Method, apparatus, device, and system for secure communication, medium, and program product

Abstract

The present disclosure belongs to the technical field of communications, and discloses a method, apparatus, device, and system for secure communication, a medium, and a program product. The method comprises: when a one-way TLS link is established between a terminal device and a PKI service platform, receiving a certificate application message sent by the terminal device, the certificate application message being obtained by the terminal device using, on the basis of device information and service information of the terminal device, a first public key in a SIM card in the terminal device for encryption; invoking a functional interface of a SIM card management platform, so that the SIM card management platform verifies the SIM card in the terminal device on the basis of the certificate application message and uses a first private key corresponding to the SIM card to decrypt the certificate application message, and obtains a decryption result; and, when the decryption result indicates successful decryption, issuing a device certificate to the terminal device by means of the one-way TLS link. According to the embodiments of the present disclosure, the security of communication between the terminal device and the PKI service platform can be improved.

Description

Secure communication method, device, apparatus, system, medium and program product

[0001] Cross-reference to related disclosures

[0002] The present disclosure is based on and claims priority to Chinese Patent Publication No. 202410732710.7, filed on June 6, 2024, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0003] The present disclosure belongs to the technical field of communication, and particularly relates to a secure communication method, device, apparatus, system, medium and program product. BACKGROUND

[0004] Under a security system of a public key infrastructure (PKI), a terminal device can perform one-way authentication with a PKI service side through a one-way transport layer security (TLS) link, that is, the terminal device verifies the PKI service side. After verification, the terminal device requests a device certificate from the PKI service side, and the PKI service side does not perform identity verification on the terminal device, which makes it easy for a network attacker to steal the device certificate of the terminal device, thereby forging the identity and data of the terminal device, bringing great data security risks and reducing the communication security between the terminal device and the PKI service side. SUMMARY

[0005] The present disclosure provides a secure communication method, device, apparatus, system, medium and program product, which can improve the communication security between the terminal device and the PKI service platform.

[0006] In a first aspect, the present disclosure provides a secure communication method applied to a PKI service platform, which includes: receiving a certificate application message sent by a terminal device in a case where the terminal device and the PKI service platform establish a one-way TLS link, the certificate application message being obtained by encrypting, by the terminal device, based on device information and service information of the terminal device, a first public key in a subscriber identity module (SIM) card in the terminal device; calling a function interface of a SIM card management platform to enable the SIM card management platform to verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result; and in a case where the decryption result represents successful decryption, issuing a device certificate to the terminal device through the one-way TLS link.

[0007] In a second aspect, the embodiments of the present disclosure provide a secure communication method, applied to a SIM card management platform, the method comprising: in a case where a terminal device and a PKI service platform establish a one-way TLS link, accepting a call initiated by the PKI service platform in response to a certificate application message sent by the terminal device, verifying a SIM card in the terminal device based on the certificate application message, and decrypting the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result, the certificate application message being encrypted by the terminal device based on device information and service information by using a first public key in the SIM card in the terminal device; feeding back the decryption result to the PKI service platform, so that the PKI service platform issues a device certificate to the terminal device through the one-way TLS link in a case where the decryption result represents that the decryption is successful.

[0008] In a third aspect, the embodiments of the present disclosure provide a secure communication method, applied to a terminal device, the terminal device having a SIM card, the method comprising: in a case where the terminal device and a PKI service platform establish a one-way TLS link, encrypting a certificate application message by using a first public key in the SIM card based on device information and service information of the terminal device; sending the certificate application message to the PKI service platform, so that the PKI service platform calls a function interface of a SIM card management platform, verifies the SIM card in the terminal device based on the certificate application message by the SIM card management platform, and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result; and in a case where the decryption result represents that the decryption is successful, receiving a device certificate issued by the PKI service platform through the one-way TLS link.

[0009] In a fourth aspect, the embodiments of the present disclosure provide a secure communication device, applied to a PKI service platform, the device comprising: a receiving module configured to receive a certificate application message sent by a terminal device in a case where the terminal device and the PKI service platform establish a one-way TLS link, the certificate application message being encrypted by the terminal device based on device information and service information of the terminal device by using a first public key in a SIM card in the terminal device; an interface calling module configured to call a function interface of a SIM card management platform, so that the SIM card management platform verifies a SIM card in the terminal device based on the certificate application message and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result; and a sending module configured to issue a device certificate to the terminal device through the one-way TLS link in a case where the decryption result represents that the decryption is successful.

[0010] In a fifth aspect, the embodiments of the present disclosure provide a secure communication apparatus applied to a SIM card management platform, the apparatus comprising: a processing module configured to, in a case where a terminal device establishes a one-way TLS link with a PKI service platform, accept a call initiated by the PKI service platform in response to a certificate application message sent by the terminal device, verify a SIM card in the terminal device based on the certificate application message, and decrypt the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result, the certificate application message being encrypted by the terminal device based on device information and service information by using a first public key in the SIM card in the terminal device; and a sending module configured to feed back the decryption result to the PKI service platform, so that the PKI service platform issues a device certificate to the terminal device through the one-way TLS link in a case where the decryption result represents that the decryption is successful.

[0011] In a sixth aspect, the embodiments of the present disclosure provide a terminal device having a SIM card therein, the terminal device comprising: a message generation module configured to, in a case where the terminal device establishes a one-way TLS link with a PKI service platform, encrypt a certificate application message by using a first public key in the SIM card based on device information and service information of the terminal device; a sending module configured to send the certificate application message to the PKI service platform, so that the PKI service platform calls a function interface of a SIM card management platform, verifies the SIM card in the terminal device based on the certificate application message by the SIM card management platform, and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result; and a receiving module configured to, in a case where the decryption result represents that the decryption is successful, receive a device certificate issued by the PKI service platform through the one-way TLS link.

[0012] In a seventh aspect, the embodiments of the present disclosure provide a secure communication device applied to a PKI service platform, the device comprising: a processor and a memory storing computer program instructions; and the processor implements the secure communication method of the first aspect when executing the computer program instructions.

[0013] In an eighth aspect, the embodiments of the present disclosure provide a secure communication device applied to a SIM card management platform, the device comprising: a processor and a memory storing computer program instructions; and the processor implements the secure communication method of the second aspect when executing the computer program instructions.

[0014] In a ninth aspect, the embodiments of the present disclosure provide a terminal device having a SIM card therein, the terminal device comprising: a processor and a memory storing computer program instructions; and the processor implements the secure communication method of the third aspect when executing the computer program instructions.

[0015] In a tenth aspect, the embodiments of the present disclosure provide a secure communication system, comprising: a PKI service platform configured to perform the secure communication method of the first aspect; a SIM card management platform in communication connection with the PKI service platform and configured to perform the secure communication method of the second aspect; and a terminal device in communication connection with the PKI service platform and configured to perform the secure communication method of the third aspect.

[0016] In an eleventh aspect, the embodiments of the present disclosure provide a computer-readable storage medium, which stores computer program instructions. When the computer program instructions are executed by a processor, the secure communication method of the first aspect, the secure communication method of the second aspect, or the secure communication method of the third aspect is implemented.

[0017] In a twelfth aspect, the embodiments of the present disclosure provide a computer program product, which comprises a computer program. When the computer program is executed by a processor, the secure communication method of the first aspect, the secure communication method of the second aspect, or the secure communication method of the third aspect is implemented.

