A one-card double-network based USIM card and a card manufacturing and registration system thereof

Abstract

The application provides a one-card dual-network USIM card and a card manufacturing and registration system thereof, the USIM card comprising a USIM card hardware carrier, an automatic switching module and a start-up switching module. The system comprises a public network service system, a public network number card resource system, a public network UDM, a one-card dual-network platform, a private network service system and a private network UDM. The application realizes two sets of physically isolated communication authentication data and a matching card end intelligent switching logic in a single USIM card, fundamentally avoiding cross exposure of dual-network authentication data. In addition, the application aims to design a set of matching, system level isolated safe card manufacturing and registration process, ensuring the full link data safety from the card to the cloud. Finally, the application can realize automatic and rapid switching between the public network and the private network on the basis of high security according to the network signal condition without the user's awareness.

Description

Technical Field

[0001] This invention relates to the field of mobile communication technology, specifically to a USIM card based on dual networks and its card issuance and registration system. Specifically, it is a USIM card (Universal Subscriber Identity Module) that simultaneously supports communication on public and private networks, and a card issuance and registration system with physical isolation of dual data, automatic switching, and corresponding security. Background Technology

[0002] With the development of information technology infrastructure, the demands for mobile communications from various industries such as government, transportation, and energy are becoming increasingly diversified and specialized. This has led to numerous business scenarios requiring simultaneous operation on both public and dedicated wireless communication networks (such as government private networks and dedicated LTE networks for rail transit). To meet these demands, users typically need to carry two or more terminal devices adapted to different networks, or frequently manually change USIM cards within a single terminal. This not only causes inconvenience for users but also increases equipment costs and management complexity.

[0003] To address this issue, a technical solution has emerged: using the same set of communication authentication data on a single USIM card for separate registration in both public and private network systems. Specifically, after the user completes public network registration, the public network authentication data is sent to the private network system, where it is encrypted using a specific key to complete the private network registration, thus enabling a single card to switch between the two networks. However, this solution has significant drawbacks: Data security issues: Public network communication authentication data needs to be transmitted from the public network system and exposed to the private network system for further processing. This is outside the security supervision system of the public network operator, which poses a risk of data leakage and malicious use, and violates the high security and isolation requirements of the private network itself.

[0004] Increased system risk: To achieve registration, a data interface or system connection needs to be established between the public network and the private network. This increases network exposure points and system coupling, raising the risk of the entire system being attacked.

[0005] Insufficient handover dependency and flexibility: The handover mechanism of existing solutions mostly relies on the terminal operating system or application software, or is based on a set of data dual-network roaming logic. The handover sensitivity, reliability and independence are limited, especially in the public and private network signal boundary area, where handover delay or anomalies may occur.

[0006] Therefore, there is an urgent need in this field for a technical solution that can enable a single USIM card to switch automatically, stably, and with high sensitivity between the two networks while ensuring absolute isolation of data security between the public and private networks, and is equipped with a secure card issuance and registration process. Summary of the Invention

[0007] To overcome the shortcomings of existing technologies, this invention aims to provide a USIM card based on a single SIM card with dual networks and its card issuance and registration system. The primary objective of this invention is to fundamentally avoid the cross-exposure of authentication data between the two networks by implementing two physically isolated sets of communication authentication data and corresponding intelligent switching logic within a single USIM card. Secondly, this invention aims to design a matching, system-level isolated secure card issuance and registration process to ensure end-to-end data security from card to cloud. Ultimately, it enables the device to automatically and quickly switch between public and private networks based on network signal conditions without the user's awareness, while maintaining high security.

[0008] The present invention achieves the above objectives through the following technical solutions: A USIM card based on dual-network compatibility includes: A USIM card hardware carrier contains two sets of physically isolated communication authentication data: a public network communication authentication dataset for accessing public network communication and a private network communication authentication dataset for accessing private network communication. An automatic switching module is used to execute judgment logic based on the current network signal strength to achieve automatic switching between the public network and the private network; A power-on switching module is used to select the initial access network according to preset logic when the USIM card is restarted or powered on by inserting the card: when manually powered on by inserting the card, the default initial access is to the public network; when powered on by an automatic restart command issued by the automatic switching module, the access code network is switched according to the switching logic.

