easily intercepted, tampered with, or replayed during transmission or storage, leading to potential identity forgery or data leakage. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a configuration file management method and configuration file management system based on quantum keys. By using two-way authentication between the quantum key management platform and the eSIM terminal, and using quantum key blocks for key derivation and verification during the authentication process, it can ensure that the session key is generated only between the authenticated trusted parties, thereby preventing man-in-the-middle attacks and key leakage, and thus improving the confidentiality, integrity and anti-tampering capability of the configuration file during download and transmission.

[0005] In a first aspect, the present invention provides a configuration file management method based on quantum key distribution, applied to a configuration file management system. The configuration file management system includes an eSIM data management platform, an eSIM terminal, and a quantum key management platform, wherein the eSIM data management platform is communicatively connected to both the eSIM terminal and the quantum key management platform. The method includes: the eSIM data management platform coordinating two-way authentication between the eSIM terminal and the quantum key management platform based on the eSIM terminal's identity identifier, so that the eSIM terminal and the quantum key management platform negotiate and generate a target session key for encrypted data transmission and a target message authentication key for integrity verification; after completing the two-way authentication, the eSIM data management platform establishes a connection with the eSIM terminal based on the target session key. The first secure communication channel is used to send a configuration file request to the SM-DP+ platform based on the identity identifier and receive the target configuration file returned by the SM-DP+ platform. The eSIM data management platform encrypts the target configuration file based on the target session key to obtain an encrypted configuration file. It generates a corresponding message authentication code based on the target message authentication key. The eSIM data management platform encapsulates the encrypted configuration file and the message authentication code into encapsulated configuration file data and sends the encapsulated configuration file data to the eSIM terminal through the first secure communication channel. The eSIM terminal performs integrity verification on the encapsulated configuration file data based on the target message authentication key. If the verification result is successful, the eSIM terminal decrypts the received encrypted configuration file based on the target session key to restore and save the target configuration file.

[0006] In an optional implementation, the eSIM terminal includes an identity protection proxy module; the eSIM data management platform coordinates the two-way identity authentication steps between the eSIM terminal and the quantum key management platform based on the identity identifier of the eSIM terminal, including: the identity protection proxy module sending an authentication request to the eSIM data management platform; the authentication request including the identity identifier; the eSIM data management platform forwarding the identity identifier to the quantum key management platform so that the quantum key management platform performs a first identity authentication on the eSIM terminal; if the first identity authentication is successful, the quantum key management platform initiates a second identity authentication on the eSIM terminal through the eSIM data management platform.

[0007] In an optional implementation, the eSIM terminal further includes an embedded user identification module communicatively connected to the identity protection agent module; the step of the quantum key management platform performing first identity authentication on the eSIM terminal includes: the quantum key management platform generating key index information and a first random number based on the identity identifier, and sending the key index information and the first random number to the identity protection agent module through the eSIM data management platform; the identity protection agent module sending the key index information and the first random number to the embedded user identification module; the embedded user identification module extracting a first authentication key from a preset quantum key block according to the key index information, and generating a second random number; the embedded user identification module then performing first authentication based on the first random number and the second random number. The first authentication value is generated using the first authentication key and a preset message authentication key algorithm, and the authentication count is incremented by 1. The identity protection agent module sends the second random number, the first authentication value, and the authentication count to the quantum key management platform through the eSIM data management platform. After receiving the second random number, the first authentication value, and the authentication count, the quantum key management platform determines the quantum key block copy corresponding to the eSIM terminal based on the key index information and extracts the second authentication key from the quantum key block copy. The quantum key management platform generates a copy of the first authentication value based on the first random number, the second random number, the second authentication key, and the preset message authentication key algorithm. If the copy of the first authentication value matches the first authentication value, the first identity authentication is confirmed to be successful.

[0008] In an optional implementation, if the first identity authentication is successful, the step of the quantum key management platform performing a second identity authentication with the eSIM terminal through the eSIM data management platform includes: the quantum key management platform performing a key derivation operation on the quantum key block copy based on the authentication count value to generate an initial session key and an initial message authentication key; the quantum key management platform encrypting a first random number based on the initial session key to generate a first verification key; encrypting a second random number based on the initial message authentication key to generate a second verification key; the quantum key management platform sending the initial session key, the initial message authentication key, the first verification key, and the second verification key to the eSIM data management platform; and the eSIM data management platform saving the initial session key and the initial message authentication key, and sending the first verification key and the second verification key to the eSIM data management platform. The process is forwarded to the identity protection agent module; the identity protection agent module sends the first verification key and the second verification key to the embedded user identification module; after receiving the first verification key and the second verification key, the embedded user identification module performs a key derivation operation on the quantum key block based on the authentication count value to generate an initial session key copy and an initial message authentication key copy; the embedded user identification module encrypts the first random number based on the initial session key copy to generate a first verification key copy; it encrypts the second random number based on the message authentication key copy to generate a second verification key copy; if the first verification key copy is consistent with the first verification key, and the second verification key copy is consistent with the second verification key, the second identity authentication is determined to be successful, and the initial session key is the target session key, and the initial message authentication key is the target message authentication key.

