A sim / eSIM-based cross-terminal agent security communication method and device

Abstract

The application relates to the technical field of agent communication, in particular to a cross-terminal agent security communication method and device based on SIM / eSIM, which comprises the following steps: a first terminal agent obtains a feature digest and a public key of a first SIM or eSIM card through a first terminal security plug-in, applies for and caches an identity credential to an identity management platform; based on a challenge code issued by an agent security communication platform, the first SIM or eSIM card uses a non-exportable private key in the chip to perform signing, completes bidirectional authentication and derives a session key; a business message is signed and encrypted based on the session key, is forwarded to a second terminal agent through the platform, and is output as plaintext after being verified and decrypted by a second terminal security plug-in. The method realizes hardware-level protection of the non-exportable private key of the SIM or eSIM card, considers the anti-quantum evolution capability by fusing key negotiation, and supports security management and control and hierarchical abnormal disposal in the whole life cycle of the session.

Description

Technical Field

[0001] This invention relates to the field of intelligent agent communication technology, and specifically to a cross-terminal intelligent agent secure communication method and device based on SIM / eSIM. Background Technology

[0002] With the rapid popularization of IoT, edge computing, and distributed intelligent agent technologies, cross-terminal intelligent collaboration and autonomous communication between devices have become mainstream application forms. Various mobile terminals and IoT units are equipped with intelligent agents to complete data interaction, command coordination, and business linkage, and are widely used in mobile internet, vehicle-to-everything (V2X) networks, industrial IoT, smart government, and other fields. At the same time, the number of terminals is surging and communication links are becoming more open, making communication security issues increasingly prominent. Security threats such as identity forgery, message tampering, key leakage, and replay attacks occur frequently, and traditional security protection methods are no longer sufficient to meet the requirements of high-level trusted communication.

[0003] Currently, existing technologies for secure communication between intelligent agents mainly focus on the following aspects: I. Access control schemes based on application-layer account systems or cloud-side token mechanisms. These schemes rely on cloud-based identity authentication services to issue temporary access tokens to agents, achieving session-level identity verification. Their drawback lies in the lack of hardware root of trust constraints on the terminal side. That is, the agent's identity depends entirely on the software-level account system or token mechanism. Once the terminal system is compromised, the private key or token can be easily stolen, posing a risk of agent identity forgery. Furthermore, the binding relationship between device identity, agent identity, and session identity is loose, making it difficult to form an end-to-end trusted link from terminal hardware to agent software and then to the communication session. II. Digital Certificate Authentication System Based on Public Key Infrastructure. Existing solutions achieve identity authentication and communication encryption by issuing digital certificates for each agent. However, in dynamic networking scenarios with multiple agents, the generation, distribution, verification, and revocation of certificates involve complex key management processes, and centralized certificate authorities are prone to becoming single points of failure and performance bottlenecks. Furthermore, in such solutions, private keys are typically stored in the terminal file system or software keystore, lacking hardware-level protection and making them vulnerable to theft by malicious programs. III. Communication Encryption Schemes Based on Transport Layer Security Protocols. Existing schemes ensure the confidentiality and integrity of data transmission by establishing a TLS encrypted channel between the communicating parties. However, such schemes rely on software-implemented key exchange and encryption operations, with the keys existing in plaintext in the terminal memory, making them vulnerable to memory scanning, firmware extraction, and other methods. Furthermore, the TLS protocol itself cannot solve the problem of trustworthy identity between agents, nor can it provide field-level replay protection for application layer messages. IV. Identity Authentication Schemes Based on SIM and eSIM Hardware Security Chips. SIM and eSIM, as standard hardware carriers in mobile terminals, possess inherent security attributes such as security chips, independent storage, hardware encryption, and key isolation, and are recognized in the industry as hardware roots of trust. By relying on SIM or eSIM security chips to achieve key generation, signature computation, and hardware protection of private keys, the risk of private key theft due to terminal system intrusion can be avoided from the underlying layer. This approach is currently widely used in device identity authentication and communication encryption scenarios.

[0004] The invention patent CN121751174A proposes a low-altitude intelligent agent interconnection system and method based on a mobile SIM card. This solution utilizes the embedded security chip of the mobile SIM card to construct a trusted execution environment. It performs multi-dimensional composite authentication by collecting user behavior characteristics, terminal hardware identifiers, and digital certificate information of the intelligent agent to generate a globally unique identity. A unified security gateway layer is then used for heterogeneous network protocol conversion to establish a quantum-encrypted transmission channel. This solution introduces the SIM card as a secure trust anchor point into the low-altitude intelligent agent interconnection scenario, effectively improving communication security. However, this solution primarily focuses on the interconnection and evidence storage issues of low-altitude intelligent agents in heterogeneous network environments. It uses the SIM card to solve the heterogeneous network forwarding compatibility problem but does not deeply integrate and bind the SIM / eSIM hardware root of trust with the intelligent agent's identity credentials. It also lacks specific optimization for multi-device cross-domain communication of distributed intelligent agents, resulting in issues such as coarse identity binding granularity and weak traceability. Therefore, it cannot adapt to end-to-end trusted communication scenarios between heterogeneous terminals such as mobile phones, robots, and IoT devices. Summary of the Invention

[0005] Purpose of the invention: In order to overcome the shortcomings of the prior art, the present invention provides a secure communication method for cross-terminal intelligent agents based on SIM / eSIM, which solves the technical problems of identity forgery, link untrustworthiness, lack of quantum resistance and insufficient security mechanism linkage in existing cross-terminal intelligent agent collaborative communication, and realizes highly reliable, traceable and scalable end-to-end secure communication. The present invention also provides a secure communication system for cross-terminal intelligent agents based on SIM / eSIM.

[0006] Technical solution: According to a first aspect of the present invention, a secure communication method for cross-terminal intelligent agents based on SIM or eSIM is provided, the method comprising: The first terminal intelligent agent initiates an identity registration request through the first terminal security plugin. The first terminal security plugin responds to the identity registration request by obtaining the feature digest and public key of the first SIM or eSIM card, and submits the identity authentication information containing the feature digest and public key of the first SIM or eSIM card to the identity management platform to apply for identity credentials. The identity management platform verifies the identity authentication information and issues the identity credentials of the first terminal intelligent agent after verification. The intelligent agent secure communication platform generates a first challenge code based on the request of the first terminal intelligent agent, performs a signature operation on the first challenge code based on the private key in the first SIM or eSIM card, the first SIM or eSIM card returns the signature result and the identity credential to the first terminal security plug-in, after the intelligent agent secure communication platform verifies the signature result and the identity credential, the intelligent agent secure communication platform sends a two-way authentication request to the second terminal intelligent agent, and obtains the session key of the first terminal intelligent agent and the second terminal intelligent agent after completing the two-way authentication; The first terminal agent submits a service message to the first terminal security plugin. The first terminal security plugin signs and encrypts the service message based on the session key, and forwards it to the second terminal agent through the agent security communication platform. The second terminal security plugin verifies and decrypts the signature, outputs a plaintext service message, and sends a response message back to the first terminal agent through the agent security communication platform.

[0007] Furthermore, the method also includes: The secure communication platform for intelligent agents determines whether a risk event has been triggered while the session is running. If no risk event has been triggered and the session has expired, the platform triggers session renegotiation to update the session key and resumes session operation; otherwise, If a risk event is triggered, the intelligent agent secure communication platform determines the risk level. If the risk level is not higher than a preset threshold, the session validity period is shortened and the session continues. If the risk level is higher than the preset threshold, the local session context is destroyed. Re-authenticate the session. If successful, rebuild the session and resume communication; otherwise, refuse communication.

[0008] Furthermore, including: The first terminal security plugin requests identity credentials from the identity management platform, including: The first terminal security plugin calls the first SIM or eSIM card to generate an asymmetric key pair, wherein the private key cannot be exported; After obtaining the returned public key identifier, the integrated circuit card identification code and international mobile subscriber identification code of the first SIM or eSIM card are collected, and a feature digest is generated; the feature digest is an encrypted string obtained by the first terminal security plugin by concatenating the collected integrated circuit card identification code and international mobile subscriber identification code and calculating it using a hash algorithm; The first terminal security plugin submits identity authentication information to the identity management platform. After the identity management platform performs legality verification and binding relationship verification, it issues identity credentials to the first terminal security plugin. The identity authentication information includes a public key, feature digest, intelligent agent identifier, and terminal device identifier. The terminal device is the first SIM or eSIM card and the physical carrier and operating environment where the first terminal intelligent agent is located.

[0009] Furthermore, including: The signing operation of the first challenge code based on the private key in the first SIM or eSIM card includes: The intelligent agent secure communication platform returns a first challenge code to the first terminal intelligent agent, and the first terminal security plugin sends a first signature request to the first SIM or eSIM card; the first signature request includes at least a first index, a first challenge code, and a signature algorithm identifier. The first SIM or eSIM card finds the corresponding private key based on the first index, performs a digital signature operation on the first challenge code, generates a first signature result, and returns the first signature result to the first terminal security plugin; The first terminal security plugin submits the first signature result to the intelligent agent secure communication platform, and the intelligent agent secure communication platform completes the signature verification.

[0010] Furthermore, including: The secure communication platform for the intelligent agent sends a two-way authentication request to the second terminal intelligent agent, including: After receiving the two-way authentication request, the second terminal intelligent agent calls the second terminal security plugin to request the use of the private key in the second SIM or eSIM card to sign the second challenge code and generate a second signature result. The two-way authentication request includes at least a session identifier and a second challenge code for authenticating the second terminal intelligent agent. The second signature result and the identity credentials of the second terminal agent are returned to the second terminal security plugin; The second terminal security plugin returns the second signature result and the identity credentials of the second terminal agent to the agent security communication platform, and the agent security communication platform completes the signature verification of the second signature result and the validity verification of the identity credentials. After successful verification, the intelligent agent secure communication platform returns platform verification materials and identity authentication information of the second terminal intelligent agent to the first terminal intelligent agent. The first terminal intelligent agent completes peer identity confirmation based on the platform verification materials and the identity authentication information, thereby completing two-way authentication.