[0009] According to the present invention, a USIM card based on dual networks is provided, wherein the public network communication authentication dataset is stored in a first designated hardware security area, and the private network communication authentication dataset is stored in a second designated hardware security area. The two datasets are physically isolated from each other in the address space, and the hardware security mechanism ensures that the access permissions are independent, so that the authentication data reading and processing process in any network environment cannot access or interfere with the authentication data of the other network.

[0010] A card issuance and registration system for a dual-network USIM card, wherein the USIM card uses the aforementioned USIM card, and the system includes: The public network service system is used to receive and process users' requests for public network registration for dual-network SIM card services, and to enable users' communication functions on the public network. The public network SIM card resource system connects to the public network business system and is used to manage and access card production resources, card writing resources, and authentication resources for the public network portion of the USIM card, as well as manage the usage status of these resources. The public network UDM connects to the public network business system and is used to receive public network registration instructions and perform public network login authentication and verification for users who have activated the one-card-dual-network service. The dual-network platform serves as a business support and data management platform, used to generate, store, and manage private network numbers, private network number resources, communication authentication data, and encryption keys in the USIM card. The private network service system connects to the dual-network platform and is used to receive and process users' private network registration requests, and to enable users' communication functions on the private network. The private network UDM connects to the private network business system and is used to receive private network registration instructions and perform network login authentication and verification on the private network side for users who have activated the one-card-dual-network service.

[0011] According to the present invention, a card issuance and registration system for a USIM card based on a dual-network SIM card is provided. The public network SIM card resource system and the dual-network SIM card platform maintain system-level isolation during data transmission and business processing. The public network communication authentication data only flows within the public network side's business system, SIM card resource system, and public network UDM, and does not sink to the private network system throughout the entire process. The private network communication authentication data is independently generated, stored, and managed by the dual-network SIM card platform and is not directly exposed to the processing link of the public network business system.

[0012] According to the present invention, a card production and registration system for a USIM card based on a single card and dual network is provided. When producing a card, the private network business system receives the card production request, generates order information including the number of cards to be produced, the specified delivery time, and the target card vendor identifier, and sends the card production request to the single card and dual network platform. The dual-network platform generates dedicated network card production data that corresponds one-to-one with the order information based on the card production request, and then transmits the dedicated network card production data to the public network card resource system after encrypting it with the card merchant's public key. The public network SIM card resource system generates public network SIM card production data and encrypts it using the card vendor's public key; The public network SIM card resource system encapsulates and combines the encrypted private network SIM card production data with the public network SIM card production data to generate a unified SIM card production data package containing dual-network encrypted data. The public network number card resource system sends the unified card production data packet to the card production terminal of the corresponding target card vendor. The card vendor uses its own private key to decrypt the data packet, extract the dual network card production data and write it into the USIM card hardware carrier. Finally, the physical production and logistics delivery of the USIM card are completed according to the order information.

[0013] According to the present invention, a card issuance and registration system for a USIM card based on a dual-network card is provided. When registering on the public network, the user selects the dual-network card service in the public network business system. After the salesperson with business operation authority verifies the user's identity information, the public network registration process corresponding to the dual-network card service is initiated in the public network business system. The public network business system sends a public network registration instruction request carrying the user's identity identifier and the target USIM card identifier to the public network SIM card resource system. The public network SIM card resource system retrieves the public network communication authentication data of the corresponding USIM card, encrypts the data using a preset encryption algorithm, assembles it into a public network registration instruction that conforms to the public network UDM communication protocol specification, and sends the encrypted public network registration instruction back to the public network business system. The public network business system forwards the encrypted public network registration command to the public network UDM. The public network UDM decrypts and verifies the command, completes the user's public network identity authentication and network subscription configuration, and returns a successful public network registration result receipt to the public network business system after the configuration is completed. After receiving the registration success receipt, the public network business system marks the user's public network number as activated and available, and synchronously updates the business database on the public network side, completing the full public network side registration process for the dual-network USIM card.