[0018] The embodiments of the present disclosure provide a secure communication method, device, equipment, system, medium, and program product. The terminal device is provided with a SIM card, and the first public key corresponding to the SIM card can be pre-stored in the SIM card. In the case that the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device encrypts a certificate application message based on the device information and the service information of the terminal device and the first public key, and sends the certificate application message to the PKI service platform. The PKI service platform can call the function interface of the SIM card management platform, instruct the SIM card management platform to verify the SIM card of the terminal device based on the certificate application message and decrypt the certificate application message by using the first private key corresponding to the SIM card. If the decryption is successful, it indicates that the terminal device has the first public key paired with the first private key, and it has the legitimacy. The interaction between the PKI service platform and the SIM card management platform realizes the identity verification of the terminal device. Even if a network attacker steals the root certificate chain, the device certificate of the terminal device, and the public key of the PKI service platform to simulate the terminal device, the network attacker cannot obtain the first public key corresponding to the SIM card in the terminal device, and cannot verify the identity legitimacy and uniqueness of the terminal device, so as to ensure the data security and improve the communication security between the terminal device and the PKI service platform. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings needed in the embodiments of the present disclosure will be briefly introduced. Those skilled in the art can obtain other drawings according to these drawings without creating any creative labor.

[0020] FIG. 1 is an architecture schematic diagram of a secure communication system provided by an embodiment of the present disclosure;

[0021] FIG. 2 is a flowchart of a secure communication method according to an embodiment of the first aspect of the present disclosure;

[0022] FIG. 3 is a flowchart of a secure communication method according to another embodiment of the first aspect of the present disclosure;

[0023] FIG. 4 is a flowchart of a secure communication method according to an embodiment of the second aspect of the present disclosure;

[0024] FIG. 5 is a flowchart of a secure communication method according to an embodiment of the third aspect of the present disclosure;

[0025] FIG. 6 is a flowchart of a secure communication method according to another embodiment of the third aspect of the present disclosure;

[0026] FIG. 7 is a flowchart of an example of a communication interaction process between a terminal device, a PKI service platform and a SIM card management platform according to an embodiment of the present disclosure;

[0027] FIG. 8 is a schematic structural diagram of a secure communication apparatus according to an embodiment of the fourth aspect of the present disclosure;

[0028] FIG. 9 is a schematic structural diagram of a secure communication apparatus according to an embodiment of the fifth aspect of the present disclosure;

[0029] FIG. 10 is a schematic structural diagram of a terminal device according to an embodiment of the sixth aspect of the present disclosure;

[0030] FIG. 11 is a schematic structural diagram of a secure communication apparatus according to an embodiment of the seventh aspect of the present disclosure. DETAILED DESCRIPTION

[0031] The features and exemplary embodiments of the various aspects of the present disclosure will be described in detail below, in order to make the purposes, technical solutions and advantages of the present disclosure clearer. The following further describes the present disclosure in detail with reference to the accompanying drawings and specific embodiments, and it should be understood that the specific embodiments described herein are only intended to explain the present disclosure, but not to limit the present disclosure. The present disclosure can be implemented without some of the specific details by those skilled in the art. The following description of the embodiments is only intended to provide a better understanding of the present disclosure by showing examples of the present disclosure.

[0032] It should be noted that, in this document, the terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, so that a process, method, article, or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0033] Under the security system of the PKI, the terminal device can perform one-way authentication with the PKI service side through a one-way TLS link, that is, the terminal device verifies the PKI service side. After verification, the terminal device requests a device certificate from the PKI service side, and the PKI service side does not authenticate the terminal device, which makes it easy for a network attacker to steal the device certificate of the terminal device, thereby forging the identity and data of the terminal device, causing a great data security risk and reducing the communication security between the terminal device and the PKI service side.

[0034] In some cases, in order to improve the communication security between the terminal device and the PKI service side, an encryption hardware device such as an encryption machine can be separately deployed on the PKI service side, the device certificate is pre-encrypted into ciphertext and stored in the chip of the encryption hardware device such as the encryption machine, and the root certificate, intermediate certificate, and the like are also stored in the chip of the encryption hardware device such as the encryption machine, and the encryption and decryption of the device certificate are completed in the chip. However, this scheme cannot guarantee the security and reliability of the certificate application of the terminal device to the PKI service side, and the device terminal is extremely likely to have been forged and tampered with by a network attacker when obtaining the device certificate, and this scheme needs to specially increase the encryption hardware device, which increases the complexity and construction cost of the PKI security system, and also causes the communication security to be limited to the supplier of the encryption hardware device, which is not convenient for the management and control of the communication security.

[0035] The present disclosure provides a secure communication method, device, equipment, system, medium and program product. A terminal device has a subscriber identity module (SIM) card, and a first public key is prewritten in the SIM card. After a terminal device and a PKI service side establish a one-way TLS link, the terminal device can encrypt device information and service information of the terminal device by using the first public key prewritten in the SIM card of the terminal device, to obtain a certificate application message for applying for a device certificate. The PKI service side can call a SIM card management platform to obtain a first private key corresponding to the first public key in the SIM card, and decrypt the first private key to complete verification of the terminal device. After decryption and verification determine that the terminal device is safe and reliable, the PKI service side issues a device certificate to the terminal device, realizes verification of the terminal device by the PKI service side, improves the communication security between the terminal device and the PKI service side without adding new encryption hardware devices, and establishes a more secure and reliable PKI security system.

[0036] The secure communication method, device, equipment, system, medium and program product provided by the present disclosure are described below.

[0037] For ease of understanding, the secure communication system to which the secure communication method is applied is introduced first. FIG. 1 is an architecture schematic diagram of a secure communication system provided by an embodiment of the present disclosure. As shown in FIG. 1, the secure communication system can include a terminal device 11, a PKI service platform 12 and a SIM card management platform 13.

[0038] The terminal device 11 can include a vehicle terminal, a wearable terminal, a home terminal, an industrial terminal, a city application terminal and the like intelligent terminal in the Internet of Things. For example, the terminal device 11 can include, but is not limited to, a vehicle terminal, a smart phone, a tablet computer, a smart refrigerator, a smart air conditioner, a smart street lamp and the like intelligent terminal. The terminal device is provided with a SIM card, and the SIM card can be handled through the SIM card management platform 13. The terminal device 11 can be in communication connection with the PKI service platform 12. In the embodiment of the present disclosure, the terminal device 11 and the PKI service platform can first establish one-way TLS link communication.

[0039] The PKI service platform 12 can provide system information security services through public key technology and digital certificates, and the PKI service platform 12 can generate and issue a device certificate for the terminal device. The PKI service platform 12 can communicate with the SIM card management platform 13. Specifically, the PKI service platform 12 can call a function interface of the SIM card management platform 13 to instruct the SIM card management platform to perform certain function operations. The PKI service platform 12 can include a server and the like equipment, and the type and number of equipment implementing the function of the PKI service platform 12 are not limited herein.

[0040] The SIM card management platform 13 can manage the SIM card. The SIM card management platform 13 can handle the SIM card, and record the relevant information of the handled SIM card and the binding relationship between the SIM card and the terminal device 11. The SIM card is arranged in the terminal device 11, that is, the terminal device 11 has a binding relationship with the SIM. In the embodiment of the present disclosure, the SIM card management platform 13 can provide a first public key and a first private key corresponding to the SIM card, the first public key and the first private key are a pair of keys, and the ciphertext information encrypted by the first public key can be decrypted by the first private key, so that the plaintext information before encryption is obtained. The SIM card management platform 13 can prewrite the first public key corresponding to the SIM card into the SIM card. After the SIM card is installed in the terminal device 11, the terminal device 11 can read the first public key from the SIM card. The SIM card management platform 13 can include a server and the like, and the type and quantity of the device for implementing the function of the SIM card management platform 13 are not limited herein.

[0041] The first aspect of the present disclosure provides a secure communication method, which can be applied to a PKI service platform, that is, the secure communication method can be executed by the PKI service platform. FIG. 2 is a flowchart of the secure communication method provided by the first aspect of the present disclosure, as shown in FIG. 2, the secure communication method can include steps S201 to S203.