[0011] Furthermore, including: The session keys obtained after completing two-way authentication for the first and second terminal intelligent agents include: The first terminal security plugin calls an interface to send the key negotiation material to the intelligent agent secure communication platform and forwards it to the second terminal security plugin. The key negotiation material is a set of cryptographic parameters exchanged by the two communicating parties to calculate the final shared secret. The second terminal security plugin calls the interface to generate key negotiation response material based on the received key negotiation material. The key negotiation response material is a set of return data generated by the second terminal security plugin according to the negotiation protocol after receiving the key negotiation material, which is used to enable the initiator to complete the shared secret calculation. The intelligent agent secure communication platform sends back a negotiation completion notification, and the first terminal security plugin and the second terminal security plugin derive a session key by fusing the received shared secret.

[0012] Furthermore, including: The first terminal security plugin signs and encrypts the service message based on the session key, including: The first terminal security plugin injects timestamp, random number, request identifier and session identifier fields into the business message, calls the signature interface to perform signature, and calls the encryption / decryption interface to perform encryption using the session key, and sends the security message to the intelligent agent security communication platform.

[0013] Furthermore, including: The second terminal security plugin verifies and decrypts the encrypted service message and outputs a plaintext service message, including: The second terminal security plugin performs anti-replay verification and signature verification, and uses the session key to perform decryption, outputting the decrypted business message to the second terminal intelligent agent. The anti-replay verification includes at least time window verification, random number uniqueness verification and request identifier idempotency verification.

[0014] Secondly, the present invention also provides a secure communication device for cross-terminal intelligent agents, the device comprising: The system comprises: a first terminal intelligent agent, a first SIM or eSIM card, a second terminal intelligent agent, a first terminal security plugin, a second terminal security plugin, an intelligent agent secure communication platform, and an identity management platform. The first terminal intelligent agent is used to initiate identity registration requests and business messages; The first SIM or eSIM card is connected to the first terminal security plug-in; The first terminal security plugin is connected to the first terminal smart agent and the first SIM or eSIM card respectively. It is used to respond to the identity registration request to obtain the feature digest and public key of the first SIM or eSIM card, submit the identity authentication information containing the feature digest and public key to the identity management platform to apply for identity credentials, cache the issued identity credentials, and initiate a signature request to the first SIM or eSIM card. It submits the signature result and the identity credentials to the smart agent secure communication platform and signs and encrypts the business message based on the session key. The second terminal intelligent agent is used to receive plaintext service messages; The second terminal security plugin is connected to the second terminal intelligent agent and is used to verify and decrypt the encrypted business message and output the plaintext business message to the second terminal intelligent agent. The intelligent agent secure communication platform is connected to the first terminal security plugin and the second terminal security plugin respectively. It is configured to send a first challenge code to the first terminal security plugin, and after successful verification, send an authentication request to the second terminal security plugin. After completing two-way authentication, it obtains the session key, forwards the signed and encrypted business message to the second terminal security plugin, and sends the plaintext business message back to the first terminal intelligent agent. The identity management platform is connected to the security plugin of the first terminal and is configured to receive applications for the identity credentials, verify them, and then issue the identity credentials.

[0015] Thirdly, the present invention also provides a communication system implemented using a SIM / eSIM-based cross-terminal intelligent agent secure communication method, the system comprising: The identity registration module is used to respond to the identity registration request initiated by the first terminal intelligent agent through the first terminal security plugin. The first terminal security plugin obtains the feature digest and public key of the first SIM or eSIM card in response to the identity registration request, submits the identity authentication information containing the feature digest and public key of the first SIM or eSIM card to the identity management platform to apply for identity credentials, and the identity management platform verifies the identity authentication information and issues the identity credentials of the first terminal intelligent agent after verification. The two-way authentication and key negotiation module is used to generate a first challenge code based on the request of the first terminal intelligent agent through the intelligent agent secure communication platform, perform a signature operation on the first challenge code based on the private key in the first SIM or eSIM card, the first SIM or eSIM card returns the signature result and the identity credential to the first terminal security plug-in, after the intelligent agent secure communication platform verifies the signature result and the identity credential, the intelligent agent secure communication platform sends a two-way authentication request to the second terminal intelligent agent, and obtains the session key of the first terminal intelligent agent and the second terminal intelligent agent after completing the two-way authentication; The secure message transmission module is used to submit a business message to the first terminal security plugin through the first terminal agent. The first terminal security plugin signs and encrypts the business message based on the session key, and forwards it to the second terminal agent through the agent secure communication platform. The second terminal security plugin verifies and decrypts the signature and outputs a plaintext business message, and sends a response message back to the first terminal agent through the agent secure communication platform.

[0016] Fourthly, the present invention also provides an electronic device, comprising: At least one memory stores computer-executable instructions non-transiently; At least one processor, configured to run the computer-executable instructions, The computer-executable instructions are executed by the processor to implement the steps of the SIM / eSIM-based cross-terminal intelligent agent secure communication method described in the first aspect.

[0017] Fifthly, the present invention also provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores program code for execution by a device, the program code including steps for performing the SIM / eSIM-based cross-terminal intelligent agent secure communication method described in the first aspect.

[0018] Beneficial effects: Compared with the prior art, the present invention has the following advantages: (1) This invention uses the SIM / eSIM card as the hardware root of trust on the terminal side. The asymmetric key pair is generated internally by the SIM or eSIM card. The private key cannot be exported, and all cryptographic operations are completed inside the chip. The terminal security plugin only calls the SIM or eSIM card to perform operations such as signing and verification. The terminal intelligent agent does not directly touch the key, which fundamentally eliminates the security dependence on the terminal software operating environment and significantly reduces the risk of identity forgery of the intelligent agent. (2) This invention collects the ICCID and IMSI of the SIM or eSIM card through the terminal security plugin to generate a feature digest. The public key, feature digest, agent identifier and terminal device identifier are submitted to the identity management platform. After verification, an identity certificate is issued, realizing the deep integration and binding of the device layer, agent layer and session layer. Through the challenge code two-way authentication mechanism, the two parties in communication verify each other's identities under the platform arrangement, and establish an end-to-end trusted link of device, agent and session. Any change in any dimension will trigger the certificate to become invalid, effectively preventing identity fraud.

[0019] (3) After two-way authentication is successful, the present invention performs fusion key negotiation through the first terminal security plugin and the second terminal security plugin, that is, SM2 negotiation and post-quantum key encapsulation mechanism are executed in parallel, and the shared secrets of the two outputs are jointly input into the HKDF fusion derived session key. This mechanism takes into account both the compatibility of the existing national cryptographic system and the smooth evolution capability of the post-quantum cryptographic system. Even if quantum computing technology makes breakthroughs in the future, the confidentiality of the session key can still be effectively guaranteed.

[0020] (4) The present invention forcibly injects four anti-replay fields—timestamp, random number, request identifier, and session identifier—into the business message by the terminal security plugin. The receiving side performs triple protection by performing time window verification, random number uniqueness verification, and request identifier idempotency verification. Combined with message-level encryption and signature mechanisms, it provides confidentiality, integrity, and anti-replay capabilities of data in synchronous calls, asynchronous callbacks, and streaming communication scenarios, ensuring that business messages are not stolen, tampered with, or replayed during transmission.

[0021] (5) This invention establishes a complete session lifecycle management mechanism, continuously monitoring risk events during session operation. When no risk is triggered and the session expires, a key renegotiation is triggered. When a risk event is triggered, the risk control engine determines the risk level. For low-risk events, capability restrictions and TTL shortening are implemented. For high-risk events, access token revocation, session key destruction, random number and request identifier blacklist windowing, and re-authentication are executed sequentially. After successful re-authentication, the session is rebuilt and communication is restored. This mechanism covers a complete closed loop from risk perception, level determination, graded handling, re-authentication to session reconstruction, and supports large-scale deployment under edge cloud deployment.

[0022] In summary, this invention systematically solves the technical challenges of existing cross-terminal intelligent agent secure communication schemes in four aspects: identity forgery, link untrustworthiness, resistance to quantum missing, and insufficient linkage of security mechanisms. It provides a secure, reliable, quantum-resistant, and end-to-end secure communication scheme for cross-terminal intelligent agent collaborative communication that supports asynchronous and streaming communication scenarios. Attached Figure Description

[0023] Figure 1 This is a flowchart of the cross-terminal intelligent agent secure communication method based on SIM / eSIM as described in an embodiment of the present invention; Figure 2 This is a basic architecture diagram as described in an embodiment of the present invention; Figure 3 This is a flowchart of the intelligent agent identity credential application method according to an embodiment of the present invention; Figure 4 This is a flowchart of the two-way authentication and fusion key negotiation method described in an embodiment of the present invention; Figure 5 This is a flowchart of the secure message transmission method according to an embodiment of the present invention; Figure 6 This is a flowchart of the session lifecycle and cancellation method described in an embodiment of the present invention; Figure 7 This is a timing diagram of the method for applying for an intelligent agent identity credential according to an embodiment of the present invention; Figure 8 This is a timing diagram of the two-way authentication and fusion key negotiation method described in an embodiment of the present invention; Figure 9 This is a timing diagram of the secure message transmission method described in an embodiment of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] like Figure 1 As shown, this application provides a secure communication method for cross-terminal intelligent agents based on SIM / eSIM, which includes the following steps: S1 The first terminal intelligent agent initiates an identity registration request through the first terminal security plugin. The first terminal security plugin applies for identity credentials from the identity management platform. After verification, the platform issues the identity credentials of the first terminal intelligent agent. The first terminal security plugin caches the identity credentials of the first terminal intelligent agent.