[0014] According to the present invention, a card issuance and registration system for a USIM card based on a single card and dual networks is provided. After completing the public network registration, the user goes to the private network business system to submit proof of private network use qualification. The dedicated private network salesperson verifies the user's identity and private network access permission. After the verification is passed, the private network registration process corresponding to the single card and dual network service is initiated in the private network business system. The private network business system sends a private network registration instruction request to the one-card-two-network platform, which carries the unique identifier of the target USIM card and the user's private network qualification number. The one-card-two-network platform retrieves the private network communication authentication data of the corresponding USIM card, encrypts the data, assembles it into a private network registration instruction that conforms to the private network UDM communication protocol specification, and sends the encrypted private network registration instruction back to the private network business system. The private network service system sends the encrypted private network registration command to the private network UDM. The private network UDM decrypts and verifies the command, completes the user's identity authentication and exclusive network subscription configuration on the private network side, and returns a successful private network registration result receipt to the private network service system after the configuration is completed. After receiving the registration success receipt, the private network business system marks the user's private network number as activated and available, and updates it synchronously to the independent business database on the private network side. It does not synchronize the core parameters of private network authentication to the public network side system, thus completing the full-process registration of the dual-network USIM card on the private network side.

[0015] According to the present invention, a card issuance and registration system for a USIM card based on a single card and dual networks is provided. During normal communication use, the automatic switching module of the USIM card periodically sends a status query command to the user terminal at fixed time intervals to continuously poll the current network connection status. The system counts the cumulative number of status commands sent. When the count reaches a preset threshold, the automatic switching module sends a "provide local information" command to the user terminal, pauses the regular polling process, and waits for the terminal to return terminal response data. The automatic switching module reads the terminal response data returned by the terminal and first executes the first judgment logic: if the value of the terminal response is greater than the first preset threshold or equal to the specified abnormal value, it directly determines that the current network signal quality does not meet the communication requirements and immediately triggers the code number switching operation. If not, if the first-level determination does not meet the handover conditions, then the second determination logic is executed: further determine whether the value of the terminal response is less than the second preset threshold and not equal to the specified abnormal value. If the condition is met, then the network identifier verification process is started to read the MCC mobile country code, MNC mobile network code and CELL ID cell identifier information of the currently camped network.

[0016] According to the present invention, a card issuance and registration system for a USIM card based on a single card and dual networks verifies the validity of the read MCC (Mobile Country Code), MNC (Mobile Network Code), and CELL ID (Cell Identifier). If any identification information is missing or invalid, it is determined that the current network has left the effective coverage area. The automatic switching module sends a refresh command to the user equipment, triggering the code switching process inside the USIM card, and completing the network reselection and access between the public network and the private network.

[0017] The card issuance and registration system for a USIM card based on a single card with dual networks provided by the present invention further includes a power-on switching mechanism: At the moment of power-on startup, the USIM card's power-on switching module first identifies the trigger type of this power-on action, distinguishing between a cold start triggered by the user manually inserting the card and an internal automatic restart triggered by the automatic switching module sending a refresh command. If the system is identified as a cold start triggered by the user manually inserting a SIM card, the default access logic is executed, the public network communication authentication dataset is loaded directly, and the public network code number is used to complete network registration, so as to achieve ready-to-use in normal scenarios. If the system detects that the current boot is an internal automatic restart triggered by the refresh command, it directly calls the automatic switching judgment logic. Based on the network signal detection results before the restart, it loads the communication authentication dataset of the target network and directly switches to the corresponding private network or public network code number. There is no need to repeat the full signal detection process, thus achieving seamless connection of cross-network switching actions.

[0018] Therefore, compared with the existing technology, the USIM card and system based on dual networks proposed in this invention have the following beneficial effects: 1. This invention eliminates the possibility of mutual leakage or tampering of dual-network authentication data at the card level by physically isolating and storing two sets of authentication data in a single USIM card hardware, thus achieving the highest level of hardware security.