[0042] In step S201, in the case that the terminal device and the PKI service platform establish a one-way TLS link, a certificate application message sent by the terminal device is received.

[0043] The terminal device and the PKI service platform can first establish a one-way TLS link. Specifically, the terminal device can send the TLS information of the terminal device such as the TLS version to the PKI service platform; the PKI service platform feeds back the security information of the PKI service platform such as the TLS version, random number and public key of the PKI service platform to the terminal device; the terminal device verifies the legality of the platform certificate of the PKI service platform, and if the verification of the legality of the platform certificate is passed, the establishment of the one-way TLS link is completed.

[0044] The certificate application message is obtained by the terminal device based on device information and service information of the terminal device, and encrypted by using a first public key in a SIM card in the terminal device. The terminal device can read the first public key from the SIM card, and perform RSA encryption based on the device information and the service information of the terminal device by using the first public key, to obtain the certificate application message. The certificate application message is ciphertext encrypted by using the first public key, and cannot be cracked and read even if intercepted during transmission, thereby protecting the security of data. The device information of the terminal device can represent the terminal device. In some examples, the device information can include, but is not limited to, a device identifier and a SIM card identifier. The SIM card identifier can represent the SIM card, and the terminal device has a binding relationship with the SIM card. Correspondingly, the SIM card identifier can also represent the terminal device. The service information can include, but is not limited to, a device identifier, a device type, and a device state of the terminal device. For example, the terminal device is a smart street lamp, and the service information can include information indicating the brightness and power of the smart street lamp. The certificate application message can include a message header and a message body. The message body can be ciphertext obtained by encrypting the service information by using the first public key. The message header can include the device information.

[0045] After the terminal device establishes the one-way TLS link with the PKI service platform, the terminal device generates a certificate application message and sends the certificate application message to the PKI service platform, and the PKI service platform receives the certificate application message.

[0046] In step S202, a function interface of the SIM card management platform is called to enable the SIM card management platform to verify the SIM card in the terminal device based on the certificate application message, and to decrypt the certificate application message by using the first private key corresponding to the SIM card, to obtain a decryption result.

[0047] The PKI service platform calls the function interface of the SIM card management platform to instruct the SIM card management platform to verify the SIM card of the terminal device, and determines whether to obtain the first private key corresponding to the first public key to decrypt the certificate application message according to the verification result.

[0048] In some examples, the PKI service platform can also verify the access right of the terminal device based on the certificate application message. The PKI service platform can obtain the device information from the certificate application message, determine whether the terminal device has the access right according to the device information, and in the case that the terminal device has the access right, call the function interface of the SIM card management platform. According to the device information, the PKI service platform can determine whether the terminal device is a known and trusted device, and can also determine whether the terminal device is registered in the PKI service platform. Specifically, the PKI service platform can have a device white list, which can include the device information of known and trusted devices registered in the PKI service platform. The PKI service platform can find whether the device information in the certificate application message exists in the device white list. If the device information in the certificate application message exists in the device white list, it can be determined that the terminal device sending the certificate application message is registered in the PKI service platform and is a known and trusted terminal device, has the access right, and can call the function interface of the SIM card management platform.

[0049] The device information of the terminal device can include a SIM card identifier, and the SIM card identifier can include an integrate circuit card identity (ICCID). The SIM card identifier is used by the SIM card management platform to verify the SIM card, and the verification of the SIM card includes legality verification and / or attribution verification. In the case where the verification of the SIM card is passed, the SIM card identifier is used by the SIM card management platform to obtain a first private key corresponding to the SIM card identifier. The PKI service platform can call a function interface of the SIM card management platform, and can send a certificate application message to the SIM card management platform. The SIM card management platform can verify the SIM card according to the SIM card identifier in the certificate application message. The SIM card management platform records the SIM card identifiers of legal SIM cards, and can search whether the SIM card identifier in the certificate application message exists in the SIM card identifiers of the legal SIM cards. If the SIM card identifier in the certificate application message exists in the SIM card identifiers of the legal SIM cards, the legality verification of the SIM card is passed. The SIM card management platform can record the binding relationship between the SIM card identifier and the terminal device, and can determine whether the SIM card identifier and the device identifier in the certificate application message have a binding relationship. If the binding relationship exists, the attribution verification of the SIM card is passed. If a SIM card identifier has been bound to a certain terminal device, other terminal devices cannot use the SIM card identifier to apply for a device certificate. Through the attribution verification, the repeated use or malicious use of the SIM card identifier can be avoided, and the data security is further improved. The private keys of the SIM cards can be stored in a secure database of the SIM card management platform, and the secure database can only be accessed by a verified system. In the case where the verification of the SIM card is passed, the SIM card management platform can search the first private key corresponding to the SIM card identifier from the secure database of the SIM card management platform.

[0050] After the SIM card management platform obtains the first private key corresponding to the SIM card identifier, the first private key is used to decrypt the certificate application message, a decryption result is obtained, and the decryption result is fed back to the PKI service platform. The decryption result can represent decryption success or decryption failure. If the decryption result represents decryption success, it indicates that the certificate application message comes from the source device claimed by the certificate application message, and the certificate application message is not tampered in the transmission process. If the decryption result represents decryption failure, it indicates that the certificate application message is not sent by the source device claimed by the certificate application message, and / or the certificate application message is tampered in the transmission process, that is, the certificate application message can have a security problem.

[0051] In step S203, in the case where the decryption result represents decryption success, the device certificate is issued to the terminal device through a one-way TLS link.

[0052] The decryption result represents that the decryption is successful, which indicates that the certificate application message does not have a security problem, and also indicates that the identity legitimacy and uniqueness of the terminal device are verified. The PKI service platform can generate a device certificate for the terminal device corresponding to the certificate application message, and issue the device certificate to the terminal device. The generated device certificate is transmitted to the terminal device through a one-way TLS link, which ensures the security of the transmission. After receiving the device certificate, the terminal device can save the device certificate, and in subsequent communication with the PKI service platform, the device certificate can be used for identity authentication.

[0053] In some examples, the device certificate includes a first public key, device information, certificate information, and a digital signature, and the digital signature is generated based on a second private key of the PKI service platform. It should be noted that the device certificate is encrypted by using the public key of the PKI service platform, that is, the second public key, and the first public key, the device information, and the certificate information in the device certificate are not in plaintext form. After obtaining the device certificate, the first public key, the device information, and the certificate information cannot be obtained without decryption. Specifically, the device information in the device certificate can include a SIM card identifier, and the certificate information can represent the attributes of the device certificate, for example, the certificate information can include the valid period of the device certificate and the like. The digital signature is generated by using the private key of the PKI service platform, that is, the second private key, and the digital signature can be used to prove that the device certificate comes from the PKI service platform and has not been tampered with.

[0054] If the decryption result represents decryption failure, it indicates that the certificate application message may have security problems, and the PKI service platform can further monitor the terminal device. For example, the PKI service platform can limit the request frequency of the terminal device for the certificate application message of the PKI service platform to prevent the brute force cracking of the network attack party; or, monitor whether the number of received certificate application messages from the terminal device within a preset time period satisfies a preset security risk condition, and if the number of received certificate application messages from the terminal device within the preset time period satisfies the preset security risk condition, limit the access of the terminal device to the PKI service platform. In some examples, the decryption result can also not be considered, regardless of whether there is a decryption result, or regardless of whether the decryption result represents decryption success or decryption failure, as long as the number of received certificate application messages from the terminal device within a preset time period satisfies a preset security risk condition, the PKI service platform limits the access of the terminal device to the PKI service platform. The security risk condition can be set according to specific scenarios, needs, experience, etc., and is not limited herein, for example, the security risk condition can include that the number of received certificate application messages from the terminal device within a preset time period exceeds a security number threshold. The limitation of the access of the terminal device to the PKI service platform by the PKI service platform can include but is not limited to sending warning information to the terminal device, directly rejecting the access of the terminal device, forcibly reducing the access frequency of the terminal device to the PKI service platform, and the like. By limiting the access of the terminal device to the PKI service platform in the presence of risks, malicious attacks can be prevented, thereby further ensuring the security and reliability of the PKI service platform.