[0026] In this embodiment, before implementing step S1, the first terminal intelligent agent, the first terminal security plug-in, the identity management platform, the intelligent agent secure communication platform, the second terminal intelligent agent, the second terminal security plug-in, the first hardware security element, and the second hardware security element are first deployed, such as... Figure 2As shown, a user interaction entry point is constructed, which includes at least a first terminal intelligent agent and a second terminal intelligent agent. A trusted link is constructed on the terminal A side, corresponding to the link: first terminal intelligent agent—first terminal security plug-in—first hardware security element. In this embodiment, it can be any one of a SIM card, an embedded SIM card, or an integrated SIM card. A trusted link is constructed on the terminal B side, corresponding to the link: second terminal intelligent agent—second terminal security plug-in—second hardware security element. In this embodiment, it can also be any one of a SIM card, an embedded SIM card, or an integrated SIM card. An intelligent agent management platform functional domain is constructed, which includes at least an intelligent agent secure communication platform, an identity management platform, and an intelligent agent discovery and registration center. Communication relationships are established, with the first terminal intelligent agent communicating bidirectionally with the platform side, and the second terminal intelligent agent communicating bidirectionally with the platform side. A platform collaboration relationship is established, with the intelligent agent secure communication platform interacting bidirectionally with the identity management platform, and the platform interacting bidirectionally with the intelligent agent discovery and registration center.

[0027] In a preferred embodiment of this invention, the first hardware security element and the second hardware security element can be any one of a SIM card, an embedded SIM card (eSIM), or an integrated SIM card (iSIM). The first hardware security element and the second hardware security element can have the same physical form or different physical forms, such as a combination of a SIM card on the first terminal side and an iSIM card on the second terminal side. Since the communication protocols of the two cards are the same, it does not affect the implementation of the method.

[0028] In this embodiment, the first terminal security plugin and the second terminal security plugin provide a unified security capability interface family, including the init, AgentRegister, GetAccessToken, SignBySm2, VerifySignature, KeyAgreement, EncDecAcpPackage, and DestroySession interfaces. The business intelligence agent completes registration, authentication, signature verification, key negotiation, message encapsulation, and session management through the above interfaces. Specifically, the functions of the above interfaces include: The `init(Context, callback)` method is an initialization interface used to complete the initialization configuration of the terminal security plugin, establish a connection channel with the hardware security element, load the plugin configuration, prepare the secure operating environment, and check whether the hardware security element is available. This interface is a prerequisite for using all other interfaces, ensuring that the plugin is in a ready state before subsequent interfaces can be called.

[0029] AgentRegister(requestJson) is the agent registration interface, used to initiate an agent identity registration request to the system, call the hardware security element to generate an asymmetric key pair; collect ICCID and IMSI to generate a feature digest; construct registration materials containing a public key, feature digest, agent ID, and terminal device identifier; submit a registration application to the identity and credential management platform, i.e., the identity management platform mentioned above, and receive the issued agent identity credentials.

[0030] The `GetAccessToken(requestJson)` interface is used to obtain a short-term access token for platform access control. After successful two-way authentication, the smart agent secure communication platform issues a short-term access token, and this interface is responsible for obtaining and caching this token. The token is only used for platform-level access control; the confidentiality and integrity of business messages are still guaranteed by independent message-level cryptographic signatures and are not the sole reliance for secure transmission.

[0031] VerifySignature(requestJson) is a signature verification interface used to verify the validity of digital signatures. It receives the data to be verified and its signature sent by the other party. The plugin verifies whether the signature is correct and confirms the authenticity of the message source and whether the content has been tampered with.

[0032] KeyAgreement(requestJson) is a key negotiation interface used to perform fused key negotiation. After two-way authentication is successful, the two communicating parties exchange key negotiation materials through this interface. It supports the parallel execution of SM2 negotiation and post-quantum key encapsulation mechanism, and inputs the shared secret of the two outputs into HKDF to fuse and derive the session key.

[0033] EncDecAcpPackage(requestJson) is a message encryption / decryption interface used to encrypt and decrypt business messages, and automatically inject / verify anti-replay fields. When the sending side calls this interface, it automatically injects four anti-replay fields—timestamp, random number, request identifier, and session identifier—into the business message, and then uses the session key to perform encryption and signing. When the receiving side calls this interface, it performs triple anti-replay verification—time window verification, random number uniqueness verification, and request identifier idempotency verification—and then verifies the signature and decrypts the message, outputting plaintext business data.

[0034] DestroySession(requestJson) is a session destruction interface used to destroy the local session context. This interface is called during the session revocation process, and the plugin destroys the local session key, clears the session cache, and releases related resources to ensure that the session context is thoroughly cleaned up.

[0035] After the arrangement, such as Figure 3 As shown, step S1 specifically includes the following timing steps: Step S101: The first terminal agent initiates an identity registration request to the identity management platform by calling the AgentRegister interface of the first terminal security plugin.

[0036] In this embodiment, the first terminal intelligent agent and its corresponding first terminal security plugin maintain a separation between business application and security agent. They communicate through a standardized interface, and the first terminal intelligent agent does not directly access the key or perform cryptographic operations. Therefore, even if the first terminal intelligent agent's code is reverse-engineered or tampered with, an attacker cannot steal the key because the key is always internal to the first SIM or eSIM card and is isolated and accessed through the first terminal security plugin. There is no application programming interface that can export the private key to the first terminal intelligent agent. Simultaneously, the anti-replay fields forcibly injected by the first terminal security plugin, such as timestamps, random numbers, request identifiers, and session identifiers, cannot be bypassed or tampered with by the terminal A side, thus ensuring the confidentiality, integrity, and non-repudiation of messages at the application layer.

[0037] The S102 first terminal security plugin calls the first SIM or eSIM card to generate an asymmetric key pair, in which the private key cannot be exported.

[0038] The S103 first SIM or eSIM card returns a public key identifier to the first terminal security plug-in.

[0039] The S104 first terminal security plugin collects the Integrated Circuit Card Identifier (ICCID) and International Mobile Subscriber Identity (IMSI) of the first SIM or eSIM card and generates a feature summary.

[0040] In this embodiment, the Integrated Circuit Card Identifier (ICCID) is the unique hardware serial number of the first SIM or eSIM card, burned into the chip, unique and unchangeable, used to identify the hardware identity of the first SIM or eSIM card; the International Mobile Subscriber Identity (IMSI) is the operator user account identifier stored in the first SIM or eSIM card, used to identify the user identity. By collecting the hardware identifier and user account identifier represented by the ICCID and IMSI, combined with the intelligent agent identifier and terminal device identifier, the digital identity of the intelligent agent is bound to the physical hardware and real user information. If the software of the first terminal intelligent agent is cloned and run on another terminal device, the system will refuse authentication because the ICCID and IMSI corresponding to the SIM or eSIM card of the new terminal device are inconsistent with those previously bound, thereby effectively preventing identity forgery and impersonation.

[0041] In this embodiment, the feature digest refers to a fixed-length, irreversible encrypted string calculated by the first terminal security plugin after concatenating the collected ICCID and IMSI according to specific rules and using a hash algorithm, such as the national cryptographic standard SM3.

[0042] Its logical representation is: Feature Digest FH = Hash(ICCID∥IMSI), where ∥ represents string concatenation, and the preferred hash algorithm is SM3 or SHA-256.

[0043] Specifically, the first terminal security plugin reads the underlying data through the first SIM or eSIM card driver, performs splicing within the Trusted Execution Environment (TEE), and calls the national cryptographic SM3 algorithm to calculate the digest value.

[0044] The first terminal security plugin submits the feature digest, public key, and Agent ID to the identity and credential management platform. Upon receiving the feature digest, the identity management platform stores it as the hardware identity information of the agent, using it for device legitimacy verification during subsequent challenge code authentication, thus achieving a trusted binding between the first SIM or eSIM card, the first terminal agent, and the communication session.

[0045] The S105 first terminal security plug-in submits the public key, feature digest, agent identifier, and terminal device identifier to the identity and credential management platform.

[0046] In this embodiment, the first terminal device is the physical carrier and operating environment of the first SIM or eSIM card. More precisely, the first SIM or eSIM card is integrated inside the first terminal device and is a component of the first terminal device. The terminal device identifier is the unique serial number of the first terminal device.

[0047] The S106 identity management platform performs legality verification and binding relationship verification.

[0048] In this embodiment, legality verification and binding relationship verification are two sequential checks with different purposes. Legality verification aims to confirm the authenticity and completeness of the registration request, including at least: verifying whether the signature of the submitted materials is correct; verifying whether the format and parameters of the public key comply with the relevant standards of the State Cryptography Administration; verifying whether the format of the feature digest is correct; and verifying whether the formats of the intelligent agent identifier and the terminal device identifier are legal and compliant. The core purpose of this verification is to confirm that the registration materials themselves are legal and valid, and to ensure that the submitted content has not been tampered with and comes from a legitimate terminal.

[0049] The binding relationship verification in this embodiment aims to confirm whether the hardware identity and software identity constitute a trusted binding relationship. When the identity management platform receives a new registration request, it compares the submitted information with existing binding records. It checks whether the ICCID and terminal device identifier have been bound to the registration records of other intelligent agents. If they have, it is determined to be a risk of device reuse or SIM card replacement. It checks whether the pairing of ICCID and IMSI is consistent with the pairing relationship registered on the operator's side. If they are inconsistent, it is determined to be an illegal card. It checks whether the Agent ID has been bound to other ICCIDs or terminal device identifiers. If it has, it is determined to be a risk of intelligent agent cloning or theft. It checks whether the terminal device identifier is consistent with the device fingerprint in the historical record. If they are inconsistent, it is determined to be a risk of device replacement. Through the above multiple comparisons, it is ensured that the hardware identity, user identity, software identity, and device identity corresponding to the registration request constitute a unique and exclusive trusted binding relationship, thereby preventing identity forgery behaviors such as the same intelligent agent being registered to multiple devices, the same SIM card being shared by multiple intelligent agents, or cloned software running on other devices.