[0019] 2. In this invention, the data generation, management, and registration processes for the public and private networks are completely isolated at the system level. Public network authentication data always remains within the public network system and never sinks to the private network; private network data is managed by an independent dual-network platform. The two systems only collaborate on processes (such as card issuance) through encrypted, one-way data packets, thereby minimizing network exposure and improving the overall system security and robustness.

[0020] 3. The automatic card-end switching mechanism of the present invention does not rely on the terminal operating system and application software. It independently judges the network status and makes fast and accurate switching decisions in the edge area of ​​public network and private network signals or weak signal area through a combination of timed detection, graded signal interpretation (terminal response) and network identification (MCC / MNC / CELL ID) verification logic. This achieves highly sensitive, low-latency, seamless network switching and a smooth user experience.

[0021] 4. This invention provides users with a secure and convenient service activation experience by designing a clear, independent registration process for public and private networks (either sequentially or in parallel), and integrating it with the secure card issuance process. The intelligent design of the boot logic (manual boot via public network, automatic restart for direct switching) further optimizes the user experience for both initial use and daily switching.

[0022] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of an embodiment of the card production and registration system for a USIM card based on a dual-network card according to the present invention.

[0024] Figure 2 This is a flowchart illustrating the card production process of an embodiment of the USIM card production and registration system based on a dual-network card according to the present invention.

[0025] Figure 3 This is a registration flowchart of an embodiment of the card production and registration system for a USIM card based on a dual-network card according to the present invention.

[0026] Figure 4 This is a flowchart illustrating the power-on switching mechanism of an embodiment of the card issuance and registration system for a USIM card based on a dual-network card according to the present invention.

[0027] Figure 5 This is a flowchart illustrating the automatic switching mechanism of an embodiment of the card issuance and registration system for a USIM card based on a dual-network card according to the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0030] See Figures 1 to 5 This embodiment provides a card issuance and registration system for a USIM card based on a single card with dual networks, including: The public network service system is used to receive and process users' requests for public network registration for dual-network SIM card services, and to enable users' communication functions on the public network. The public network SIM card resource system connects to the public network business system and is used to manage and access card production resources, card writing resources, and authentication resources for the public network portion of the USIM card, as well as manage the usage status of these resources. The public network UDM connects to the public network business system and is used to receive public network registration instructions and perform public network login authentication and verification for users who have activated the one-card-dual-network service. The dual-network platform serves as a business support and data management platform, used to generate, store, and manage private network numbers, private network number resources, communication authentication data, and encryption keys in the USIM card. The private network service system connects to the dual-network platform and is used to receive and process users' private network registration requests, and to enable users' communication functions on the private network. The private network UDM connects to the private network business system and is used to receive private network registration instructions and perform network login authentication and verification on the private network side for users who have activated the one-card-dual-network service. The public network SIM card resource system and the dual-network SIM card platform work together to complete the physical preparation of the USIM card. The dual-network SIM card platform generates an encrypted private network SIM card production data packet based on the card production order and sends it to the public network SIM card resource system. The public network SIM card resource system generates and encrypts its public network SIM card production data, and then merges and packages the two into a unified dual-network SIM card production data packet, which is sent to an external card vendor for final card production. Furthermore, during the user registration and activation process, the public network SIM card resource system, the public network UDM and the dual-network platform, and the private network UDM operate independently in the public network business system and the private network business system respectively through encrypted instructions. This achieves system-level isolation processing of public network communication authentication data and private network communication authentication data, ensuring the security of dual-network data during transmission and processing.

[0031] In this embodiment, a USIM card based on dual-network compatibility includes: A USIM card hardware carrier contains two sets of physically isolated communication authentication data: a public network communication authentication dataset for accessing public network communication and a private network communication authentication dataset for accessing private network communication. An automatic switching module is used to execute judgment logic based on the current network signal strength to achieve automatic switching between the public network and the private network; A power-on switching module is used to select the initial access network according to preset logic (default or switch after restart) when the USIM card is restarted or powered on by inserting the card: when manually powered on by inserting the card, the default initial access is to the public network; when powered on by an automatic restart command issued by the automatic switching module, the access code network is switched according to the switching logic.