[0055] In the embodiment of the present disclosure, the terminal device is provided with a SIM card, and the first public key corresponding to the SIM card can be pre-stored in the SIM card. In the case that the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device encrypts a certificate application message based on the device information and the service information of the terminal device by using the first public key, and sends the certificate application message to the PKI service platform. The PKI service platform can call the function interface of the SIM card management platform, instruct the SIM card management platform to verify the SIM card of the terminal device based on the certificate application message and decrypt the certificate application message by using the first private key corresponding to the SIM card. If the decryption is successful, it indicates that the terminal device has the first public key paired with the first private key, and it is legitimate. The interaction between the PKI service platform and the SIM card management platform realizes the identity verification of the terminal device. Even if a network attacker steals the root certificate chain, the device certificate of the terminal device and the public key of the PKI service platform to simulate the terminal device, the network attacker cannot obtain the first public key corresponding to the SIM card in the terminal device, and cannot verify the identity legitimacy and uniqueness of the terminal device, so as to ensure the data security and improve the communication security between the terminal device and the PKI service platform. Moreover, the embodiment of the present disclosure does not need to increase the encryption hardware device, and the communication security will not be limited by the supplier of the encryption hardware device. The verification of the terminal device can be completed by using the function of the SIM card management platform in the related technology, which reduces the complexity and construction cost of the PKI security system, and facilitates the management and control of the communication security.

[0056] In some embodiments, after the terminal device obtains the device certificate, the terminal device can use the device certificate for identity verification in subsequent communication with the PKI service platform. FIG. 3 is a flowchart of a secure communication method according to another embodiment of the first aspect of the present disclosure. The difference between FIG. 3 and FIG. 2 is that the secure communication method shown in FIG. 3 can further include steps S204 to S206.

[0057] In step S204, a service message sent by the terminal device is received.

[0058] The service message includes the device certificate and the first ciphertext, and the first ciphertext is encrypted by the terminal device based on the service information by using the first public key. When the terminal device needs to interact with the PKI service platform, the terminal device can encrypt the service information by using the first public key to obtain the first ciphertext, generate the service message according to the first ciphertext and the device certificate, and send the service message to the PKI service platform. After the PKI service platform receives the service message sent by the terminal device, the PKI service platform processes the service message to obtain the service information.

[0059] In step S205, the device certificate is decrypted by using the second private key of the PKI service platform to obtain the first public key from the device certificate.

[0060] The device certificate can include the first public key, device information, certificate information, and a digital signature, and the device certificate is ciphertext encrypted using a public key of the PKI service platform, i.e., a second public key. The PKI service platform can decrypt the device certificate using a second private key paired with the second public key, and obtain the first public key therefrom.

[0061] In step S206, based on the first public key, a function interface of the SIM card management platform is invoked to obtain the first private key from the SIM card management platform, and the first ciphertext is decrypted using the first private key to obtain the service information.

[0062] The PKI service platform can invoke the function interface of the SIM card management platform using the first public key to obtain a first private key paired with the first public key. In some examples, the SIM card management platform can provide the first private key to the PKI service platform, and the PKI service platform decrypts the first ciphertext using the first private key to obtain the service information. In other examples, the PKI service platform can transmit the first ciphertext to the SIM card management platform, the SIM card management platform decrypts the first ciphertext using the first private key to obtain the service information, and feeds back the service information to the PKI service platform.

[0063] The terminal device can perform secondary verification of the identity of the terminal device with the PKI service platform through the device certificate, and guarantee the data security of communication between the terminal device and the PKI service platform.

[0064] In some examples, the PKI service platform has a root certificate. After the PKI service platform receives the service message sent by the terminal device, the PKI service platform can verify the device certificate using the root certificate. If the device certificate is verified, the PKI service platform can establish a bidirectional secure channel with the terminal device. The root certificate can verify whether the device certificate is a device certificate issued by the PKI service platform. The device certificate verification passing indicates that the device certificate is a device certificate issued by the PKI service platform, and the terminal device is a trusted terminal device. A bidirectional secure channel can be established between the terminal device and the PKI service platform. The bidirectional secure channel is an encrypted secure channel, and data transmitted through the bidirectional secure channel can guarantee its security, thereby further improving the communication security between the terminal device and the PKI service platform.

[0065] The second aspect of the present disclosure provides a secure communication method applied to a SIM card management platform, i.e., the secure communication method can be executed by the SIM card management platform. FIG. 4 is a flowchart of a secure communication method provided by an embodiment of the second aspect of the present disclosure. As shown in FIG. 4, the secure communication method includes steps S301 and S302.

[0066] In step S301, in a case where the terminal device establishes a one-way TLS link with the PKI service platform, the PKI service platform initiates a call in response to a certificate application message sent by the terminal device, verifies the SIM card in the terminal device based on the certificate application message, and decrypts the certificate application message by using the first private key corresponding to the SIM card to obtain a decryption result.

[0067] The certificate application message is encrypted by the terminal device based on device information and service information by using the first public key in the SIM card in the terminal device.

[0068] In step S302, the decryption result is fed back to the PKI service platform, so that the PKI service platform issues a device certificate to the terminal device through the one-way TLS link in a case where the decryption result represents successful decryption.

[0069] The specific content of steps S301 and S302 can be referred to the related description in the above embodiments, which will not be repeated here.

[0070] In the embodiments of the present disclosure, the terminal device is provided with a SIM card, and the first public key corresponding to the SIM card can be pre-stored in the SIM card. In a case where the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device encrypts a certificate application message by using the first public key based on device information and service information of the terminal device, and sends the certificate application message to the PKI service platform. The SIM card management platform accepts a call of the PKI service platform, verifies the SIM card of the terminal device based on the certificate application message, and decrypts the certificate application message by using the first private key corresponding to the SIM card. If the decryption is successful, it indicates that the terminal device has the first public key paired with the first private key, and it is legitimate. The interaction between the SIM card management platform and the PKI service platform realizes the identity verification of the terminal device. Even if a network attacker steals the root certificate chain, the device certificate of the terminal device, and the public key of the PKI service platform to simulate the terminal device, the network attacker cannot obtain the first public key corresponding to the SIM card in the terminal device, and cannot verify the identity legitimacy and uniqueness of the terminal device, so as to ensure the data security and improve the communication security between the terminal device and the PKI service platform. Moreover, the embodiments of the present disclosure do not need to increase the encryption hardware device, and the communication security will not be limited by the supplier of the encryption hardware device. The verification of the terminal device can be completed by using the SIM card management platform function in the related technology, which reduces the complexity and construction cost of the PKI security system, and facilitates the management and control of the communication security.

[0071] In some embodiments, the device information includes a SIM card identifier of the SIM card. The step S301 can be specifically refined as: obtaining the SIM card identifier from the certificate application message, and verifying the SIM card by using the SIM card identifier, wherein the verification of the SIM card includes legality verification and / or attribution verification; and in a case where the verification of the SIM card is passed, obtaining the first private key corresponding to the SIM card identifier according to the SIM card identifier; and decrypting the certificate application message by using the first private key to obtain a decryption result.

[0072] In some embodiments, the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access rights. The step S301 can be specifically refined as: in a case where the PKI service platform determines that the terminal device has the rights, accepting the call initiated by the PKI service platform in response to the certificate application message sent by the terminal device.