[0050] Therefore, through legality verification and binding relationship validation, the identity management platform can finally confirm that the registration request is legitimate and the binding is trustworthy, thereby issuing identity credentials.

[0051] After the S107 identity management platform verifies the identity, it issues identity credentials or trusted identity identifiers to the first terminal security plugin.

[0052] In this embodiment, the identity credential is essentially a digital credential that binds the multiple identity information of the intelligent agent, including the software identity Agent ID, the hardware identity ICCID / IMSI digest, and the device identity, with the public key, and is then endorsed and issued by the platform.

[0053] The S108 first terminal security plugin notifies the first terminal smart agent that registration is complete and caches the credential reference.

[0054] The S109 first terminal security plugin reports the Agent Card information to the Agent Discovery and Registration Center. The Agent Card includes at least: ID, name, version, capabilities, input parameters, output parameters, communication endpoint, authentication method, constraints, and metadata.

[0055] The S110 agent discovery and registration center performs legality verification on agent card information, completes capability cataloging, and builds a query index.

[0056] In this embodiment, when other intelligent agents, such as the second terminal intelligent agent, need to call the service, they can submit task type or capability keywords to the intelligent agent discovery and registration center to retrieve the target intelligent agent and obtain the corresponding secure communication policy, such as supported encryption suites and authentication strength requirements.

[0057] The S2 first terminal security plugin performs security verification on the first intelligent agent initiating the session based on the first challenge code issued by the intelligent agent security communication platform. After successful verification, the intelligent agent security communication platform sends an authentication request to the second terminal intelligent agent. After completing two-way authentication, the session key of the first terminal intelligent agent and the second terminal intelligent agent is obtained.

[0058] In this embodiment, as Figure 4 As shown, the specific implementation of this step includes the following steps: S201 The first terminal intelligent agent initiates a secure session establishment request to the intelligent agent secure communication platform.

[0059] In this embodiment, the secure session establishment request is used to request the establishment of a secure communication session between the first terminal agent and the second terminal agent.

[0060] After receiving the session establishment request, the S202 intelligent agent secure communication platform generates a session identifier and a first challenge code for authenticating the first terminal intelligent agent, and returns the session identifier and the first challenge code to the first terminal intelligent agent.

[0061] S203 The first terminal intelligent agent calls the first terminal security plugin to request the use of the private key in the first SIM or eSIM card to sign the first challenge code and the session identifier; the first terminal security plugin calls the first SIM or eSIM card to perform digital signature operation inside the chip to generate a first signature result; the first SIM or eSIM card returns the first signature result and the identity certificate of the first terminal intelligent agent to the first terminal security plugin.

[0062] In this embodiment, the first terminal security plugin calls the signature interface SignBySm2 to send a signature request to the first SIM or eSIM card. Since the private key cannot be exported, the signature request carries at least the first private key index, the first challenge code, and the signature algorithm identifier, such as SM2 or ML-DSA. The first SIM or eSIM card finds the corresponding private key in the internal secure storage area according to the first private key index, performs digital signature operation on the first challenge code using the signature algorithm inside the chip, generates the first signature result, and returns the first signature result to the first terminal security plugin. S204 The first terminal security plugin sends the first signature result and the identity credentials of the first terminal intelligent agent to the intelligent agent security communication platform.

[0063] In this embodiment, the first terminal security plugin does not carry the first challenge code when sending, because the intelligent agent secure communication platform already holds the first challenge code. The first terminal security plugin is a software-layer security proxy module deployed in the first terminal device, and the first SIM or eSIM card is a hardware security chip integrated inside the first terminal device. The two communicate through a standardized interface to form a layered collaborative architecture.

[0064] Specifically, the first SIM or eSIM card is a hardware chip with independent secure storage and cryptographic operation capabilities. It contains at least one non-exportable private key storage area for key generation, signature verification, and data encryption / decryption operations. This private key is generated internally by the first SIM or eSIM card. The plaintext private key never leaves the hardware boundary during the chip's lifecycle. The operating system layer and upper-layer applications cannot read or export the plaintext private key through any application programming interface. In a preferred embodiment, the SIM or eSIM card can store multiple types of private keys, including but not limited to: SM2 private keys for traditional digital signatures, ML-KEM private keys for post-quantum key encapsulation, and ML-DSA private keys for post-quantum digital signatures. Different types of private keys correspond to different cryptographic operation scenarios: the SM2 or ML-DSA private key is used for challenge code signing and business message signing; the SM2 and ML-KEM private keys are used for fusion key negotiation. Each private key is provided to the terminal security plugin via a key index, and the terminal security plugin does not directly access any plaintext private key. Similarly, the second terminal security plugin is a software-layer security proxy module deployed in the first terminal device, and the second SIM or eSIM card is a hardware security chip integrated inside the second terminal device.

[0065] In this embodiment, the first terminal security plugin is pre-configured with a first key index corresponding to the private key of the first SIM or eSIM card. The first terminal security plugin does not directly hold or access the plaintext private key. Instead, when a signature operation is required, it passes the first key index and the data to be signed to the first SIM or eSIM card. The first SIM or eSIM card locates the corresponding private key within its chip based on the first key index, completes the signature operation, and returns the signature result. The plaintext private key never leaves the hardware boundary during the chip's lifecycle. Therefore, the first terminal security plugin uses the key index corresponding to the private key of the first SIM or eSIM card to sign the first challenge code. Specifically, one possible signature result is generated using a standard cryptographic student, denoted as Sig_skA(Challenge_A).

[0066] Therefore, in summary, after generating the asymmetric key pair, the first SIM or eSIM card assigns a unique key index to the private key and returns the key index to the first terminal security plugin. The first terminal security plugin stores the key index but cannot read or export the plaintext private key. When a signature operation is required, the first terminal security plugin sends the key index and the data to be signed to the first SIM or eSIM card, calls the first SIM or eSIM card to locate the corresponding private key within the chip based on the key index, and performs the signature operation. After completing the signature, the first SIM or eSIM card returns the signature result to the first terminal security plugin. The key index is pre-set within the first terminal security plugin.

[0067] The S205 intelligent agent secure communication platform completes signature verification and credential validity verification on the terminal A side.

[0068] In this embodiment, the signature verification and credential validity verification performed by the intelligent agent secure communication platform are two sequential checks with different purposes. The signature verification includes: First, the intelligent agent secure communication platform extracts the public key of the first terminal security plugin from the identity credential submitted by the first terminal security plugin. This public key is generated by the first SIM or eSIM card and issued by the identity and credential management platform along with the identity credential; the credential contains this public key information. Then, the intelligent agent secure communication platform extracts the signature result, namely the signature value of the first terminal security plugin using the private key of the first SIM or eSIM card for the first challenge code Challenge_A and the first challenge code Challenge_A. Finally, the intelligent agent secure communication platform verifies the signature using the SM2 digital signature verification algorithm.

[0069] One verification process can be as follows: Calculate the message digest of Challenge_A using the SM3 message digest algorithm; use the public key extracted from the credential to verify the matching of the signature value and the message digest according to the SM2 signature verification algorithm; if the verification is successful, it confirms that the signature was indeed signed by the first smart terminal holding the corresponding private key, and that the message has not been tampered with during transmission; if the verification fails, the authentication request is rejected.

[0070] The purpose of credential validity verification is to confirm that the identity credential itself is legitimate, valid, and not revoked, preventing the use of expired, forged, or revoked credentials for authentication. The specific verification process includes: the identity credential is essentially a digital certificate or signature data packet issued by the identity and credential management platform. The intelligent agent secure communication platform uses the public key of the identity and credential management platform to verify the platform's digital signature on the credential; if the verification passes, it confirms that the credential was indeed issued by a legitimate platform and its content has not been tampered with; if the verification fails, the credential is determined to be forged. After all verification items pass, the intelligent agent secure communication platform confirms the legitimacy of the first terminal's identity and proceeds to S205 to send a peer authentication request to the second terminal; if any verification fails, the authentication request is rejected.

[0071] In this embodiment, the signature verification and credential validity verification performed by the intelligent agent secure communication platform are two sequential checks with different purposes. The purpose is that if credential validity verification is performed first, attackers could use a large number of forged credentials to consume the platform's computing resources for certificate chain verification and revocation status queries. Signature verification also involves asymmetric cryptographic operations. Therefore, placing credential verification after signature verification ensures that credential verification is performed only after the signature is confirmed to be genuine. Even if a large number of requests are initiated using forged credentials, they will be directly discarded during the signature verification stage because they cannot pass the verification, thus avoiding the consumption of platform resources by invalid credential verification.

[0072] After the first terminal side verification is successful in S206, the intelligent agent secure communication platform sends a two-way authentication request to the second terminal intelligent agent. The two-way authentication request includes at least the session identifier and a second challenge code for authenticating the second terminal intelligent agent.

[0073] After receiving the two-way authentication request, the second terminal intelligent agent S207 calls the second terminal security plugin to request the use of the private key in the second SIM or eSIM card to sign the second challenge code; the second terminal security plugin calls the second SIM or eSIM card to perform digital signature operation on the second challenge code inside the chip to generate a second signature result; the second SIM or eSIM card returns the second signature result and the identity certificate of the second terminal intelligent agent to the second terminal security plugin.

[0074] In this embodiment, the second terminal security plugin calls the signature interface SignBySm2 to send a signature request to the second SIM or eSIM card. The signature request carries at least the second private key index, the second challenge code and the signature algorithm identifier. The second SIM or eSIM card finds the corresponding private key in the internal secure storage area according to the second private key index, performs a digital signature operation on the second challenge code using the signature algorithm inside the chip, generates a second signature result, and returns the second signature result to the second terminal security plugin; The S208 second terminal security plugin sends the signature result and identity credentials back to the intelligent agent secure communication platform.