[0032] In this embodiment, two independent sets of communication authentication data, namely the public network communication authentication dataset and the private network communication authentication dataset, are physically isolated and stored in the physical storage area inside the USIM card hardware carrier.

[0033] Specifically, the public network communication authentication dataset is stored in a first designated hardware security zone, and the private network communication authentication dataset is stored in a second designated hardware security zone. The two datasets are physically isolated from each other in the address space, and the hardware security mechanism ensures that access permissions are independent. This ensures that the authentication data reading and processing process in any network environment cannot access or interfere with the authentication data of the other network. Thus, the data interaction risk between the public network and the private network is completely isolated at the hardware level, significantly improving the security level of the dual-network communication authentication data in the hardware carrier itself.

[0034] The public network SIM card resource system and the dual-network platform maintain system-level isolation during data transmission and business processing. Public network communication authentication data only flows within the public network side's business system, SIM card resource system, and public network UDM, and is never sent down to the private network system. Private network communication authentication data is independently generated, stored, and managed by the dual-network platform and is not directly exposed to the processing link of the public network business system.

[0035] In this system, the public network system and the private network system only exchange necessary card-making data packets through a preset encrypted one-way transmission channel. The public network system cannot directly read, parse, or modify the plaintext content of the private network communication authentication data, and the private network system cannot reversely obtain the core parameters of the public network communication authentication data. This achieves physical link isolation, processing logic isolation, and permission boundary isolation of dual-network data at the system architecture level, completely blocking cross-network data leakage paths and providing system-level security for the one-card-two-network service.

[0036] like Figure 2 As shown, when making cards, the private network business system receives the card making request, generates order information including the number of cards to be made, the specified delivery time, and the target card vendor identifier, and sends the card making request to the one-card-two-network platform; The dual-network platform generates dedicated network card production data that corresponds one-to-one with the order information based on the card production request, and then transmits the dedicated network card production data to the public network card resource system after encrypting it with the card merchant's public key. The public network SIM card resource system generates public network SIM card production data and encrypts it using the card vendor's public key; The public network SIM card resource system encapsulates and combines the encrypted private network SIM card production data with the public network SIM card production data to generate a unified SIM card production data package containing dual-network encrypted data. The public network number card resource system sends the unified card production data packet to the card production terminal of the corresponding target card vendor. The card vendor uses its own private key to decrypt the data packet, extract the dual network card production data and write it into the USIM card hardware carrier. Finally, the physical production and logistics delivery of the USIM card are completed according to the order information.

[0037] like Figure 3 As shown, when registering for the public network, the user selects the "One Card, Two Networks" service in the public network business system. After the salesperson with business operation authority verifies the user's identity information, the public network registration process corresponding to the "One Card, Two Networks" service is initiated in the public network business system. The public network business system sends a public network registration instruction request carrying the user's identity identifier and the target USIM card identifier to the public network SIM card resource system. The public network SIM card resource system retrieves the public network communication authentication data of the corresponding USIM card, encrypts the data using a preset encryption algorithm, assembles it into a public network registration instruction that conforms to the public network UDM communication protocol specification, and sends the encrypted public network registration instruction back to the public network business system. The public network business system forwards the encrypted public network registration command to the public network UDM. The public network UDM decrypts and verifies the command, completes the user's public network identity authentication and network subscription configuration, and returns a successful public network registration result receipt to the public network business system after the configuration is completed. After receiving the registration success receipt, the public network business system marks the user's public network number as activated and available, and synchronously updates the business database on the public network side, completing the full public network side registration process for the dual-network USIM card.