[0073] In some examples, the device certificate includes the first public key, the device information, the certificate information, and a digital signature, and the digital signature is generated based on the second private key of the PKI service platform.

[0074] In some embodiments, the secure communication method can further include: in a case where the PKI service platform decrypts the device certificate in the received service message by using the second private key of the PKI service platform to obtain the first public key, accepting the call of the PKI service platform, and obtaining the first private key corresponding to the first public key. The first private key is used to decrypt the first ciphertext to obtain the service information. The service message includes the device certificate and the first ciphertext, and the first ciphertext is encrypted by the terminal device based on the service information by using the first public key.

[0075] The third aspect of the present disclosure provides a secure communication method, which can be applied to a terminal device having a SIM card, and can be executed by the terminal device. FIG. 5 is a flowchart of a secure communication method provided by an embodiment of the third aspect of the present disclosure. As shown in FIG. 5, the secure communication method can include steps S401 to S403.

[0076] In step S401, in a case where a terminal device and a public key infrastructure (PKI) service platform establish a one-way TLS link, a certificate application message is encrypted by using a first public key in a SIM card based on device information and service information of the terminal device.

[0077] In step S402, the certificate application message is sent to the PKI service platform, so that the PKI service platform calls a function interface of a SIM card management platform, and the SIM card management platform verifies a SIM card in the terminal device based on the certificate application message and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result.

[0078] In step S403, in a case where the decryption result represents that the decryption is successful, the device certificate issued by the PKI service platform is received through the one-way TLS link.

[0079] In the embodiment of the present disclosure, the terminal device is provided with a SIM card, and the first public key corresponding to the SIM card can be pre-stored in the SIM card. In a case where the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device encrypts the certificate application message based on the device information and the service information of the terminal device by using the first public key, and sends the certificate application message to the PKI service platform. The PKI service platform calls the SIM card management platform, so that the SIM card management platform verifies the SIM card of the terminal device based on the certificate application message and decrypts the certificate application message by using the first private key corresponding to the SIM card. If the decryption is successful, it indicates that the terminal device has the first public key paired with the first private key, and it is legitimate. The interaction between the PKI service platform and the SIM card management platform realizes the identity verification of the terminal device. Even if a network attacker steals the root certificate chain, the device certificate of the terminal device and the public key of the PKI service platform to simulate the terminal device, the network attacker cannot obtain the first public key corresponding to the SIM card in the terminal device, and cannot verify the identity legitimacy and uniqueness of the terminal device, so as to ensure the data security and improve the communication security between the terminal device and the PKI service platform. Moreover, the embodiment of the present disclosure does not need to increase the encryption hardware device, and the communication security will not be limited by the supplier of the encryption hardware device. The verification of the terminal device can be completed by using the SIM card management platform function in the related technology, which reduces the complexity and construction cost of the PKI security system, and is convenient for the management and control of the communication security.

[0080] In some embodiments, the device information includes a SIM card identifier of the SIM card. The SIM card identifier is used by the SIM card management platform to verify the SIM card. The verification of the SIM card includes legitimacy verification and / or attribution verification. In a case where the verification of the SIM card is passed, the SIM card identifier is used by the SIM card management platform to obtain the first private key corresponding to the SIM card identifier.

[0081] In some embodiments, the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access rights, and in a case where the terminal device has access rights, the PKI service platform calls the function interface of the SIM card management platform.

[0082] In some examples, the device certificate includes the first public key, the device information, the certificate information and the digital signature, and the digital signature is generated based on the second private key of the PKI service platform.

[0083] In some embodiments, the secure communication method can further include: in a case where the number of times of sending, by the terminal device, the certificate application message to the PKI service platform within a preset time period satisfies a preset security risk condition, access of the terminal device to the PKI service platform is limited by the PKI service platform.

[0084] FIG. 6 is a flowchart of a secure communication method according to another embodiment of the third aspect of the present disclosure. The difference between FIG. 6 and FIG. 5 is that the secure communication method shown in FIG. 6 can further include step S404 and step S405.

[0085] In step S404, after receiving the device certificate issued by the PKI service platform through the one-way TLS link, the first ciphertext is encrypted based on the service information by using the first public key, and the service message is generated according to the first ciphertext and the device certificate.

[0086] In step S405, the service message is sent to the PKI service platform, so that the PKI service platform decrypts the device certificate by using the second private key of the PKI service platform to obtain the first public key, and calls the function interface of the SIM card management platform based on the first public key to obtain the first private key, and decrypts the first ciphertext by using the first private key to obtain the service information.

[0087] The specific content of step S404 and step S405 can be referred to the related description in the above embodiments, which will not be repeated here.

[0088] In some embodiments, the PKI service platform has a root certificate. The secure communication method can further include: after sending the service message to the PKI service platform, in a case where the verification of the device certificate by the PKI service platform using the root certificate is passed, a two-way secure channel is established with the PKI service platform.

[0089] For the convenience of description, the communication interaction between the terminal device, the PKI service platform and the SIM card management platform is described below by taking an example. FIG. 7 is a flowchart of an example of a communication interaction process of a terminal device, a PKI service platform and a SIM card management platform according to an embodiment of the present disclosure. As shown in FIG. 7, the communication interaction process includes steps a1 to a11.

[0090] In step a1, the terminal device sends the TLS information of the terminal device to the PKI service platform.

[0091] In step a2, the PKI service platform feeds back the security information to the terminal device.

[0092] In step a3, the terminal device checks the legality of the platform certificate of the PKI service platform. If the check of the legality is passed, step a4 is executed; if the check of the legality is not passed, the current interaction is stopped.

[0093] In step a4, the terminal device establishes a one-way TLS link with the PKI service platform.

[0094] In step a5, the terminal device sends a certificate application message to the PKI service platform.

[0095] In step a6, the PKI service platform calls a SIM card management platform interface to verify the SIM card. If the verification of the SIM card is passed, step a7 is performed; if the verification of the SIM card is passed, the current certificate application is stopped.

[0096] In step a7, the SIM card management platform obtains a first private key according to a SIM card identifier of the SIM card.

[0097] In step a8, the SIM card management platform decrypts the certificate application message by using the first private key to obtain a decryption result.

[0098] In step a9, the SIM card management platform sends the decryption result to the PKI service platform.

[0099] In step a10, if the decryption result indicates that the decryption is successful, the PKI service platform generates a device certificate according to the certificate application message.

[0100] In step a11, the PKI service platform issues the device certificate to the terminal device through the one-way TLS link.

[0101] The specific content of steps a1 to a11 can be referred to the related description in the above embodiments, which will not be repeated here.

[0102] The fourth aspect of the present disclosure provides a secure communication device applied to a PKI service platform. FIG. 8 is a structural schematic diagram of the secure communication device provided by an embodiment of the fourth aspect of the present disclosure. As shown in FIG. 8, the secure communication device 500 includes a receiving module 501, an interface calling module 502, and a sending module 503.

[0103] The receiving module 501 can be configured to receive a certificate application message sent by a terminal device in a case where the terminal device establishes a one-way secure transmission layer protocol (TLS) link with the PKI service platform. The certificate application message is encrypted by the terminal device based on device information and service information of the terminal device by using a first public key in a user identification SIM card in the terminal device.

[0104] The interface calling module 502 can be configured to call a function interface of a SIM card management platform, so that the SIM card management platform verifies a SIM card in the terminal device based on the certificate application message and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result.

[0105] The sending module 503 can be configured to, in a case where the decryption result represents that the decryption is successful, issue the device certificate to the terminal device through the one-way TLS link.

[0106] In some embodiments, the device information includes a SIM card identifier of the SIM card. The SIM card identifier is used by the SIM card management platform to perform verification of the SIM card. The verification of the SIM card includes legality verification and / or attribution verification. In a case where the verification of the SIM card is passed, the SIM card identifier is used by the SIM card management platform to obtain the first private key corresponding to the SIM card identifier.