[0009] In an optional implementation, during the embedded user identification module production stage, the method for setting the quantum key block includes: the quantum key management platform generates a corresponding quantum key block for the received initial identity identifier, and sends the quantum key block to the quantum key injection tool, so that the quantum key injection tool writes the quantum key block into the corresponding embedded user identification module; wherein, the quantum key injection tool is communicatively connected to both the quantum key management platform and the eSIM terminal; the initial identity identifier is generated by the quantum key injection tool after reading the embedded user identification module of the eSIM terminal.

[0010] In an optional implementation, the step of the eSIM terminal performing integrity verification on the encapsulated configuration file data based on the target message authentication key includes: the eSIM terminal generating a message authentication code copy based on the target message authentication key, and determining whether the message authentication code copy is consistent with the received message authentication code; if consistent, determining that the verification result of the encapsulated configuration file data is that the verification is successful.

[0011] In an optional implementation, after the eSIM terminal performs integrity verification on the encapsulated configuration file data based on the target message authentication key, and if the verification result is successful, decrypts the received encrypted configuration file based on the target session key to restore and save the target configuration file, the method further includes: the eSIM terminal destroys the target session key after completing the decryption to close the first secure communication channel.

[0012] In an optional implementation, the eSIM terminal includes an identity protection proxy module and an embedded user identification module connected via communication; the method further includes: the identity protection proxy module, in response to received configuration file activation information, sends an activation request to the eSIM data management platform to establish a second secure communication channel with the eSIM data management platform; the configuration file activation information includes configuration file information to be activated; after the second secure communication channel is established, the eSIM data management platform generates an activation command based on the configuration file activation information and sends the activation command to the identity protection proxy module through the secure communication channel; the identity protection proxy module, based on the received activation command, instructs the embedded user identification module to activate the configuration file corresponding to the configuration file information to be activated.

[0013] In a second aspect, the present invention provides a configuration file management system for executing the quantum key-based configuration file management method of any of the foregoing embodiments; the configuration file management system includes an eSIM data management platform, an eSIM terminal, and a quantum key management platform; the eSIM data management platform is communicatively connected to the eSIM terminal and the quantum key management platform, respectively.

[0014] In an optional implementation, the eSIM terminal includes an identity protection proxy module for communication connectivity and an embedded user identification module.

[0015] This application provides a quantum key-based configuration file management method and system. By coordinating two-way authentication between the quantum key management platform and the eSIM terminal through an eSIM data management platform, the authenticity verification of the identity and the security of key negotiation during configuration file transmission can be ensured, thereby preventing man-in-the-middle attacks and identity forgery risks. The target session key and target message authentication key negotiated during the authentication process ensure the confidentiality and integrity of the configuration file during transmission, thereby reducing the risk of the configuration file being stolen, tampered with, or replayed. By establishing a secure communication channel between the eSIM data management platform and the eSIM terminal to transmit encrypted configuration files and authentication data, and performing local decryption and verification operations upon receipt, end-to-end security protection of the configuration file can be achieved. Furthermore, this application can improve the quantum-resistant security, data protection capabilities, and identity authentication strength in the eSIM configuration file management process, and is widely applicable to eSIM deployment scenarios with high security requirements, such as the Internet of Things, industrial terminals, and wearable devices, demonstrating universality.

[0016] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application.

[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 A schematic diagram of the configuration file management system provided in this application embodiment; Figure 2 This is a schematic diagram of another configuration file management system provided in an embodiment of this application; Figure 3 A flowchart of a quantum key-based configuration file management method provided in an embodiment of this application.

[0020] Icons: 1-eSIM data management platform; 2-eSIM terminal; 3-quantum key management platform; 21-identity protection agent module; 22-embedded user identification module. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] To facilitate understanding of this embodiment, the embodiments of this application will be described in detail below.

[0023] In existing technologies, eSIM configuration files are primarily distributed to eSIM terminals through the SM-DP+ platform (Subscription Manager Data Preparation platform), typically employing symmetric encryption or PKI (Public Key Infrastructure)-based authentication to ensure data transmission security. However, these encryption mechanisms have significant shortcomings.

[0024] First, traditional key exchange protocols (such as Diffie-Hellman (Diffie-Hellman Key Exchange) or TLS (Transport Layer Security) handshakes) are vulnerable to man-in-the-middle attacks and their security is significantly weakened when faced with quantum computing capabilities, making it difficult to meet future quantum-resistant security requirements.

[0025] Secondly, configuration files are easily intercepted, replayed, or tampered with during transmission. Existing mechanisms lack anti-tampering protection measures based on dynamic key derivation and two-way verification, making it difficult to prevent identity forgery or configuration file contamination.