[0038] After completing public network registration, users go to the private network business system to submit proof of private network usage qualifications. The dedicated private network salesperson will verify the user's identity and private network access permissions. After the verification is passed, the user will initiate the private network registration process corresponding to the one card dual network service in the private network business system. The private network business system sends a private network registration instruction request to the one-card-two-network platform, which carries the unique identifier of the target USIM card and the user's private network qualification number. The one-card-two-network platform retrieves the private network communication authentication data of the corresponding USIM card, encrypts the data, assembles it into a private network registration instruction that conforms to the private network UDM communication protocol specification, and sends the encrypted private network registration instruction back to the private network business system. The private network service system sends the encrypted private network registration command to the private network UDM. The private network UDM decrypts and verifies the command, completes the user's identity authentication and exclusive network subscription configuration on the private network side, and returns a successful private network registration result receipt to the private network service system after the configuration is completed.

[0039] After receiving the registration success receipt, the private network business system marks the user's private network number as activated and available, and updates it synchronously to the independent business database on the private network side. However, it does not synchronize the core parameters of private network authentication to the public network side system, thus completing the entire registration process of the dual-network USIM card on the private network side.

[0040] like Figure 4 As shown, during normal communication use, the USIM card's automatic switching module periodically sends status query commands to the user terminal at fixed time intervals to continuously poll the current network connection status. The number of status commands sent is counted. When the count reaches a preset threshold (e.g., 10 times), the automatic switching module sends a "provide local information" command to the user terminal, suspends the regular polling process, and waits for the terminal to return terminal response data. The automatic switching module reads the terminal response data returned by the terminal and first executes the first judgment logic: if the value of the terminal response is greater than the first preset threshold (e.g., 0x20) or equal to the specified abnormal value (e.g., 0x06), it is directly determined that the current network signal quality does not meet the communication requirements and the code number switching operation is immediately triggered. If not, if the first-level determination does not meet the handover conditions, then the second determination logic is executed: further determine whether the value of the terminal response is less than the second preset threshold (e.g., 0x10) and not equal to the specified abnormal value. If the condition is met, then the network identifier verification process is started to read the MCC mobile country code, MNC mobile network code and CELL ID cell identifier information of the currently camped network. The validity of the read MCC, MNC, and CELL ID is verified. If any identification information is missing or invalid, it is determined that the current network has left the effective coverage area. The automatic switching module sends a refresh command to the user equipment, triggering the code switching process inside the USIM card, and completing the network reselection and access between the public network and the private network.

[0041] In this embodiment, the public network registration process and the private network registration process are executed completely independently at the system level. There is no direct two-way data interaction interface between the public network business system and the private network business system. The operation permissions, data storage areas and business processing links of the two types of business systems are completely isolated at the physical level.

[0042] The business status connection between the public network registration process and the private network registration process is completed only through a one-way encrypted transmission channel deployed in an independent security domain. Only after the public network registration process is fully executed and an encrypted public network activation credential is generated can the credential be synchronized to the private network business system through the one-way channel. This credential serves as the only legitimate pre-verification basis for triggering the private network registration process. No core authentication plaintext data from the public network or the private network is transmitted throughout the process, thus cutting off the direct data access path across network systems at the source and significantly reducing the network exposure risk of the private network's core resources to the external public network.

[0043] In this embodiment, as Figure 5 As shown, it also includes a boot switching mechanism: At the moment of power-on startup, the USIM card's power-on switching module first identifies the trigger type of this power-on action, distinguishing between a cold start triggered by the user manually inserting the card and an internal automatic restart triggered by the automatic switching module sending a refresh command. If the system is identified as a cold start triggered by the user manually inserting a SIM card, the default access logic is executed, the public network communication authentication dataset is loaded directly, and the public network code number is used to complete network registration, so as to achieve ready-to-use in normal scenarios. If the system detects that the current boot is an internal automatic restart triggered by the refresh command, it directly calls the automatic switching judgment logic. Based on the network signal detection results before the restart, it loads the communication authentication dataset of the target network and directly switches to the corresponding private network or public network code number. There is no need to repeat the full signal detection process, thus achieving seamless connection of cross-network switching actions.