[0107] In some embodiments, the interface calling module 502 can be specifically configured to: obtain the device information from the certificate application message, determine whether the terminal device has access authority according to the device information, and call a function interface of the SIM card management platform in a case where the terminal device has the access authority.

[0108] In some examples, the device certificate includes the first public key, the device information, the certificate information, and a digital signature, and the digital signature is generated based on a second private key of the PKI service platform.

[0109] In some embodiments, the secure communication apparatus 500 can further include an access restriction module. The access restriction module can be configured to, if a number of times of receiving the certificate application message from the terminal device within a preset time period satisfies a preset security risk condition, restrict access of the terminal device to the PKI service platform.

[0110] In some embodiments, the secure communication apparatus 500 can further include a decryption module.

[0111] The receiving module 501 can be specifically configured to receive a service message sent by the terminal device, the service message including the device certificate and the first ciphertext, and the first ciphertext being obtained by the terminal device by encrypting the service information based on the service information using the first public key.

[0112] The decryption module can be configured to decrypt the device certificate using the second private key of the PKI service platform, and obtain the first public key from the device certificate.

[0113] The interface calling module 502 can be specifically configured to: based on the first public key, call a function interface of the SIM card management platform to obtain the first private key from the SIM card management platform, and decrypt the first ciphertext using the first private key to obtain the service information.

[0114] In some embodiments, the PKI service platform has a root certificate. The secure communication apparatus 500 can further include a verification module and a secure channel establishment module.

[0115] The verification module can be configured to verify the device certificate using the root certificate.

[0116] The secure channel establishment module can be configured to establish a bidirectional secure channel with the terminal device if the device certificate verification is passed.

[0117] A fifth aspect of the present disclosure provides a secure communication apparatus, which can be applied to a SIM card management platform. FIG. 9 is a structural schematic diagram of the secure communication apparatus according to an embodiment of the fifth aspect of the present disclosure. As shown in FIG. 9, the secure communication apparatus 600 can include a processing module 601 and a sending module 602.

[0118] The processing module 601 can be configured to, in a case where a terminal device establishes a single-directional secure transmission layer protocol (TLS) link with a public key infrastructure (PKI) service platform, receive a call initiated by the PKI service platform in response to a certificate application message sent by the terminal device, verify a SIM card in the terminal device based on the certificate application message, and decrypt the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result, the certificate application message being encrypted by the terminal device based on device information and service information by using a first public key in the SIM card in the terminal device.

[0119] The sending module 602 can be configured to feed back the decryption result to the PKI service platform, so that the PKI service platform issues a device certificate to the terminal device through the single-directional TLS link in a case where the decryption result represents that the decryption is successful.

[0120] In some embodiments, the device information includes a SIM card identifier of the SIM card. The processing module 601 can be specifically configured to obtain the SIM card identifier from the certificate application message, perform verification of the SIM card by using the SIM card identifier, the verification of the SIM card including legality verification and / or attribution verification, obtain the first private key corresponding to the SIM card identifier according to the SIM card identifier in a case where the verification of the SIM card is passed, and decrypt the certificate application message by using the first private key to obtain the decryption result.

[0121] In some embodiments, the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access authority. The processing module 601 can be specifically configured to accept the call initiated by the PKI service platform in response to the certificate application message sent by the terminal device in a case where the PKI service platform determines that the terminal device has the authority.

[0122] In some examples, the device certificate includes the first public key, the device information, certificate information, and a digital signature, the digital signature being generated based on a second private key of the PKI service platform.

[0123] In some embodiments, the processing module 601 can also be configured to accept the call of the PKI service platform, and obtain the first private key corresponding to the first public key, in a case where the PKI service platform decrypts the device certificate in the received service message by using the second private key of the PKI service platform to obtain the first public key. The first private key is used to decrypt the first ciphertext to obtain the service information. The service message includes the device certificate and the first ciphertext, and the first ciphertext is encrypted by the terminal device based on the service information by using the first public key.

[0124] The sixth aspect of the present disclosure provides a terminal device having a SIM card. FIG. 10 is a structural schematic diagram of a terminal device according to an embodiment of the sixth aspect of the present disclosure. As shown in FIG. 10, the terminal device 700 can include a message generation module 701, a sending module 702, and a receiving module 703.

[0125] The message generation module 701 can be configured to, in a case where the terminal device establishes a one-way secure transmission layer protocol (TLS) link with a public key infrastructure (PKI) service platform, encrypt a certificate application message by using a first public key in a SIM card based on device information and service information of the terminal device.

[0126] The sending module 702 can be configured to send the certificate application message to the PKI service platform, so that the PKI service platform calls a function interface of a SIM card management platform, and the SIM card management platform verifies the SIM card in the terminal device based on the certificate application message and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result.

[0127] The receiving module 703 can be configured to receive a device certificate issued by the PKI service platform through the one-way TLS link, in a case where the decryption result indicates that the decryption is successful.

[0128] In some embodiments, the device information includes a SIM card identifier of the SIM card. The SIM card identifier is used by the SIM card management platform to verify the SIM card, and the verification of the SIM card includes legality verification and / or attribution verification. In a case where the verification of the SIM card is passed, the SIM card identifier is used by the SIM card management platform to obtain the first private key corresponding to the SIM card identifier.

[0129] In some embodiments, the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access permission, and the PKI service platform calls the function interface of the SIM card management platform in a case where the terminal device has the access permission.

[0130] In some examples, the device certificate includes the first public key, the device information, certificate information, and a digital signature, and the digital signature is generated based on the second private key of the PKI service platform.

[0131] In some embodiments, in a case where the number of times that the terminal device sends the certificate application message to the PKI service platform within a preset time period satisfies a preset security risk condition, the access of the terminal device to the PKI service platform is limited by the PKI service platform.

[0132] In some embodiments, the message generation module 701 can be further configured to encrypt the first public key based on the service information to obtain first ciphertext, and generate the service message according to the first ciphertext and the device certificate.

[0133] The sending module 702 can be further configured to send the service message to the PKI service platform, so that the PKI service platform decrypts the device certificate by using the second private key of the PKI service platform to obtain the first public key, and calls the function interface of the SIM card management platform based on the first public key to obtain the first private key, decrypts the first ciphertext by using the first private key, and obtains the service information.

[0134] In some embodiments, the PKI service platform has a root certificate. The terminal device 700 can further include a secure channel establishment module, which can be configured to establish a bidirectional secure channel with the PKI service platform in a case where the verification of the device certificate by the PKI service platform using the root certificate is passed.

[0135] It should be noted that the secure communication apparatus 500, the secure communication apparatus 600 and the terminal device 700 are apparatuses corresponding to the secure communication method described above, and all implementation manners in the method embodiments are applicable to the embodiments of the secure communication apparatus 500, the secure communication apparatus 600 and the terminal device 700, and the same technical effects can be achieved.

[0136] The seventh aspect of the present disclosure provides a secure communication device, which can be applied to a PKI service platform. FIG. 11 is a structural schematic diagram of a secure communication device according to an embodiment of the seventh aspect of the present disclosure. As shown in FIG. 11, the secure communication device 800 includes a memory 801, a processor 802, and a computer program stored in the memory 801 and executable on the processor 802.

[0137] In some examples, the processor 802 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present disclosure.

[0138] The memory 801 can include a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical, or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the secure communication method according to the first aspect of the embodiments of the present disclosure.

[0139] The processor 802 runs a computer program corresponding to the executable program code stored in the memory 801 by reading the executable program code, for implementing the secure communication method in the above-mentioned first aspect embodiment.