[0026] Furthermore, eSIM terminals and the SM-DP+ platform typically only establish a one-way verification mechanism. The SM-DP+ platform cannot perform strong verification of the authenticity of the eSIM terminal, which poses a risk of spoofing the terminal to download illegal configuration files.

[0027] To address this, this application proposes a quantum key-based configuration file management method and system. By performing two-way authentication using quantum keys during the download and transmission of eSIM configuration files, the eSIM terminal and the quantum key management platform establish an authentication relationship through identity identifiers and negotiate and generate a target session key and a target message authentication key based on a pre-set quantum key block. After authentication, the eSIM data management platform encrypts the configuration file based on the target session key and generates a corresponding message authentication code based on the target message authentication key. The encryption result and authentication code are then encapsulated and sent to the eSIM terminal through a secure channel. The eSIM terminal decrypts and imports the configuration file after verifying the consistency of the authentication code, thereby ensuring the confidentiality and integrity of the configuration file during transmission, effectively resisting risks such as quantum hacking, man-in-the-middle attacks, and data replay, and improving the security and reliability of the configuration file management system in a quantum environment.

[0028] The technical solution provided in this application will be described in detail below.

[0029] This application provides a configuration file management system, referring to... Figure 1 As shown, the configuration file management system includes an eSIM data management platform 1, an eSIM terminal 2, and a quantum key management platform 3; the eSIM data management platform 1 is communicatively connected to the eSIM terminal 2 and the quantum key management platform 3, respectively.

[0030] Specifically, the quantum key management platform 3 is used to manage the quantum key information associated with each eSIM terminal and to perform identity authentication and key derivation.

[0031] The eSIM data management platform 1 is used to handle specific business logic related to the eSIM lifecycle, such as triggering authentication, requesting configuration files, and issuing activation commands. The eSIM data management platform 1 communicates with both the eSIM terminal 2 and the quantum key management platform 3, acting as a communication intermediary in the authentication process between the two.

[0032] eSIM terminal 2 can be any IoT device or smart terminal that integrates eSIM functionality, such as smart cameras, wearable devices, industrial sensors, etc.

[0033] In one embodiment, reference is made to Figure 2 The eSIM terminal 2 includes an identity protection agent module 21 for communication connection and an embedded user identification module 22.

[0034] The embedded Subscriber Identity Module 22 (eSIM module) is a secure chip soldered inside the terminal. It is used not only to store and manage the operator's configuration files, but also to securely store a quantum key block pre-configured during production and bound to the terminal's unique EID (Euicc Identity). All sensitive cryptographic operations involving this quantum key are performed within the secure environment of this module.

[0035] The Identity Protection Agent module 21 (IPA module) serves as a secure communication proxy between the embedded user identification module 22 and external systems. It is responsible for encapsulating and parsing communication messages, processing data transmission with the eSIM data management platform 1, and interacting with the embedded user identification module 22 according to instructions.

[0036] Specifically, the pre-setting of quantum key blocks is typically completed on the production line of the embedded user identification module 22. The quantum key injection tool on the production line first reads the unique identifier (EID) of each embedded user identification module 22. The quantum key injection tool communicates with the quantum key management platform 3 via a secure communication link (e.g., mTLS (Mutual Transport Layer Security)) and sends the EID to the quantum key management platform 3. Based on the EID, the quantum key management platform 3 uses quantum key distribution technology or a certified quantum random number source to generate a sufficiently long quantum key block (8KB or longer) with high security strength. This quantum key block is sent back to the injection tool and securely written into the tamper-proof storage area inside the corresponding embedded user identification module 22. Once written, the quantum key block is configured by hardware mechanisms to be unreadable from the outside, ensuring confidentiality.

[0037] Based on the above embodiments, this application provides a configuration file management method based on quantum key distribution, referring to... Figure 3 As shown in the embodiments of this application, the flow of the configuration file management method based on quantum key distribution is as follows: In step S101, the eSIM data management platform coordinates two-way identity authentication between the eSIM terminal and the quantum key management platform based on the identity identifier of the eSIM terminal, so that the eSIM terminal and the quantum key management platform negotiate to generate a target session key for encrypting data transmission and a target message authentication key for integrity verification.

[0038] In one embodiment, step S101 includes the following steps S201-S203.

[0039] Step S201: The identity protection agent module sends an authentication request to the eSIM data management platform; the authentication request includes an identity identifier.

[0040] Here, when the eSIM terminal needs to perform a security operation (such as initial configuration or downloading a configuration file), the identity protection agent module obtains the terminal's unique identifier EID from the embedded user identification module, then constructs an authentication request message, and sends the authentication request to the eSIM data management platform through a secure network connection (such as HTTPS (Hypertext Transfer Protocol Secure)).

[0041] In step S202, the eSIM data management platform forwards the identity identifier to the quantum key management platform so that the quantum key management platform can perform the first identity authentication on the eSIM terminal.