[0075] Therefore, S204 and S207 correspond to the challenge code signature operations on side A and side B, respectively, and both accurately reflect the hardware security mechanism in which the terminal security plugin initiates the signature request only through the index, and the SIM or eSIM card completes the private key location and signature operation.

[0076] The S209 intelligent agent secure communication platform completes the signature verification and credential validity check on the terminal B side.

[0077] The S2108 intelligent agent secure communication platform sends back platform verification materials and peer identity digest to terminal A, and terminal A completes two-way identity verification.

[0078] In this embodiment, the platform verification materials refer to the evidence provided by the secure communication platform to the first terminal intelligent agent proving that it is a legitimate and trustworthy platform. The secure communication platform uses its private key to sign the entire authentication process, including the challenge code signature of the first terminal intelligent agent and the signature result of the second terminal intelligent agent. The first terminal intelligent agent uses the platform certificate to verify this signature, thereby confirming the platform's authenticity. The peer identity digest refers to the identity confirmation information provided by the secure communication platform to the second terminal intelligent agent after verification, including at least the second terminal intelligent agent's public key or its digest, the second terminal intelligent agent's identity credentials, and the second terminal intelligent agent's intelligent agent identifier. The first terminal intelligent agent confirms the source of the returned data as a legitimate platform by verifying the platform's verification materials, and confirms the communication peer as a legitimate second terminal intelligent agent by using the peer identity digest. The two work together to prevent man-in-the-middle attacks.

[0079] S211 The first terminal intelligent agent sends the first SM2 key negotiation material and the first PQC-KEM key negotiation material to the intelligent agent secure communication platform; after the intelligent agent secure communication platform completes the processing, it returns the first key negotiation result to the first terminal intelligent agent.

[0080] In this embodiment, the key negotiation material refers to the set of cryptographic parameters exchanged by the communicating parties to calculate the final shared secret, including the first SM2 key negotiation material and the first PQC-KEM key negotiation material. The SM2 key negotiation material is a negotiation parameter based on traditional elliptic curve cryptography, used to establish a shared secret between the two parties; the PQC-KEM key negotiation material is a negotiation parameter based on post-quantum cryptography, used to establish another shared secret to resist attacks from future quantum computers. These two materials are used in parallel, and the two resulting shared secrets are ultimately merged to derive the final session key. In one implementation scheme, after two-way authentication is completed, the first terminal agent sends the first SM2 key negotiation material and the first PQC-KEM key negotiation material to the agent secure communication platform. After the intelligent agent secure communication platform completes the processing, it returns the first key negotiation result to the first terminal intelligent agent. The first key negotiation result includes the second challenge code and a random number generated by the intelligent agent secure communication platform.

[0081] In this embodiment, the first key negotiation result is a response message returned by the intelligent agent secure communication platform to the first terminal intelligent agent after receiving the key negotiation materials sent by the first terminal intelligent agent. The response message securely transmits the second challenge code and random number R necessary for the first terminal intelligent agent to calculate the session key.

[0082] In this embodiment, the random number R is a one-time random number generated by the platform independently calling the random number generator after receiving the key negotiation materials. It is used to enhance the entropy value of the session key and ensure that the session keys derived from side A and side B are bound to the current session.

[0083] S212 The second terminal intelligent agent sends the second SM2 key negotiation material and the second PQC-KEM key negotiation material to the intelligent agent secure communication platform; after the intelligent agent secure communication platform completes the processing, it returns the second key negotiation result to the second terminal intelligent agent.

[0084] In one implementation of this embodiment, the second terminal agent sends the second SM2 key negotiation material and the second PQC-KEM key negotiation material to the agent secure communication platform; after the agent secure communication platform completes the processing, it returns the second key negotiation result to the second terminal agent, and the second key negotiation result includes the first challenge code and the random number.

[0085] S213 The first terminal agent and the second terminal agent respectively derive the same session key based on the SM2 key negotiation result and the PQC-KEM key negotiation result, combined with their respective challenge codes and the random number, through the HKDF key derivation algorithm.

[0086] In this embodiment, the first terminal agent holds a first challenge code and a received second challenge code, while the second terminal agent holds a second challenge code and a received first challenge code. Each agent locally calls the HKDF function, with inputs including at least: a first shared secret obtained through SM2 negotiation, a second shared secret obtained through PQC-KEM decapsulation, a combination of their respective challenge codes, and the random number. The HKDF outputs a fixed-length, cryptographically secure session key for the encryption and decryption of subsequent business messages.

[0087] In a preferred embodiment, HKDF (HMAC-based Extract-and-Expand Key Derivation Function) is a key derivation algorithm standardized by the Internet Engineering Task Force (IETF) in RFC 5869. Its core function is to transform multi-source input materials into one or more cryptographically strong secret keys. By executing SM2 key negotiation and PQC-KEM key encapsulation mechanisms in parallel, and merging the two shared secrets into HKDF for derivation, this embodiment balances compatibility with the existing national cryptographic system and the smooth evolution capability of post-quantum cryptography. Even if quantum computing technology makes breakthroughs in the future, the confidentiality of the session key can still be effectively guaranteed.

[0088] In this embodiment, the first shared secret obtained through SM2 negotiation and the second shared secret obtained through PQC-KEM decapsulation can each include: SM2 key negotiation follows the national standard "SM2 Elliptic Curve Public Key Cryptography Algorithm Part 3: Key Exchange Protocol" (GB / T 32918.3-2016). The SM2 key negotiation materials sent by the first terminal agent typically include the following information: Temporary public key RA: the public key portion of a temporarily generated key pair by the first terminal agent; Elliptic curve parameters: identifying the specific elliptic curve used, such as the SM2 curve parameters recommended by the national cryptographic standard; Key negotiation algorithm identifier: explicitly indicating that the SM2 key exchange protocol is used; Optional identity information: such as the first terminal agent's digital certificate or identity identifier, used to assist in identity authentication. After receiving the above materials, the second terminal agent generates its own temporary key pair, namely a temporary private key rB and a temporary public key RB, and returns the public key RB as part of the key negotiation response material to the first terminal agent. Then, both parties use their own temporary private key and the other party's temporary public key to calculate the first shared secret through the SM2 key exchange protocol.

[0089] PQC-KEM (Post-Quantum Cryptography Key Encapsulation Mechanism) is a public-key cryptosystem. The first terminal agent sends the following: The initiator first generates a temporary KEM key pair, including a KEM private key and a KEM public key. Then, it sends the KEM public key as part of the PQC-KEM key negotiation material to the second terminal agent. The responder's actions and return: After receiving the KEM public key, the responder executes the KEM encapsulation algorithm. This algorithm generates a shared secret K_kem and a corresponding ciphertext. The second terminal agent then returns the ciphertext as part of the key negotiation response material to the first terminal agent. The initiator decapsulates the ciphertext using its own KEM private key to obtain the second shared secret.

[0090] S3 The first terminal agent submits a service message to the first terminal security plugin. The first terminal security plugin signs and encrypts the service message based on the session key and forwards it to the second terminal agent through the agent security communication platform. The second terminal security plugin verifies and decrypts the encrypted service message, outputs a plaintext service message, and transmits it to the agent security communication platform. The agent security communication platform then sends the plaintext service message back to the first terminal agent.

[0091] In this embodiment, as Figure 5 As shown, the specific implementation of this step includes the following steps: The S301 first terminal intelligent agent submits the business message payload to the first terminal security plugin.

[0092] The S302 first terminal security plugin calls the message encryption / decryption interface EncDecAcpPackage to inject a timestamp, a nonce, a request identifier (requestId), and a session identifier (sessionId) into the service message payload.

[0093] In this embodiment, the timestamp is used for replay attack prevention, timing verification, and timeout judgment; the nonce is used to enhance randomness, prevent pre-calculation attacks and fixed message cracking, and form a double anti-replay protection with the timestamp; the request identifier requestId is a globally unique number for a single business request or interaction, used for idempotency verification at the request level; the session identifier sessionId is a unique identity number for the entire session period after the two ends of communication establish a trusted communication link, used to mark the authenticated trusted session.

[0094] The S303 first terminal security plugin calls the SignBySm2 interface to perform a signature, and calls the EncDecAcpPackage interface to perform encryption using the session key derived from S211, and sends the encrypted security message to the intelligent agent security communication platform.

[0095] In one embodiment, the EncDecAcpPackage interface can perform the following functions: Obtaining the key: The interface internally uses the session key derived in step S211; Selecting the algorithm: Employing SM4 and other national standard symmetric encryption algorithms. SM4 is a block cipher algorithm with fast encryption and decryption speeds, making it very suitable for protecting large amounts of business data; Performing encryption: The interface uses the session key and the SM4 algorithm to encrypt the plaintext payload of the business message into ciphertext; Encapsulating and outputting: The interface encapsulates the ciphertext, algorithm identifier, and other information into a secure message for subsequent signing and transmission.

[0096] After performing routing and policy checks, the S304 intelligent agent secure communication platform forwards the security message to the second terminal security plugin.

[0097] In this embodiment, the agent secure communication platform extracts the target agent identifier, i.e., the Agent ID of the second terminal agent, from the security message received in S303. Then, it queries the agent information registered in the agent discovery and registration center to find the communication endpoint and network address where the second terminal agent is currently located, and determines which target address the message should be forwarded to. After determining the target address, a series of compliance checks are performed on the message. For example, the agent secure communication platform will confirm whether the first terminal agent has been authorized to send messages to the second terminal agent, i.e., whether the two parties have completed two-way authentication and established a valid session, and whether the current communication behavior conforms to the preset security policy template, such as whether the communication frequency is abnormal or the message size is compliant. If the policy check fails, such as the session has expired or the communication frequency is abnormal, the message will be refused to be forwarded.