[0044] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0045] The above embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of protection of the present invention. Any non-substantial changes and substitutions made by those skilled in the art based on the present invention shall fall within the scope of protection claimed by the present invention.

Claims

1. A USIM card based on dual-network connectivity, characterized in that, include: A USIM card hardware carrier contains two sets of physically isolated communication authentication data: a public network communication authentication dataset for accessing public network communication and a private network communication authentication dataset for accessing private network communication. An automatic switching module is used to execute judgment logic based on the current network signal strength to achieve automatic switching between the public network and the private network; A power-on switching module is used to select the initial access network according to preset logic when the USIM card is restarted or powered on by inserting the card: when manually powered on by inserting the card, the default initial access is to the public network; when powered on by an automatic restart command issued by the automatic switching module, the access code network is switched according to the switching logic.

2. The USIM card according to claim 1, characterized in that: The public network communication authentication dataset is stored in the first designated hardware security zone, and the private network communication authentication dataset is stored in the second designated hardware security zone. The two datasets are physically isolated from each other in the address space. The hardware security mechanism ensures that the access permissions are independent, so that the authentication data reading and processing process in any network environment cannot access or interfere with the authentication data of the other network.

3. A card issuance and registration system for a USIM card based on dual-network connectivity, characterized in that, The USIM card is the USIM card as described in claim 1 or 2, and the system includes: The public network service system is used to receive and process users' requests for public network registration for dual-network SIM card services, and to enable users' communication functions on the public network. The public network SIM card resource system connects to the public network business system and is used to manage and access card production resources, card writing resources, and authentication resources for the public network portion of the USIM card, as well as manage the usage status of these resources. The public network UDM connects to the public network business system and is used to receive public network registration instructions and perform public network login authentication and verification for users who have activated the one-card-dual-network service. The dual-network platform serves as a business support and data management platform, used to generate, store, and manage private network numbers, private network number resources, communication authentication data, and encryption keys in the USIM card. The private network service system connects to the dual-network platform and is used to receive and process users' private network registration requests, and to enable users' communication functions on the private network. The private network UDM connects to the private network business system and is used to receive private network registration instructions and perform network login authentication and verification on the private network side for users who have activated the one-card-dual-network service.

4. The system according to claim 3, characterized in that: The public network SIM card resource system and the dual-network platform maintain system-level isolation during data transmission and business processing. Public network communication authentication data only flows within the public network side's business system, SIM card resource system, and public network UDM, and is never sent down to the private network system. Private network communication authentication data is independently generated, stored, and managed by the dual-network platform and is not directly exposed to the processing link of the public network business system.

5. The system according to claim 3, characterized in that: When making cards, the private network business system receives the card making request, generates order information including the number of cards to be made, the specified delivery time, and the target card vendor identifier, and sends the card making request to the one-card-two-network platform. The dual-network platform generates dedicated network card production data that corresponds one-to-one with the order information based on the card production request, and then transmits the dedicated network card production data to the public network card resource system after encrypting it with the card merchant's public key. The public network SIM card resource system generates public network SIM card production data and encrypts it using the card vendor's public key; The public network SIM card resource system encapsulates and combines the encrypted private network SIM card production data with the public network SIM card production data to generate a unified SIM card production data package containing dual-network encrypted data. The public network number card resource system sends the unified card production data packet to the card production terminal of the corresponding target card vendor. The card vendor uses its own private key to decrypt the data packet, extract the dual network card production data and write it into the USIM card hardware carrier. Finally, the physical production and logistics delivery of the USIM card are completed according to the order information.