[0042] In one embodiment, step S202 specifically includes the following steps S301-S307.

[0043] In step S301, the quantum key management platform generates key index information and a first random number based on the identity identifier, and sends the key index information and the first random number to the identity protection agent module through the eSIM data management platform.

[0044] Here, after the eSIM data management platform forwards the eSIM terminal's EID to the quantum key management platform, the quantum key management platform generates an authentication challenge packet. This authentication challenge packet includes: The key index information is used to indicate which part of its pre-set quantum key block the eSIM terminal should use for this authentication calculation.

[0045] The first random number A is used to ensure the freshness of each authentication session and prevent attackers from launching attacks by pre-computing or replaying old authentication information.

[0046] The authentication challenge packet is sent by the quantum key management platform, forwarded by the eSIM data management platform, and finally received by the identity protection agent module of the eSIM terminal.

[0047] In step S302, the identity protection agent module sends the key index information and the first random number to the embedded user identification module.

[0048] Here, after receiving the authentication challenge packet, the identity protection agent module will pass the key index information index and the first random number A in the authentication challenge packet to the embedded user identification module.

[0049] In step S303, the embedded user identification module extracts the first authentication key from the preset quantum key block according to the key index information and generates a second random number.

[0050] Here, the embedded user identification module uses the received key index information as a pointer or offset to locate and read a byte sequence of a predetermined length (e.g., 16 bits) from the quantum key block stored internally, as the first authentication key used for this authentication.

[0051] To achieve two-way authentication, the embedded user identification module also needs to generate its own random number (second random number B). The second random number B is used to ensure the freshness of each authentication session and prevent attackers from launching attacks by pre-compiling or replaying old authentication information.

[0052] In one embodiment, during the production stage of the embedded user identification module, the method for setting the quantum key block includes: The quantum key management platform generates a corresponding quantum key block for the received initial identity identifier and sends the quantum key block to the quantum key injection tool, so that the quantum key injection tool writes the quantum key block into the corresponding embedded user identification module; wherein, the quantum key injection tool is communicatively connected to both the quantum key management platform and the eSIM terminal; the initial identity identifier is generated by the quantum key injection tool after reading the embedded user identification module of the eSIM terminal.

[0053] Specifically, the embedded user identification module is assigned a unique EID at the factory. After establishing a connection with the eSIM terminal, the quantum key injection tool reads the EID. Once the EID is read, the quantum key injection tool sends it as a request parameter to the quantum key management platform through a secure communication link.

[0054] Upon receiving a request, the quantum key management platform first verifies whether the request originates from a legitimate and trusted quantum key injection tool. If the verification is successful, the quantum key management platform generates a corresponding quantum key block for this EID. The quantum key block can be distributed via quantum key distribution (QKD). Quantum key distribution The random numbers are generated in real time by the network or obtained from a certified quantum random number generator to ensure that they have true randomness and high security strength.

[0055] The quantum key management platform establishes a one-to-one, permanent binding relationship between the EID and the generated quantum key block in its internal security database.

[0056] The quantum key management platform sends the generated quantum key block to the quantum key injection tool through a secure channel established between the platform and the injection tool.

[0057] After receiving a quantum key block, the quantum key injection tool writes the quantum key block into a pre-defined non-volatile memory area inside the embedded user identification module through a physical connection with the eSIM terminal.

[0058] To ensure absolute security of the key, once the quantum key block is written, the hardware access permissions for its storage area are configured to either write only once or allow access only by the internal cryptographic engine.

[0059] In step S304, the embedded user identification module generates a first authentication value based on the first random number, the second random number, the first authentication key, and the preset message authentication key algorithm, and increments the authentication count value by 1.

[0060] Here, the first authentication key, the received first random number A, and the locally generated second random number B are used as inputs to a preset Message Authentication Code (MAC) algorithm for computation. The output is the first authentication value X. Simultaneously, to prevent replay attacks and provide a basis for subsequent key derivation, the module's internal authentication counter is incremented by 1. The MAC algorithm can be AES (Advanced Encryption Standard) or SM4 (SM4 Block Cipher Algorithm), among others.

[0061] In step S305, the identity protection agent module sends the second random number, the first authentication value, and the authentication count value to the quantum key management platform through the eSIM data management platform.

[0062] Here, after the eSIM terminal completes the calculation, it sends the second random number B, the first authentication value X, and the updated authentication count value counter back to the quantum key management platform through the identity protection agent module and the eSIM data management platform.

[0063] In step S306, after receiving the second random number, the first authentication value, and the authentication count value, the quantum key management platform determines the quantum key block copy corresponding to the eSIM terminal based on the key index information, and extracts the second authentication key from the quantum key block copy.

[0064] Here, the quantum key management platform locates the corresponding quantum key block copy in its database based on the EID, and extracts the authentication key using the same key index information as the terminal. The second authentication key is cryptographically identical to the first authentication key.