[0098] After receiving the security message, the S305 second terminal security plugin first extracts the timestamp, random number and request identifier fields carried in the message, and performs anti-replay verification.

[0099] In this embodiment, the anti-replay verification includes time window verification, random number uniqueness verification, and request identifier idempotency verification. The time window verification is used to prevent timeout replay attacks. The receiving side compares the timestamp carried in the message with the local current time; if the time difference exceeds a preset threshold, the message is rejected. The random number uniqueness verification is used to prevent short-term replay attacks. The receiving side maintains a cache of used random numbers; if the random number for the current message already exists in the cache, the message is rejected. Preferably, the time window verification is used in combination with the random number uniqueness verification to defend against replay attacks on different time dimensions. The request identifier idempotency verification is used to prevent the same business request from being executed repeatedly due to network retransmission or timeout retries. The receiving side maintains a record of processed request identifiers. If the request identifier of the current message has been marked as processed, the stored processing result is returned directly without repeating the business logic.

[0100] If any anti-replay check fails, the message is discarded without signature verification. After all anti-replay checks pass, the second terminal security plugin calls the VerifySignature interface to perform digital signature verification on the security message to confirm the authenticity of the message source and the integrity of the content. After the signature verification passes, the EncDecAcpPackage interface is called to perform decryption using the session key, and the decrypted plaintext business data is output to the second terminal intelligent agent.

[0101] Therefore, in summary, step S305 is further divided into the following steps: Pre-filtering: The receiving side first extracts the timestamp, random number, and request identifier fields from the message, and performs time window verification, random number uniqueness verification, and request identifier idempotency verification. If any of these fail, the message is discarded without signature verification to avoid the computational resource consumption of asymmetric signature verification.

[0102] Core authentication: After all anti-replay checks pass, the receiving side performs digital signature verification on the message to confirm that the sender's identity is genuine and the content has not been tampered with.

[0103] Final decryption: After successful signature verification, decryption is performed using the session key, outputting plaintext business data.

[0104] Therefore, in one specific implementation, after receiving a security message, the second terminal security plugin first extracts the timestamp, random number, and request identifier fields carried in the message, and performs time window verification, random number uniqueness verification, and request identifier idempotency verification to filter out expired or duplicate replay messages. After all anti-replay verifications pass, the signature verification interface is called to perform digital signature verification on the message to confirm the authenticity of the message source and the integrity of the content. After the signature verification passes, the session key is used to perform decryption and output plaintext business data to the second terminal intelligent agent.

[0105] The S306 second terminal intelligent agent generates a response message, which is then signed by the second terminal security plugin through the SignBySm2 interface, and encrypted using the session key through the EncDecAcpPackage interface before being sent back to the intelligent agent secure communication platform.

[0106] The S307 intelligent agent secure communication platform transmits the security response back to the first terminal intelligent agent.

[0107] In this embodiment, after receiving the security response, the first terminal security plugin calls the signature verification interface VerifySignature to perform signature verification and calls the message encryption / decryption interface EncDecAcpPackage to perform decryption in the same manner as step S305, and outputs the decrypted plaintext response to the first terminal intelligent agent.

[0108] The intelligent agent secure communication platform described in S4 determines whether a risk event has been triggered during the session's running state. If no risk event has been triggered and the session has expired, it triggers session renegotiation to update the session key and resumes session operation; otherwise, If a risk event is triggered, the intelligent agent secure communication platform determines the risk level. If the risk level is not higher than a preset threshold, the session validity period is shortened and the session continues. If the risk level is higher than the preset threshold, the local session context is destroyed. Re-authenticate the session. If successful, rebuild the session and resume communication; otherwise, refuse communication.

[0109] like Figure 6 As shown, the specific implementation of step S4 includes: The S401 intelligent agent secure communication platform continuously monitors and determines whether a risk event is triggered during the session.

[0110] If no risk event is triggered, S402 determines whether the session has expired. If it has not expired, the session is maintained. If it has expired, the KeyAgreement interface is called to trigger session renegotiation to update the session key and resume session operation.

[0111] When a risk event is triggered, the risk control engine inside the intelligent agent secure communication platform determines the risk level.

[0112] When the risk level is not higher than the preset threshold, S404 will resume session operation after limiting execution capabilities and shortening the TTL.

[0113] In this embodiment, the capability restriction refers to downgrading the functional permissions of the current session. For example, if the agent could originally perform operations such as reading data, writing configuration, and initiating flight, after triggering a low-risk alarm, the system narrows its permissions to only allow reading status or reporting heartbeats, prohibiting it from performing sensitive operations such as issuing control commands, in order to minimize the potential damage scope of the risky session. TTL, or Time To Live, refers to the remaining validity period of the current session key or access token. The system forcibly shortens the remaining validity period from a long period, such as 1 hour, to an extremely short period, such as 5 minutes, causing the session to enter an expired state in a very short time, triggering an expiration judgment, thereby forcibly initiating session renegotiation and ensuring that the risky state does not persist for a long time. The preset threshold can be a fixed risk scoring threshold pre-configured by the system administrator or security policy template.

[0114] When the risk level is higher than a preset threshold, S405 performs the following operations in sequence: Call the DestroySession interface to destroy the local session context; revoke the current access token; destroy the current session key; add the current random number and request identifier to the blacklist window, and refuse duplicate requests with the same random number or request identifier during the blacklist window period; notify the terminal to re-authenticate.

[0115] If re-authentication is successful, the S406 will rebuild the session and resume communication; if re-authentication fails, communication will be rejected and an alarm audit will be triggered.

[0116] In this embodiment, re-establishing the session refers to re-executing the two-way authentication and fusion key negotiation process to establish a new session.

[0117] Therefore, this embodiment achieves differentiated abnormal response through the above-mentioned hierarchical handling mechanism: for high-risk events, strong measures such as revocation, destruction, and blacklisting are used to directly interrupt communication; for low-risk events, the intelligent agent is given an observation period by reducing its weight and shortening the validity period, thereby controlling potential risks without affecting the basic business connectivity, avoiding task interruption due to misjudgment, and improving the fault tolerance of the system and user experience.

[0118] In one specific embodiment of this application, the first terminal intelligent agent can be a mobile phone intelligent agent A, and the second terminal intelligent agent can be a robot or an IoT terminal intelligent agent, more specifically a robot intelligent agent B. Similarly, the first terminal security plugin is specifically security plugin A, and the second terminal security plugin is specifically security plugin B. The intelligent agent secure communication platform is referred to as the secure communication platform, and the identity management platform is referred to as the identity / credential management platform. The following embodiments use mobile phone terminal intelligent agent A and robot intelligent agent B as scenarios to describe the implementation steps of this method, specifically including: I. Application process for intelligent agent identity credentials, such as Figure 7The application sequence for identity credentials includes: mobile smart agent A initiates an identity registration request to the identity / credential management platform through the smart agent registration interface of security plugin A.

[0119] Security plugin A calls SIM or eSIM security chip A to generate an asymmetric key pair; the private key cannot be exported.

[0120] The SIM or eSIM security chip A returns a public key identifier to the security plug-in A.

[0121] Security Plug-in A collects the integrated circuit card identification code and international mobile subscriber identification code of the SIM or eSIM security chip A, and then uses a hash algorithm to generate a feature digest after concatenation.

[0122] Security plugin A submits the public key, feature digest, agent identifier, and terminal device identifier to the identity / credential management platform.

[0123] The identity / credential management platform performs legality verification and binding relationship validation.

[0124] The identity / credential management platform issues identity credentials to security plugin A.

[0125] Security plugin A notifies the mobile smart agent A that registration is complete and caches the credential reference.

[0126] In the above-described intelligent agent identity credential application process, each terminal intelligent agent is configured with a terminal security plugin. The security plugin is used to establish a trusted connection between each terminal intelligent agent and its corresponding SIM card or eSIM card. Each terminal intelligent agent verifies its identity with the identity management platform through its corresponding terminal security plugin. This includes: the terminal security plugin responding to the identity registration request initiated by the terminal intelligent agent to obtain the feature digest and public key of the SIM or eSIM, submitting the identity authentication information containing the feature digest and public key of the SIM or eSIM to the identity management platform to apply for identity credentials, the identity management platform verifying the identity authentication information, and issuing the corresponding terminal intelligent agent's identity credentials after verification; and each terminal security plugin receiving and saving the identity credentials of each terminal intelligent agent and notifying each terminal intelligent agent.

[0127] II. Flowchart of Two-Way Authentication and Fusion Key Negotiation, as follows Figure 8 As shown, it includes the following steps: Mobile agent A initiates a secure session establishment request (SessionInit) to the secure communication platform. After receiving the request, the secure communication platform generates a session identifier (sessionId) and a platform challenge code (Challenge_A) for authenticating mobile agent A, and returns both to mobile agent A.

[0128] The mobile smart agent A calls the security plugin A to request the use of the private key in the SIM / eSIM chip A to sign parameters such as Challenge_A and sessionId; the security plugin A further calls the SIM / eSIM chip A to complete the signing operation, and the SIM / eSIM chip A returns the signing result and identity credentials to the security plugin A.

[0129] Security plugin A sends the signature result and identity credentials to the secure communication platform (without carrying Challenge_A, as the platform already holds them).

[0130] The secure communication platform verifies the signature result of the mobile phone's intelligent agent A and checks the validity of the identity credential.

[0131] After the mobile intelligent agent A passes the verification, the secure communication platform sends a two-way authentication request, SessionInvite, to the robot intelligent agent B. This request includes a sessionId and a platform challenge code, Challenge_B, used to authenticate the robot intelligent agent B.

[0132] After receiving SessionInvite, robot agent B calls security plugin B to request that Challenge_B be signed using the private key in SIM / eSIM chip B; security plugin B further calls SIM / eSIM chip B to complete the signing operation, and SIM / eSIM chip B returns the signing result and identity credentials to security plugin B.