[0140] In some examples, the secure communication device 800 can further include a communication interface 803 and a bus 804. As shown in FIG. 11, the memory 801, the processor 802, and the communication interface 803 are connected through the bus 804 and complete communication among each other.

[0141] The communication interface 803 is mainly used to implement the communication among the modules, devices, units, and / or apparatuses in the embodiments of the present disclosure. The input device and / or the output device can also be accessed through the communication interface 803.

[0142] Bus 804 includes a hardware, software, or both that couples components of security communication device 800 to each other. As an example and not by way of limitation, bus 804 can include an accelerated graphics port (AGP) or other graphics bus, an enhanced industry standard architecture (EISA) bus, a front-side bus (FSB), a Hyper Transport (HT) interconnect, an industry standard architecture (ISA) bus, an infiniband interconnect, a low pin count (LPC) bus, a memory bus, a micro channel architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a serial advanced technology attachment (SATA) bus, a video electronics standards board (VLB) bus, or another suitable bus or a combination of two or more of these. Where appropriate, bus 804 can include one or more buses. Although this disclosure describes and illustrates a particular bus, this disclosure contemplates any suitable bus or interconnect.

[0143] An eighth aspect of the present disclosure provides a security communication device, which can be applied to a SIM card management platform. The security communication device can include a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0144] The memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software comprising computer-executable instructions and when the software is executed (e.g., by one or more processors) it is operable to perform operations described with reference to the security communication method according to the second aspect embodiment in the embodiments of the present disclosure.

[0145] The processor executes a computer program corresponding to the executable program code stored in the memory by reading the executable program code, for implementing the security communication method in the second aspect embodiment described above.

[0146] In some examples, the secure communication device can further include a communication interface and a bus. Wherein the memory, the processor, the communication interface are connected through the bus and complete communication among each other.

[0147] The specific implementation manners of the memory, the processor, the communication interface and the bus can be connected as described above in the related description of the secure communication device 800 in the embodiments, and will not be repeated here.

[0148] The ninth aspect of the present disclosure provides a terminal device having a SIM card. The terminal device can include a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0149] The memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software comprising computer-executable instructions and when the software is executed (e.g., by one or more processors) it is operable to perform operations described with reference to the secure communication method according to the third aspect of the embodiments of the present disclosure.

[0150] The processor runs the computer program corresponding to the executable program code stored in the memory by reading the executable program code, for implementing the secure communication method in the third aspect of the embodiments described above.

[0151] In some examples, the terminal device can further include a communication interface and a bus. Wherein the memory, the processor, the communication interface are connected through the bus and complete communication among each other.

[0152] The specific implementation manners of the memory, the processor, the communication interface and the bus can be connected as described above in the related description of the secure communication device 800 in the embodiments, and will not be repeated here.

[0153] The tenth aspect of the present disclosure provides a secure communication system. The secure communication system can include a PKI service platform, a SIM card management platform and a terminal device. The PKI service platform is configured to perform the secure communication method in the first aspect of the embodiments described above, the SIM card management platform is configured to perform the secure communication method in the second aspect of the embodiments described above, and the terminal device is configured to perform the secure communication method in the third aspect of the embodiments described above. The specific contents of the PKI service platform, the SIM card management platform, the terminal device and the respective performed secure communication methods can be referred to the related description in the embodiments described above, and the same technical effects can be achieved. To avoid repetition, they will not be repeated here.

[0154] The eleventh aspect of the present disclosure provides a computer readable storage medium, and computer program instructions are stored on the computer readable storage medium. The computer program instructions are executed by a processor to implement the secure communication method in the first aspect, the secure communication method in the second aspect, or the secure communication method in the third aspect, and achieve the same technical effects. To avoid repetition, details are not described herein. The computer readable storage medium can include a non-transitory computer readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a magnetic disc, or an optical disc, and is not limited herein.

[0155] The twelfth aspect of the present disclosure provides a computer program product, and the computer program product includes a computer program. The computer program is executed by a processor to implement the secure communication method in the first aspect, the secure communication method in the second aspect, or the secure communication method in the third aspect, and achieve the same technical effects. To avoid repetition, details are not described herein.

[0156] It should be clear that each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between each of the embodiments can be referred to each other. Each of the embodiments focuses on the differences from other embodiments. For the device embodiments, the equipment embodiments, the system embodiments, the computer readable storage medium embodiments, and the computer program product embodiments, the related parts can be referred to the description of the method embodiments. The present disclosure is not limited to the specific steps and structures described above and shown in the drawings. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps, after understanding the spirit of the present disclosure. Moreover, to be brief, detailed descriptions of known methods and techniques are omitted herein.

[0157] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. Alternatively, computer program implemented processes can be conveyed, implemented, or performed by a general purpose computer, a special purpose computer, an ASIC, or a specially designed logic circuit.