[0065] In step S307, the quantum key management platform generates a copy of the first authentication value based on the first random number, the second random number, the second authentication key, and the preset message authentication key algorithm. If the copy of the first authentication value is consistent with the first authentication value, the first identity authentication is confirmed to be successful.

[0066] Here, the quantum key management platform uses its own stored first random number A, the received second random number B, and the extracted second authentication key to execute the same message authentication code algorithm as the terminal, thereby calculating a copy of the first authentication value.

[0067] The copy of the first authentication value is compared bit by bit with the first authentication value received from the terminal.

[0068] If the two are completely consistent, the quantum key management platform can determine that the response comes from a legitimate eSIM terminal with the correct quantum key and authentication count value, and the first identity authentication is confirmed to be successful.

[0069] Step S203: If the first identity authentication is successful, the quantum key management platform initiates the second identity authentication to the eSIM terminal through the eSIM data management platform.

[0070] In one embodiment, step S203 specifically includes the following steps S401-S408.

[0071] In step S401, the quantum key management platform performs a key derivation operation on the quantum key block copy based on the authentication count value to generate an initial session key and an initial message authentication key.

[0072] Here, after confirming the validity of the eSIM terminal's identity, the quantum key management platform generates an initial session key for encryption and an initial message authentication key for integrity verification based on the authentication count value counter, the quantum key block copy corresponding to the terminal's EID, and the preset key derivation function.

[0073] Specifically, the authentication count value counter is concatenated and padded with a first preset identifier (e.g., binary string 01), and an initial session key P is generated after hashing or pseudo-random function operation; at the same time, the authentication count value counter is concatenated and padded with a second preset identifier (e.g., binary string 02), and an initial message authentication key Q is generated after hashing or pseudo-random function operation.

[0074] In step S402, the quantum key management platform encrypts the first random number based on the initial session key to generate the first verification key; and encrypts the second random number based on the initial message authentication key to generate the second verification key.

[0075] Here, based on the initial session key P, the first random number A and / or the second random number B are encrypted using a preset symmetric encryption algorithm (such as AES) to obtain the first verification key E.

[0076] Based on the initial message authentication key Q, the ciphertext value E (or other agreed-upon data) is calculated using a preset message authentication code algorithm to obtain the second verification key F.

[0077] In step S403, the quantum key management platform sends the initial session key, the initial message authentication key, the first verification key, and the second verification key to the eSIM data management platform.

[0078] In step S404, the eSIM data management platform saves the initial session key and the initial message authentication key, and forwards the first verification key and the second verification key to the identity protection agent module.

[0079] In step S405, the identity protection agent module sends the first verification key and the second verification key to the embedded user identification module.

[0080] In step S406, after receiving the first verification key and the second verification key, the embedded user identification module performs a key derivation operation on the quantum key block based on the authentication count value to generate an initial session key copy and an initial message authentication key copy.

[0081] Here, upon receiving E and F, the embedded user identification module performs the exact same key derivation operation as the quantum key management platform. Based on the authentication count and its pre-set quantum key block, the embedded user identification module calculates its local initial session key copy p and initial message authentication key copy q using the same key derivation function.

[0082] In step S407, the embedded user identification module encrypts the first random number based on the initial session key copy to generate a first verification key copy; and encrypts the second random number based on the message authentication key copy to generate a second verification key copy.

[0083] Here, the embedded user identification module, based on the locally derived key copies p and q, performs the same encryption and message authentication code calculations as the quantum key management platform on the first random number A and the second random number B stored therein, to obtain a locally computed first verification key copy e and a second verification key copy f.

[0084] The calculated e is compared with the received E, and the calculated f is compared with the received F.

[0085] Step S408: If the first verification key copy is consistent with the first verification key, and the second verification key copy is consistent with the second verification key, the second identity authentication is confirmed to be successful, and the initial session key is the target session key, and the initial message authentication key is the target message authentication key.

[0086] If both sets of values ​​are completely identical, it proves that the quantum key management platform has the correct quantum key information and authentication count value. At this time, the eSIM terminal confirms that the identity of the quantum key management platform is real and valid, that is, the second identity authentication is successful.

[0087] At the same time, P (or p) and Q (or q) are determined as the target session key and target message authentication key for subsequent communication.

[0088] If there is a discrepancy, terminate all subsequent operations.

[0089] In step S102, after completing two-way authentication, the eSIM data management platform establishes a first secure communication channel with the eSIM terminal based on the target session key, sends a configuration file request to the SM-DP+ platform based on the identity identifier, and receives the target configuration file returned by the SM-DP+ platform.

[0090] Here, after successful two-way authentication, the quantum key management platform provides the derived target session key and target message authentication key to the eSIM data management platform via a secure internal link. At this point, both the eSIM data management platform and the eSIM terminal possess the same set of keys for encryption and verification. All subsequent communication between the eSIM data management platform and the eSIM terminal will be protected using this set of keys; this protected communication state constitutes the first secure communication channel.