[0133] Security plugin B returns the signature result and identity credentials to the secure communication platform; the secure communication platform verifies the signature result on the robot agent B's side and checks the validity of the identity credentials.

[0134] After the robot agent B passes the verification, the secure communication platform returns the platform verification materials and the identity digest of robot agent B (excluding Challenge_B, which will be transmitted through a secure channel in subsequent steps) to the mobile phone agent A. Mobile phone agent A completes the peer identity verification based on the materials, thereby completing the identity authentication process between the two parties in the session.

[0135] Mobile agent A sends SM2 key negotiation materials and PQC-KEM key negotiation materials to the secure communication platform respectively; after completing the corresponding processing, the secure communication platform returns the key negotiation result to mobile agent A. The key negotiation result includes Challenge_B (obtained by the platform based on sessionId) and a random number R generated by the secure communication platform.

[0136] Robot agent B sends SM2 key negotiation materials and PQC-KEM key negotiation materials to the secure communication platform respectively; after completing the corresponding processing, the secure communication platform returns the key negotiation result to robot agent B. The key negotiation result includes Challenge_A (obtained by the platform based on sessionId) and a random number R generated by the secure communication platform.

[0137] Mobile phone agent A and robot agent B, based on the SM2 key negotiation results and PQC-KEM key negotiation results respectively, and combined with their respective challenge codes (A holds Challenge_A and the received Challenge_B, B holds Challenge_B and the received Challenge_A) and random number R, perform fusion calculations using the HKDF key derivation algorithm to derive the same session key.

[0138] III. Secure message transmission process, such as Figure 9 As shown, it includes the following steps: The mobile smart agent A submits a business message to the security plugin A.

[0139] Security plugin A calls the message encryption / decryption interface (EncDecAcpPackage) to inject timestamp, random number, request identifier, and session identifier fields into the business message.

[0140] Security plugin A calls the signature interface (SignBySm2) to perform a signature, and calls the message encryption / decryption interface (EncDecAcpPackage) to perform encryption using the session key, and sends the secure message to the secure communication platform.

[0141] After performing routing and policy checks, the secure communication platform forwards the security message to security plugin B.

[0142] Security plugin B performs anti-replay verification, calls the signature verification interface (VerifySignature) to verify the signature, calls the message encryption / decryption interface (EncDecAcpPackage) to perform decryption using the session key, and outputs plaintext business data to robot agent B.

[0143] Robot agent B generates a response message, which is then signed by the signature interface (SignBySm2) called by security plugin B, and encrypted using the session key by the message encryption / decryption interface (EncDecAcpPackage) before being sent back to the secure communication platform.

[0144] The secure communication platform sends the security response back to the mobile smart agent A.

[0145] IV. Session cancellation and exception handling process, including the following steps: The secure communication platform determines whether a risk event has been triggered while the session is running.

[0146] If no risk event is triggered, determine whether the session has expired; if it has expired, call the key negotiation interface (KeyAgreement) to trigger session renegotiation to update the session key and resume session operation.

[0147] When a risk event is triggered, the risk control engine inside the secure communication platform determines the risk level.

[0148] When the risk level is not higher than the preset threshold, the execution capability is limited and the session resumes operation after the TTL is shortened.

[0149] When the risk level exceeds the preset threshold, the DestroySession interface is called sequentially to destroy the local session context, revoke the access token, destroy the session key, add the random number and request identifier to the blacklist window, and notify the terminal to re-authenticate.

[0150] If re-authentication is successful, the session will be rebuilt and communication will be restored; if re-authentication fails, communication will be rejected and an alarm audit will be triggered.

[0151] This application is based on a communication method that enables a specific function, such as: enabling a smartphone to remotely control a home robot to retrieve items. Specifically: Users issue pickup tasks via a mobile AI agent. The mobile AI agent retrieves the target robot AI agent from the registry center and establishes a session. Both parties complete two-way authentication of challenge codes and negotiation of the fusion key. The task instruction is sent after being encrypted and signed, and the robot executes it and sends back the result. Renegotiation is triggered when the session times out or the network switches to ensure continuous and secure communication.

[0152] This case study includes the following steps: Step 1. Mobile phone agent A and robot agent B complete the connection between the terminal side and the platform side.

[0153] Step 2. Mobile smart agent A completes the identity credential application and loading through the terminal security plugin.

[0154] Step 3. Mobile phone agent A and robot agent B complete two-way authentication based on challenge codes and complete the negotiation of the SM2 and PQC fusion key.

[0155] Step 4. The mobile phone AI agent A encrypts and signs the pickup task instruction and sends it. The robot AI agent B processes it and returns a secure response.

[0156] Step 5. Trigger session renegotiation when session times out or network switch occurs; perform session revocation and re-authentication when a high-risk event is detected.

[0157] It also enables parallel OAuth token and message-level security, including: the system issues a short-term access token after successful authentication, which is used for platform access control; business messages still need to undergo terminal-side signing and encryption. Even if the token is leaked, attackers cannot forge legitimate messages without the terminal-side private key and session key.

[0158] This case study includes the following steps: Step 1: After successful two-way authentication, the system issues a short-term access token and completes session key negotiation. The access token is used for platform access control.

[0159] Step 2: During the business message transmission phase, terminal-side signature and encryption processing are still performed, and message-level security mechanisms are not omitted due to the existence of access tokens.

[0160] Step 3: When abnormal token use or terminal risk events are detected, the platform performs token revocation, session key destruction, and re-authentication.

[0161] In addition, this embodiment also provides a cross-terminal intelligent agent secure communication device based on SIM or eSIM, the device including: a first terminal intelligent agent, a first SIM or eSIM card, a second terminal intelligent agent, a first terminal security plug-in, a second terminal security plug-in, an intelligent agent secure communication platform and an identity management platform; The first terminal intelligent agent is used to initiate identity registration requests and business messages; The first SIM or eSIM card is connected to the first terminal security plug-in; The first terminal security plugin is connected to the first terminal smart agent and the first SIM or eSIM card respectively. It is used to respond to the identity registration request to obtain the feature digest and public key of the first SIM or eSIM card, submit the identity authentication information containing the feature digest and public key to the identity management platform to apply for identity credentials, cache the issued identity credentials, and initiate a signature request to the first SIM or eSIM card. It submits the signature result and the identity credentials to the smart agent secure communication platform and signs and encrypts the business message based on the session key. The second terminal intelligent agent is used to receive plaintext service messages; The second terminal security plugin is connected to the second terminal intelligent agent and is used to verify and decrypt the encrypted business message and output the plaintext business message to the second terminal intelligent agent. The intelligent agent secure communication platform is connected to the first terminal security plugin and the second terminal security plugin respectively. It is configured to send a first challenge code to the first terminal security plugin, and after successful verification, send an authentication request to the second terminal security plugin. After completing two-way authentication, it obtains the session key, forwards the signed and encrypted business message to the second terminal security plugin, and sends the plaintext business message back to the first terminal intelligent agent. The identity management platform is connected to the security plugin of the first terminal and is configured to receive applications for the identity credentials, verify them, and then issue the identity credentials.

[0162] This embodiment also provides a cross-terminal intelligent agent secure communication system based on SIM or eSIM, the system including: The identity registration module is used to respond to the identity registration request initiated by the first terminal intelligent agent through the first terminal security plugin. The first terminal security plugin obtains the feature digest and public key of the first SIM or eSIM card in response to the identity registration request, submits the identity authentication information containing the feature digest and public key of the first SIM or eSIM card to the identity management platform to apply for identity credentials, and the identity management platform verifies the identity authentication information and issues the identity credentials of the first terminal intelligent agent after verification. The two-way authentication and key negotiation module is used to generate a first challenge code based on the request of the first terminal intelligent agent through the intelligent agent secure communication platform, perform a signature operation on the first challenge code based on the private key in the first SIM or eSIM card, the first SIM or eSIM card returns the signature result and the identity credential to the first terminal security plug-in, after the intelligent agent secure communication platform verifies the signature result and the identity credential, the intelligent agent secure communication platform sends a two-way authentication request to the second terminal intelligent agent, and obtains the session key of the first terminal intelligent agent and the second terminal intelligent agent after completing the two-way authentication; The secure message transmission module is used to submit a business message to the first terminal security plugin through the first terminal agent. The first terminal security plugin signs and encrypts the business message based on the session key, and forwards it to the second terminal agent through the agent secure communication platform. The second terminal security plugin verifies and decrypts the signature and outputs a plaintext business message, and sends a response message back to the first terminal agent through the agent secure communication platform.

[0163] The SIM or eSIM-based cross-terminal intelligent agent secure communication device of this embodiment is similar to other corresponding SIM or eSIM-based cross-terminal intelligent agent secure communication systems and corresponding SIM or eSIM-based cross-terminal intelligent agent secure communication methods, and will not be described again here.

[0164] The embodiments of this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0165] This invention discloses a computer read storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps in the SIM- or eSIM-based cross-terminal smart agent secure communication method described in the foregoing embodiments.

[0166] This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps of the cross-terminal intelligent agent secure communication method based on SIM or eSIM as described in the foregoing embodiments.

[0167] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0168] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation can be achieved by means of software plus necessary general-purpose hardware platforms, and of course, it can also be achieved by hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the prior art, can be embodied in the form of software products. These computer software products can be stored in computer-readable storage media, including read-only memory, random access memory, programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, electronically erasable rewritable read-only memory, read-only optical disc or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium capable of having or storing data.