[0158] It should be understood that all the above-described embodiments are merely exemplary but not limiting. The different technical features appearing in the different embodiments can be combined to achieve beneficial effects. Based on the drawings, the specification, and the claims, a person skilled in the art should understand and be able to implement other changed embodiments of the disclosed embodiments. In the claims, the term “comprising” does not exclude other devices or steps; the numerical term “one” does not exclude more than one; the terms “first”, “second” are used to identify names and not to indicate any particular order. Any reference signs in the claims should not be understood as limiting the scope of protection. The functions of several parts appearing in the claims can be implemented by a single hardware or software module. The fact that certain technical features appear in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A secure communication method applied to a public key infrastructure (PKI) service platform, the method comprising: receiving a certificate application message sent by a terminal device, the certificate application message being encrypted by a first public key in a subscriber identity module (SIM) card in the terminal device based on device information and service information of the terminal device, in a case where the terminal device establishes a one-way transport layer security (TLS) link with the PKI service platform; calling a function interface of a SIM card management platform, so that the SIM card management platform verifies the SIM card in the terminal device based on the certificate application message and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result; and issuing a device certificate to the terminal device through the one-way TLS link in a case where the decryption result indicates that the decryption is successful. 2.The method of claim 1, wherein the device information comprises a SIM card identifier of the SIM card; the SIM card identifier is used by the SIM card management platform to verify the SIM card, and the verification of the SIM card comprises legality verification and / or attribution verification; and in a case where the verification of the SIM card is passed, the SIM card identifier is used by the SIM card management platform to obtain the first private key corresponding to the SIM card identifier. 3.The method of claim 1 or 2, wherein the calling of the function interface of the SIM card management platform comprises: obtaining the device information from the certificate application message, and determining whether the terminal device has access rights according to the device information; and calling the function interface of the SIM card management platform in a case where the terminal device has the access rights. 4.The method of any one of claims 1-3, wherein the device certificate comprises the first public key, the device information, certificate information and a digital signature, and the digital signature is generated based on a second private key of the PKI service platform. 5.The method of any one of claims 1-4, further comprising: limiting access of the terminal device to the PKI service platform if a number of times of receiving the certificate application message from the terminal device within a preset time period satisfies a preset security risk condition. 6.The method of claim 1, further comprising, after the issuing of the device certificate to the terminal device through the TLS link: receiving a service message sent by the terminal device, the service message comprising the device certificate and first ciphertext, the first ciphertext being encrypted by the terminal device based on service information by using the first public key; decrypting the device certificate by using a second private key of the PKI service platform to obtain the first public key from the device certificate; and obtaining the first private key from the SIM card management platform by calling the function interface of the SIM card management platform based on the first public key, and decrypting the first ciphertext by using the first private key to obtain the service information. 7.The method of claim 6, wherein the PKI service platform has a root certificate; and the method further comprises, after the receiving of the service message sent by the terminal device: ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ verify the device certificate by using the root certificate; if the device certificate is verified, establish a two-way secure channel with the terminal device. 8.A secure communication method applied to a user identification SIM card management platform, the method comprising: in a case where a terminal device establishes a one-way secure transmission layer protocol (TLS) link with a public key infrastructure (PKI) service platform, accepting a call initiated by the PKI service platform in response to a certificate application message sent by the terminal device, verifying a SIM card in the terminal device based on the certificate application message, and decrypting the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result, the certificate application message being encrypted by the terminal device based on device information and service information by using a first public key in the SIM card in the terminal device; feeding back the decryption result to the PKI service platform, so that the PKI service platform issues a device certificate to the terminal device through the one-way TLS link in a case where the decryption result represents successful decryption. 9.The method of claim 8, wherein the device information comprises a SIM card identifier of the SIM card. The verifying the SIM card in the terminal device based on the certificate application message and the decrypting the certificate application message by using the first private key corresponding to the SIM card to obtain the decryption result comprise: obtaining the SIM card identifier from the certificate application message, and verifying the SIM card by using the SIM card identifier, the verifying the SIM card comprising legality verification and / or attribution verification; in a case where the verifying the SIM card is passed, obtaining the first private key corresponding to the SIM card identifier according to the SIM card identifier; decrypting the certificate application message by using the first private key to obtain the decryption result. 10.The method of claim 8 or 9, wherein the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access authority. The accepting the call initiated by the PKI service platform in response to the certificate application message sent by the terminal device comprises: in a case where the PKI service platform determines that the terminal device has the authority, accepting the call initiated by the PKI service platform in response to the certificate application message sent by the terminal device. 11.The method of any one of claims 8-10, wherein the device certificate comprises the first public key, the device information, certificate information, and a digital signature, the digital signature being generated based on a second private key of the PKI service platform. 12.The method of any one of claims 8-11, further comprising: in a case where the PKI service platform decrypts the device certificate in a received service message by using a second private key of the PKI service platform to obtain the first public key, accepting a call of the PKI service platform, obtaining the first private key corresponding to the first public key, the first private key being used to decrypt first cipher text to obtain service information. The service message includes the device certificate and the first ciphertext, and the first ciphertext is encrypted by the terminal device based on service information and using the first public key. 13.A secure communication method applied to a terminal device, the terminal device having a user identification SIM card, the method comprising: in a case where a one-way secure transmission layer protocol TLS link is established between the terminal device and a public key infrastructure PKI service platform, a certificate application message is encrypted based on device information and service information of the terminal device and using a first public key in the SIM card; the certificate application message is sent to the PKI service platform, so that the PKI service platform calls a function interface of a SIM card management platform, and the SIM card management platform verifies the SIM card in the terminal device based on the certificate application message and decrypts the certificate application message using a first private key corresponding to the SIM card to obtain a decryption result; in a case where the decryption result represents successful decryption, a device certificate issued by the PKI service platform is received through the one-way TLS link. 14.The method of claim 13, wherein the device information includes a SIM card identification of the SIM card; the SIM card identification is used by the SIM card management platform to verify the SIM card, and the verification of the SIM card includes legality verification and / or attribution verification, and in a case where the verification of the SIM card is passed, the SIM card identification is used by the SIM card management platform to obtain the first private key corresponding to the SIM card identification. 15.The method of claim 13 or 14, wherein the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access permission, and in a case where the terminal device has access permission, the PKI service platform calls the function interface of the SIM card management platform. 16.The method of any one of claims 13-15, wherein the device certificate includes the first public key, the device information, certificate information and a digital signature, and the digital signature is generated based on a second private key of the PKI service platform. 17.The method of any one of claims 13-16, wherein in a case where a number of times that the terminal device sends the certificate application message to the PKI service platform within a preset time period satisfies a preset security risk condition, access of the terminal device to the PKI service platform is limited by the PKI service platform. 18.The method of any one of claims 13-17, after the device certificate issued by the PKI service platform is received through the one-way TLS link, further comprising: first ciphertext is encrypted based on service information and using the first public key, and a service message is generated according to the first ciphertext and the device certificate. ​ ​ sending the service message to the PKI service platform, so that the PKI service platform uses a second private key of the PKI service platform to decrypt the device certificate to obtain the first public key, and calls a function interface of the SIM card management platform based on the first public key to obtain a first private key, and uses the first private key to decrypt the first cipher text to obtain the service information.

19. The method of claim 18, wherein the PKI service platform has a root certificate. After the step of sending the service message to the PKI service platform, the method further comprises: In a case where the verification of the device certificate by the PKI service platform using the root certificate is passed, establishing a bidirectional secure channel with the PKI service platform.

20. A secure communication apparatus applied to a public key infrastructure (PKI) service platform, the apparatus comprising: a receiving module configured to, in a case where a terminal device and the PKI service platform establish a unidirectional secure transmission layer security (TLS) link, receive a certificate application message sent by the terminal device, the certificate application message being encrypted by the terminal device based on device information and service information of the terminal device using a first public key in a subscriber identity (SIM) card in the terminal device; an interface calling module configured to call a function interface of a SIM card management platform, so that the SIM card management platform verifies the SIM card in the terminal device based on the certificate application message and decrypts the certificate application message using a first private key corresponding to the SIM card to obtain a decryption result; a sending module configured to, in a case where the decryption result represents that the decryption is successful, issue a device certificate to the terminal device through the unidirectional TLS link.

21. A secure communication apparatus applied to a subscriber identity (SIM) card management platform, the apparatus comprising: a processing module configured to, in a case where a terminal device and a public key infrastructure (PKI) service platform establish a unidirectional secure transmission layer security (TLS) link, accept a call initiated by the PKI service platform in response to a certificate application message sent by the terminal device, verify a SIM card in the terminal device based on the certificate application message, and decrypt the certificate application message using a first private key corresponding to the SIM card to obtain a decryption result, the certificate application message being encrypted by the terminal device based on device information and service information using a first public key in the SIM card in the terminal device; a sending module configured to feed back the decryption result to the PKI service platform, so that the PKI service platform issues a device certificate to the terminal device through the unidirectional TLS link in a case where the decryption result represents that the decryption is successful.

22. A terminal device having a subscriber identity (SIM) card therein, the terminal device comprising: a message generating module configured to, in a case where the terminal device and a public key infrastructure (PKI) service platform establish a unidirectional secure transmission layer security (TLS) link, encrypt a certificate application message based on device information and service information of the terminal device using a first public key in the SIM card. a sending module configured to send the certificate application message to the PKI service platform, so that the PKI service platform invokes a function interface of a SIM card management platform, and the SIM card management platform verifies a SIM card in the terminal device based on the certificate application message and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result; a receiving module configured to receive a device certificate issued by the PKI service platform through the one-way TLS link in a case where the decryption result represents successful decryption.

23. A secure communication device for use in a public key infrastructure (PKI) service platform, the device comprising: a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the secure communication method in any one of claims 1 to 7.

24. A secure communication device, applied to a user identification SIM card management platform, the device comprising: a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the secure communication method in any one of claims 8 to 12.

25. A terminal device having a subscriber identity module (SIM) card therein, the terminal device comprising: a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the secure communication method in any one of claims 13 to 19.

26. A secure communication system, comprising: a public key infrastructure (PKI) service platform configured to implement the secure communication method in any one of claims 1 to 7; a subscriber identity module (SIM) card management platform in communication connection with the PKI service platform and configured to implement the secure communication method in any one of claims 8 to 12; a terminal device in communication connection with the PKI service platform and configured to implement the secure communication method in any one of claims 13 to 19.

27. A computer readable storage medium, the computer readable storage medium storing computer program instructions, the computer program instructions being executed by a processor to implement the secure communication method in any one of claims 1 to 19.

28. A computer program product, comprising a computer program, the computer program being executed by a processor to implement the secure communication method in any one of claims 1 to 19.

Images