[0091] Under the first secure communication channel, the eSIM data management platform can initiate a configuration file request to the SM-DP+ platform based on the terminal's identity and receive the returned target configuration file.

[0092] The SM-DP+ platform generates an eSIM profile according to operator policies and the GSMA SGP.21 / 22 standard, including operator identification, network access parameters, security credentials, and other information. The generated profile is securely stored, and its version and lifecycle status are maintained. Upon receiving a legitimate terminal request, the corresponding profile is distributed through a secure channel.

[0093] In step S103, the eSIM data management platform encrypts the target configuration file based on the target session key to obtain the encrypted configuration file; and generates the corresponding message authentication code based on the target message authentication key.

[0094] Here, the eSIM data management platform calls a preset symmetric encryption algorithm (such as AES), uses the target session key as the key, and encrypts the original target configuration file to obtain an encrypted configuration file.

[0095] The eSIM data management platform calls a preset message authentication code algorithm, uses the target message authentication key as the key, and calculates the message authentication code on the encrypted configuration file.

[0096] In step S104, the eSIM data management platform encapsulates the encrypted configuration file and message authentication code into encapsulated configuration file data, and sends the encapsulated configuration file data to the eSIM terminal through the first secure communication channel.

[0097] Here, the eSIM data management platform packages the encrypted configuration file and its corresponding message authentication code into a data structure, that is, encapsulates the configuration file data, and sends it to the eSIM terminal through the network.

[0098] In step S105, the eSIM terminal performs integrity verification on the encapsulated configuration file data based on the target message authentication key. If the verification result is successful, the received encrypted configuration file is decrypted based on the target session key to restore and save the target configuration file.

[0099] Here, the eSIM terminal parses and separates the encrypted configuration file and message authentication code from the received encapsulation configuration file data.

[0100] In one embodiment, step S105, the step of the eSIM terminal performing integrity verification on the encapsulated configuration file data based on the target message authentication key, includes: The eSIM terminal generates a copy of the message authentication code based on the target message authentication key and determines whether the copy of the message authentication code is consistent with the received message authentication code; if they are consistent, the verification result of the encapsulated configuration file data is determined to be successful.

[0101] Here, the eSIM terminal uses its locally derived target message authentication key to perform the same message authentication code calculation as the platform on the received encrypted configuration file, resulting in a copy of the message authentication code. Then, the copy of the message authentication code is compared with the received authentication code.

[0102] If the comparison matches, the verification result is considered successful, proving that the data has not been tampered with during transmission. At this point, the eSIM terminal uses its locally derived target session key to decrypt the encrypted configuration file, recover the original target configuration file, and save it to the embedded user identification module.

[0103] If the comparison does not match, the eSIM terminal discards the data packet, determines that the communication has been attacked or disrupted, and terminates all subsequent operations.

[0104] In one embodiment, after step S105, the method further includes: After completing decryption, the eSIM terminal destroys the target session key to close the first secure communication channel.

[0105] Here, once a task (e.g., this configuration file download) has been successfully completed, the temporary keys used to protect the task (i.e., the target session key and the target message authentication key) are destroyed.

[0106] Specifically, the embedded user identification module overwrites the target session key and target message authentication key stored in memory or temporary registers once or multiple times with all zeros, all ones, or random data to ensure that the key materials cannot be recovered through any memory analysis or cold start attack.

[0107] In a complete implementation, not only should the eSIM terminal destroy its keys, but the eSIM data management platform should also destroy the same set of keys it has stored for this session after confirming the end of the session (e.g., upon receiving a successful confirmation message from the terminal or after a scheduled timeout).

[0108] In one embodiment, the method further includes the following steps S501-S503.

[0109] In step S501, the identity protection agent module responds to the received configuration file activation information by sending an activation request to the eSIM data management platform to establish a second secure communication channel with the eSIM data management platform; the configuration file activation information includes the configuration file information to be activated.

[0110] Here, the user selects a downloaded but inactive profile on the eSIM terminal's settings interface or through a companion management application and clicks the activation button to initiate the activation process. This profile activation information is then passed to the identity protection agent module as a trigger signal to initiate the activation process.

[0111] The identity protection agent module will re-initiate an authentication session with the eSIM data management platform to activate the configuration file. The entire process is exactly the same as the authentication during the initial configuration file download. This communication state, protected by the new key pair, constitutes the second secure communication channel.

[0112] In step S502, after the second secure communication channel is established, the eSIM data management platform generates an activation command based on the configuration file activation information and sends the activation command to the identity protection agent module through the secure communication channel.

[0113] Here, after the second secure communication channel is established, the eSIM data management platform encapsulates the activation request, which includes the identifier of the configuration file to be activated, into an activation command. The activation command is encrypted based on the newly generated key pair and then sent to the identity protection agent module of the eSIM terminal via the network.