[0169] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0170] Obviously, those skilled in the art can make various modifications and variations to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations to the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A secure cross-terminal intelligent agent communication method based on SIM or eSIM, characterized in that, The method includes: The first terminal intelligent agent initiates an identity registration request through the first terminal security plugin. The first terminal security plugin responds to the identity registration request by obtaining the feature digest and public key of the first SIM or eSIM card, and submits the identity authentication information containing the feature digest and public key of the first SIM or eSIM card to the identity management platform to apply for identity credentials. The identity management platform verifies the identity authentication information and issues the identity credentials of the first terminal intelligent agent after verification. The intelligent agent secure communication platform generates a first challenge code for authenticating the first terminal intelligent agent based on the secure session establishment request of the first terminal intelligent agent. The first SIM or eSIM card performs a signature operation on the first challenge code based on the private key in the first SIM or eSIM card. The first SIM or eSIM card returns the signature result and the identity credential to the first terminal security plug-in. After verifying the signature result and the identity credential, the intelligent agent secure communication platform sends a two-way authentication request to the second terminal intelligent agent. After completing the two-way authentication, the platform obtains the session key of the first terminal intelligent agent and the second terminal intelligent agent. The first terminal agent submits a service message to the first terminal security plugin. The first terminal security plugin signs and encrypts the service message based on the session key, and forwards it to the second terminal agent through the agent security communication platform. The second terminal security plugin verifies and decrypts the signature, outputs a plaintext service message, and sends a response message back to the first terminal agent through the agent security communication platform.

2. The cross-terminal intelligent agent secure communication method based on SIM or eSIM according to claim 1, characterized in that, The method also includes: The secure communication platform for intelligent agents determines whether a risk event has been triggered while the session is running. If no risk event has been triggered and the session has expired, the platform triggers session renegotiation to update the session key and resumes session operation; otherwise, If a risk event is triggered, the intelligent agent secure communication platform determines the risk level. If the risk level is not higher than a preset threshold, the session validity period is shortened and the session continues. If the risk level is higher than the preset threshold, the local session context is destroyed. Re-authenticate the session. If successful, rebuild the session and resume communication; otherwise, refuse communication.

3. The cross-terminal intelligent agent secure communication method based on SIM or eSIM according to claim 1 or 2, characterized in that, The first terminal security plugin requests identity credentials from the identity management platform, including: The first terminal security plugin calls the first SIM or eSIM card to generate an asymmetric key pair, wherein the private key cannot be exported; After obtaining the returned public key identifier, the integrated circuit card identification code and international mobile subscriber identification code of the first SIM or eSIM card are collected, and a feature digest is generated; the feature digest is an encrypted string obtained by the first terminal security plugin by concatenating the collected integrated circuit card identification code and international mobile subscriber identification code and calculating it using a hash algorithm; The first terminal security plugin submits identity authentication information to the identity management platform. After the identity management platform performs legality verification and binding relationship verification, it issues identity credentials to the first terminal security plugin. The identity authentication information includes a public key, feature digest, terminal agent identifier, and terminal device identifier. The terminal device is the first SIM or eSIM card and the physical carrier and operating environment where the first terminal agent is located.

4. The cross-terminal intelligent agent secure communication method based on SIM or eSIM according to claim 3, characterized in that, The signing operation of the first challenge code based on the private key in the first SIM or eSIM card includes: The intelligent agent secure communication platform returns a first challenge code to the first terminal intelligent agent, and the first terminal security plugin sends a first signature request to the first SIM or eSIM card; the first signature request includes at least a first index, a first challenge code, and a signature algorithm identifier. The first SIM or eSIM card finds the corresponding private key based on the first index, performs a digital signature operation on the first challenge code, generates a first signature result, and returns the first signature result to the first terminal security plugin; The first terminal security plugin submits the first signature result to the intelligent agent secure communication platform, and the intelligent agent secure communication platform completes the signature verification.

5. The cross-terminal intelligent agent secure communication method based on SIM or eSIM according to claim 4, characterized in that, The secure communication platform for the intelligent agent sends a two-way authentication request to the second terminal intelligent agent, including: After receiving the two-way authentication request, the second terminal intelligent agent calls the second terminal security plugin to request the use of the private key in the second SIM or eSIM card to sign the second challenge code and generate a second signature result. The two-way authentication request includes at least a session identifier and a second challenge code for authenticating the second terminal intelligent agent. The second signature result and the identity credentials of the second terminal agent are returned to the second terminal security plugin; The second terminal security plugin returns the second signature result and the identity credentials of the second terminal agent to the agent security communication platform, and the agent security communication platform completes the signature verification of the second signature result and the validity verification of the identity credentials. After successful verification, the intelligent agent secure communication platform returns platform verification materials and identity authentication information of the second terminal intelligent agent to the first terminal intelligent agent. The first terminal intelligent agent completes peer identity confirmation based on the platform verification materials and the identity authentication information, thereby completing two-way authentication.

6. The cross-terminal intelligent agent secure communication method based on SIM or eSIM according to claim 5, characterized in that, The session keys obtained after completing two-way authentication for the first and second terminal intelligent agents include: The first terminal security plugin calls an interface to send the key negotiation material to the intelligent agent secure communication platform and forwards it to the second terminal security plugin. The key negotiation material is a set of cryptographic parameters exchanged by the two communicating parties to calculate the final shared secret. The second terminal security plugin calls the interface to generate key negotiation response material based on the received key negotiation material. The key negotiation response material is a set of return data generated by the second terminal security plugin according to the negotiation protocol after receiving the key negotiation material, which is used to enable the initiator to complete the shared secret calculation. The intelligent agent secure communication platform sends back a negotiation completion notification, and the first terminal security plugin and the second terminal security plugin derive a session key by fusing the received shared secret.

7. The cross-terminal intelligent agent secure communication method based on SIM or eSIM according to claim 1 or 2, characterized in that, The first terminal security plugin signs and encrypts the service message based on the session key, including: The first terminal security plugin injects timestamp, random number, request identifier and session identifier fields into the business message, calls the signature interface to perform signature, and calls the encryption / decryption interface to perform encryption using the session key, and sends the security message to the intelligent agent security communication platform.

8. The cross-terminal intelligent agent secure communication method based on SIM or eSIM according to claim 7, characterized in that, The second terminal security plugin verifies and decrypts the encrypted service message and outputs a plaintext service message, including: The second terminal security plugin performs anti-replay verification and signature verification, and uses the session key to perform decryption, outputting the decrypted business message to the second terminal intelligent agent. The anti-replay verification includes at least time window verification, random number uniqueness verification and request identifier idempotency verification.

9. A communication device based on the SIM- or eSIM-based cross-terminal intelligent agent secure communication method as described in claim 1, characterized in that, The device includes: a first terminal agent, a first SIM or eSIM card, a second terminal agent, a first terminal security plug-in, a second terminal security plug-in, an agent secure communication platform, and an identity management platform; The first terminal intelligent agent is used to initiate identity registration requests and business messages; The first SIM or eSIM card is connected to the first terminal security plug-in; The first terminal security plugin is connected to the first terminal smart agent and the first SIM or eSIM card respectively. It is used to respond to the identity registration request to obtain the feature digest and public key of the first SIM or eSIM card, submit the identity authentication information containing the feature digest and public key to the identity management platform to apply for identity credentials, cache the issued identity credentials, and initiate a signature request to the first SIM or eSIM card. It submits the signature result and the identity credentials to the smart agent secure communication platform and signs and encrypts the business message based on the session key. The second terminal intelligent agent is used to receive plaintext service messages; The second terminal security plugin is connected to the second terminal intelligent agent and is used to verify and decrypt the encrypted business message and output the plaintext business message to the second terminal intelligent agent. The intelligent agent secure communication platform is connected to the first terminal security plugin and the second terminal security plugin respectively. It is configured to send a first challenge code to the first terminal security plugin, and after successful verification, send an authentication request to the second terminal security plugin. After completing two-way authentication, it obtains the session key, forwards the signed and encrypted business message to the second terminal security plugin, and sends the plaintext business message back to the first terminal intelligent agent. The identity management platform is connected to the security plugin of the first terminal and is configured to receive applications for the identity credentials, verify them, and then issue the identity credentials.

10. A communication system based on the SIM- or eSIM-based cross-terminal intelligent agent secure communication method described in claim 1, characterized in that, The system includes: The identity registration module is used to respond to the identity registration request initiated by the first terminal intelligent agent through the first terminal security plugin. The first terminal security plugin obtains the feature digest and public key of the first SIM or eSIM card in response to the identity registration request, submits the identity authentication information containing the feature digest and public key of the first SIM or eSIM card to the identity management platform to apply for identity credentials, and the identity management platform verifies the identity authentication information and issues the identity credentials of the first terminal intelligent agent after verification. The two-way authentication and key negotiation module is used to generate a first challenge code based on the request of the first terminal intelligent agent through the intelligent agent secure communication platform, perform a signature operation on the first challenge code based on the private key in the first SIM or eSIM card, the first SIM or eSIM card returns the signature result and the identity credential to the first terminal security plug-in, after the intelligent agent secure communication platform verifies the signature result and the identity credential, the intelligent agent secure communication platform sends a two-way authentication request to the second terminal intelligent agent, and obtains the session key of the first terminal intelligent agent and the second terminal intelligent agent after completing the two-way authentication; The secure message transmission module is used to submit a business message to the first terminal security plugin through the first terminal agent. The first terminal security plugin signs and encrypts the business message based on the session key, and forwards it to the second terminal agent through the agent secure communication platform. The second terminal security plugin verifies and decrypts the signature and outputs a plaintext business message, and sends a response message back to the first terminal agent through the agent secure communication platform.

11. An electronic device, comprising: At least one memory stores computer-executable instructions non-transiently; At least one processor, configured to run the computer-executable instructions, The computer-executable instructions are executed by the processor to implement the steps of the cross-terminal intelligent agent secure communication method based on SIM or eSIM according to any one of claims 1-8.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program code for execution by the device, the program code including steps for performing the SIM- or eSIM-based cross-terminal smart agent secure communication method as described in any one of claims 1-8.

Images