6. The system according to claim 3, characterized in that: When registering for public network access, users select the "One Card, Two Networks" service in the public network service system. After the salesperson with business operation authority verifies the user's identity information, the public network registration process corresponding to the "One Card, Two Networks" service is initiated in the public network service system. The public network business system sends a public network registration instruction request carrying the user's identity identifier and the target USIM card identifier to the public network SIM card resource system. The public network SIM card resource system retrieves the public network communication authentication data of the corresponding USIM card, encrypts the data using a preset encryption algorithm, assembles it into a public network registration instruction that conforms to the public network UDM communication protocol specification, and sends the encrypted public network registration instruction back to the public network business system. The public network business system forwards the encrypted public network registration command to the public network UDM. The public network UDM decrypts and verifies the command, completes the user's public network identity authentication and network subscription configuration, and returns a successful public network registration result receipt to the public network business system after the configuration is completed. After receiving the registration success receipt, the public network business system marks the user's public network number as activated and available, and synchronously updates the business database on the public network side, completing the full public network side registration process for the dual-network USIM card.

7. The system according to claim 6, characterized in that: After completing public network registration, users go to the private network business system to submit proof of private network usage qualifications. The dedicated private network salesperson will verify the user's identity and private network access permissions. After the verification is passed, the user will initiate the private network registration process corresponding to the one card dual network service in the private network business system. The private network business system sends a private network registration instruction request to the one-card-two-network platform, which carries the unique identifier of the target USIM card and the user's private network qualification number. The one-card-two-network platform retrieves the private network communication authentication data of the corresponding USIM card, encrypts the data, assembles it into a private network registration instruction that conforms to the private network UDM communication protocol specification, and sends the encrypted private network registration instruction back to the private network business system. The private network service system sends the encrypted private network registration command to the private network UDM. The private network UDM decrypts and verifies the command, completes the user's identity authentication and exclusive network subscription configuration on the private network side, and returns a successful private network registration result receipt to the private network service system after the configuration is completed. After receiving the registration success receipt, the private network business system marks the user's private network number as activated and available, and updates it synchronously to the independent business database on the private network side. It does not synchronize the core parameters of private network authentication to the public network side system, thus completing the full-process registration of the dual-network USIM card on the private network side.

8. The system according to claim 3, characterized in that: During normal communication use, the USIM card's automatic switching module periodically sends status query commands to the user terminal at fixed time intervals to continuously poll the current network connection status. The system counts the cumulative number of status commands sent. When the count reaches a preset threshold, the automatic switching module sends a "provide local information" command to the user terminal, pauses the regular polling process, and waits for the terminal to return terminal response data. The automatic switching module reads the terminal response data returned by the terminal and first executes the first judgment logic: if the value of the terminal response is greater than the first preset threshold or equal to the specified abnormal value, it directly determines that the current network signal quality does not meet the communication requirements and immediately triggers the code number switching operation. If not, if the first-level judgment does not meet the handover conditions, then the second judgment logic is executed: further determine whether the value of the terminal response is less than the second preset threshold and not equal to the specified abnormal value. If the condition is met, then the network identifier verification process is started to read the MCC mobile country code, MNC mobile network code and CELL ID cell identifier information of the currently camped network.

9. The system according to claim 8, characterized in that: The validity of the read MCC (Mobile Country Code), MNC (Mobile Network Code), and CELL ID (Cell ID) information is verified. If any of the identification information is missing or invalid, it is determined that the current network has left the effective coverage area. The automatic handover module sends a refresh command to the user equipment, triggering the code switching process inside the USIM card, and completing the network reselection and access between the public network and the private network.

10. The system according to claim 3, characterized in that, It also includes a boot switching mechanism: At the moment of power-on startup, the USIM card's power-on switching module first identifies the trigger type of this power-on action, distinguishing between a cold start triggered by the user manually inserting the card and an internal automatic restart triggered by the automatic switching module sending a refresh command. If the system is identified as a cold start triggered by the user manually inserting a SIM card, the default access logic is executed, the public network communication authentication dataset is loaded directly, and the public network code number is used to complete network registration, so as to achieve ready-to-use in normal scenarios. If the system detects that the current boot is an internal automatic restart triggered by the refresh command, it directly calls the automatic switching judgment logic. Based on the network signal detection results before the restart, it loads the communication authentication dataset of the target network and directly switches to the corresponding private network or public network code number. There is no need to repeat the full signal detection process, thus achieving seamless connection of cross-network switching actions.

Images