[0114] In step S503, the identity protection agent module, based on the received activation instruction, instructs the embedded user identification module to activate the configuration file corresponding to the configuration file information to be activated.

[0115] Here, after receiving the data, the identity protection agent module passes it to the embedded user identification module. The embedded user identification module first uses the new key to perform integrity verification and decryption of the instruction. After confirming that the instruction source is reliable and its content is correct, it performs an internal state switching operation, setting the configuration file specified in the instruction to the active state.

[0116] Once the embedded user identification module successfully activates the configuration file, the eSIM terminal's communication module can use the network credentials in the configuration file to register with the corresponding mobile network and begin data transmission and service access.

[0117] The quantum key-based configuration file management method provided in this application allows eSIM terminals and eSIM data management platforms to establish a temporary, task-specific secure channel by invoking the quantum key management platform to perform an authentication and key derivation process for any continuous data communication requiring security. All data transmitted within this channel is encrypted using the session key generated in this instance, and this session key is immediately destroyed by both communicating parties after data transmission is complete, ensuring long-term security and confidentiality of the communication.

[0118] The computer-readable storage medium provided in the embodiments of this application is described below. The computer-readable storage medium provided in the embodiments of this application stores computer instructions, which, when executed by a processor, implement the human-machine interface device login method provided in the embodiments of this application. In specific implementation, the computer instructions can be built into or installed in the processor, so that the processor can implement the human-machine interface device login method provided in the embodiments of this application by executing the built-in or installed computer instructions.

[0119] In addition, the human-machine interface device login method provided in the embodiments of this application can also be implemented as a computer program product. The computer program product includes program code, which implements the human-machine interface device login method provided in the embodiments of this application when running on a processor.

[0120] The computer program product provided in this application embodiment may employ one or more computer-readable storage media, which may be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. Specifically, more specific examples (a non-exhaustive list) of computer-readable storage media include electrical connections with one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM), optical fibers, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0121] The computer program product provided in this application embodiment can be a CD-ROM and include program code, and can also run on electronic devices such as mobile phones, computers, and cloud servers. However, the computer program product provided in this application embodiment is not limited to this. In this application embodiment, the computer-readable storage medium can be any tangible medium that contains or stores program code, which can be used by or in conjunction with an instruction execution system, device, or apparatus.

[0122] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0123] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0124] Although preferred embodiments of this application have been described, those skilled in the art can make other changes and modifications to these embodiments once they learn the basic inventive concept.

[0125] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of this application and its equivalents, this application also intends to include these modifications and variations.

Claims

1. A configuration file management method based on quantum key distribution, characterized in that, The method is applied to a configuration file management system; the configuration file management system includes an eSIM data management platform, an eSIM terminal, and a quantum key management platform, wherein the eSIM data management platform is communicatively connected to the eSIM terminal and the quantum key management platform, respectively; the method includes: The eSIM data management platform coordinates two-way authentication between the eSIM terminal and the quantum key management platform based on the identity identifier of the eSIM terminal, so that the eSIM terminal and the quantum key management platform negotiate and generate a target session key for encrypting data transmission and a target message authentication key for integrity verification based on a preset quantum key block. After completing the two-way authentication, the eSIM data management platform establishes a first secure communication channel with the eSIM terminal based on the target session key, and sends a configuration file request to the SM-DP+ platform based on the identity identifier, and receives the target configuration file returned by the SM-DP+ platform. The eSIM data management platform encrypts the target configuration file based on the target session key to obtain an encrypted configuration file; and generates a corresponding message authentication code based on the target message authentication key. The eSIM data management platform encapsulates the encrypted configuration file and the message authentication code into encapsulated configuration file data, and sends the encapsulated configuration file data to the eSIM terminal through the first secure communication channel; The eSIM terminal performs integrity verification on the encapsulated configuration file data based on the target message authentication key. If the verification result is successful, the received encrypted configuration file is decrypted based on the target session key to restore and save the target configuration file.

2. The configuration file management method based on quantum key distribution according to claim 1, characterized in that, The eSIM terminal includes an identity protection proxy module; The eSIM data management platform coordinates the two-way authentication process between the eSIM terminal and the quantum key management platform based on the eSIM terminal's identity identifier, including: The identity protection agent module sends an authentication request to the eSIM data management platform; the authentication request includes the identity identifier; The eSIM data management platform forwards the identity identifier to the quantum key management platform, so that the quantum key management platform can perform first identity authentication on the eSIM terminal; If the first identity authentication is successful, the quantum key management platform initiates a second identity authentication to the eSIM terminal through the eSIM data management platform.

3. The configuration file management method based on quantum key distribution according to claim 2, characterized in that, The eSIM terminal also includes an embedded user identification module that is communicatively connected to the identity protection agent module; The steps of the quantum key management platform performing the first identity authentication on the eSIM terminal include: The quantum key management platform generates key index information and a first random number based on the identity identifier, and sends the key index information and the first random number to the identity protection agent module through the eSIM data management platform. The identity protection agent module sends the key index information and the first random number to the embedded user identification module; The embedded user identification module extracts the first authentication key from the preset quantum key block according to the key index information and generates a second random number; The embedded user identification module generates a first authentication value based on the first random number, the second random number, the first authentication key, and a preset message authentication key algorithm, and increments the authentication count value by 1. The identity protection agent module sends the second random number, the first authentication value, and the authentication count value to the quantum key management platform through the eSIM data management platform. After receiving the second random number, the first authentication value, and the authentication count value, the quantum key management platform determines the quantum key block copy corresponding to the eSIM terminal based on the key index information, and extracts the second authentication key from the quantum key block copy. The quantum key management platform generates a copy of the first authentication value based on the first random number, the second random number, the second authentication key, and the preset message authentication key algorithm. If the copy of the first authentication value is consistent with the first authentication value, the first identity authentication is determined to be successful.

4. The configuration file management method based on quantum key distribution according to claim 3, characterized in that, If the first identity authentication is successful, the step of the quantum key management platform performing a second identity authentication with the eSIM terminal through the eSIM data management platform includes: The quantum key management platform performs a key derivation operation on the quantum key block copy based on the authentication count value to generate an initial session key and an initial message authentication key. The quantum key management platform encrypts the first random number based on the initial session key to generate a first verification key; and encrypts the second random number based on the initial message authentication key to generate a second verification key. The quantum key management platform sends the initial session key, the initial message authentication key, the first verification key, and the second verification key to the eSIM data management platform. The eSIM data management platform stores the initial session key and the initial message authentication key, and forwards the first verification key and the second verification key to the identity protection agent module; The identity protection agent module sends the first verification key and the second verification key to the embedded user identification module; After receiving the first verification key and the second verification key, the embedded user identification module performs a key derivation operation on the quantum key block based on the authentication count value to generate an initial session key copy and an initial message authentication key copy. The embedded user identification module encrypts the first random number based on the initial session key copy to generate a first verification key copy; and encrypts the second random number based on the message authentication key copy to generate a second verification key copy. If the first verification key copy is consistent with the first verification key, and the second verification key copy is consistent with the second verification key, the second identity authentication is determined to be successful, and the initial session key is the target session key, and the initial message authentication key is the target message authentication key.

5. The configuration file management method based on quantum key distribution according to claim 4, characterized in that, During the production phase of the embedded user identification module, the method for setting the quantum key block includes: The quantum key management platform generates a corresponding quantum key block for the received initial identity identifier and sends the quantum key block to the quantum key injection tool, so that the quantum key injection tool writes the quantum key block into the corresponding embedded user identification module; wherein, the quantum key injection tool is communicatively connected to both the quantum key management platform and the eSIM terminal; the initial identity identifier is generated by the quantum key injection tool after reading the embedded user identification module of the eSIM terminal.

6. The configuration file management method based on quantum key distribution according to claim 1, characterized in that, The step of the eSIM terminal performing integrity verification on the encapsulated configuration file data based on the target message authentication key includes: The eSIM terminal generates a copy of the message authentication code based on the target message authentication key, and determines whether the copy of the message authentication code is consistent with the received message authentication code; if they are consistent, the verification result of the encapsulated configuration file data is determined to be successful.

7. The configuration file management method based on quantum key distribution according to claim 1, characterized in that, The eSIM terminal performs integrity verification on the encapsulated configuration file data based on the target message authentication key. If the verification result is successful, the received encrypted configuration file is decrypted based on the target session key to restore and save the target configuration file. Following this step, the method further includes: After completing decryption, the eSIM terminal destroys the target session key to close the first secure communication channel.

8. The configuration file management method based on quantum key distribution according to claim 1, characterized in that, The eSIM terminal includes an identity protection proxy module for communication connection and an embedded user identification module; the method further includes: In response to the received configuration file activation information, the identity protection agent module sends an activation request to the eSIM data management platform to establish a second secure communication channel with the eSIM data management platform; the configuration file activation information includes information about the configuration file to be activated. After the second secure communication channel is established, the eSIM data management platform generates an activation command based on the configuration file activation information and sends the activation command to the identity protection agent module through the second secure communication channel; Based on the received activation command, the identity protection agent module instructs the embedded user identification module to activate the configuration file corresponding to the configuration file information to be activated.

9. A configuration file management system, characterized in that, The configuration file management system is used to perform the quantum key-based configuration file management method according to any one of claims 1-8; the configuration file management system includes an eSIM data management platform, an eSIM terminal, and a quantum key management platform; the eSIM data management platform is communicatively connected to the eSIM terminal and the quantum key management platform, respectively.

10. The configuration file management system according to claim 9, characterized in that, The eSIM terminal includes an identity protection proxy module for communication connection and an embedded user identification module.

Images