CN105873045B - Method for security protection, device, system and the terminal of soft SIM card - Google Patents

Abstract

The invention discloses a security protection method for a soft SIM card. After the verification is passed, the soft SIM card allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area. The invention also discloses a safety protection device, system and terminal of the soft SIM card.

Description

Security protection method, device, system and terminal of soft SIM card

technical field

The present invention relates to the field of wireless communication, and in particular, to a security protection method, device, system and terminal for a Soft Subscriber Identity Module (SIM, SubscriberIdentity Module) card.

Background technique

At present, the Internet of Things field has special requirements for the Universal Subscriber Identity Module (USIM, Universal Subscriber Identity Module) card. For example, the industrial field needs to adapt to the special environmental requirements of high temperature and low temperature, and the wearable device requires the USIM card to be as small as possible. A soft SIM card solution in which software implements the function of a USIM card is very feasible, but the security of the software and hardware environment of the soft SIM card solution is much lower than that of a chip-type USIM card.

In order to improve the security of soft SIM cards, a series of solutions have emerged, such as: soft SIM card solutions based on ARM TrustZone, soft SIM card solutions based on built-in dedicated flash memory (Flash), etc., but these solutions all require baseband chips Support TrustZone or chip modification to support built-in dedicated Flash, that is, the baseband chip needs to be modified, and these modifications will greatly increase the cost of the chip.

SUMMARY OF THE INVENTION

In order to solve the existing technical problems, the embodiments of the present invention provide a security protection method, device, system and terminal for a soft SIM card.

An embodiment of the present invention provides a security protection method for a soft SIM card, the method comprising:

After receiving the request for accessing the soft SIM card-related information stored in the eMMC (Embedded Multi Media Card) playback protection memory block (RPMB, Replay Protected Memory Block) area, the soft SIM card verifies the legitimacy of the request;

After the verification is passed, the soft SIM card allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area.

In the above solution, before receiving the request, the method further includes:

When the terminal accesses the network, the soft SIM card sends the hardware identification of the terminal and its own identification to the network side to verify the legitimacy of the terminal;

After the soft SIM card receives the legal instruction of the terminal on the network side, the terminal enables the terminal to perform network communication through the soft SIM card.

In the above solution, before verifying the validity of the request, the method further includes:

The soft SIM card verifies the legality of the request when it is determined that the terminal is legal according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card.

In the above solution, the determining that the terminal is legal is:

The soft SIM card compares the terminal identifier corresponding to the binding relationship with the terminal identifier corresponding to the request, and when the two are the same, it is determined that the terminal is legitimate.

In the above solution, the verification of the validity of the request includes:

The soft SIM card utilizes a secure hash algorithm (SHA, Secure Hash Algorithm) to calculate a message authentication code (MAC, Message Authentication Code) value according to the counter (Counter) value and the key (key) value of the eMMC where it is located;

The soft SIM card compares the calculated MAC value with the MAC value carried in the request;

The soft SIM card determines the validity of the request according to the comparison result.

The embodiment of the present invention also provides a security protection method for a soft SIM card, including:

When accessing the network, the terminal sends its own hardware identifier and the corresponding soft SIM card identifier to the network side;

The network side matches the received terminal hardware identifier and the corresponding soft SIM card identifier with the terminal hardware identifier stored by itself and the corresponding soft SIM card identifier, and when the matching is determined, the terminal is allowed to use the corresponding soft SIM card for Telecommunication.

In the above scheme, the described matching of the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification, including:

The base station sends the received terminal hardware identifier and the corresponding soft SIM card identifier to a mobility management entity (MME, Mobility Management Entity);

The MME sends the received terminal hardware identifier and the corresponding soft SIM card identifier to a Home Subscriber Server (HSS, Home Subscriber Server);

The HSS sends the received terminal hardware identification and the corresponding soft SIM card identification to the verification server;

The verification server matches the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification.

In the above solution, when the matching is determined, the terminal is allowed to perform network communication through the corresponding soft SIM card, including:

When the verification server determines that the received terminal hardware identifier and the corresponding soft SIM card identifier match the terminal hardware identifier stored by itself and the corresponding soft SIM card identifier, it reports to the HSS that the matching is successful;

The HSS feeds back the matching success to the MME; the MME feeds back the matching success to the base station;

After receiving the successful matching feedback from the MME, the base station allows the terminal to perform network communication through the corresponding soft SIM card.

The embodiment of the present invention also provides a security protection device for a soft SIM card, including: a first verification unit and an access unit; wherein,

The first verification unit is used to verify the legitimacy of the request after receiving a request for accessing the relevant information of the soft SIM card stored in the eMMC RPMB area;

The access unit is configured to allow the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area after the verification is passed.

In the above solution, the device further includes: a second verification unit, configured to send the hardware identification of the terminal and the identification of the soft SIM card to the network side to verify the terminal when the terminal accesses the network and after receiving the legal instruction of the terminal on the network side, make the terminal perform network communication through the soft SIM card.

In the above solution, the device further includes: a third verification unit, configured to trigger the first verification when it is determined that the terminal is legal according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card The verification unit verifies the validity of the request.

In the above scheme, the first verification unit is specifically used to: calculate the MAC value by using SHA according to the Counter value and the key value of the eMMC where it is located; compare the calculated MAC value with the MAC value carried in the request; and according to The result of the comparison determines the legitimacy of the request.

An embodiment of the present invention further provides a terminal, where the electronic device includes the above-mentioned security protection device for a soft SIM card.

An embodiment of the present invention further provides a terminal, including: a storage unit and a sending unit; wherein,

The storage unit is used to store the hardware identification of the terminal and the corresponding soft SIM card identification;

The sending unit is configured to send the stored hardware identifier of the terminal and the corresponding soft SIM card identifier to the network side when the terminal accesses the network.

An embodiment of the present invention further provides a security protection system for a soft SIM card, including: a terminal and a network side device; wherein,

The terminal, when used to access the network, sends its own hardware identification and the corresponding soft SIM card identification to the network side device;

The network side device is used to match the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification, and when the matching is determined, the terminal is allowed to pass the corresponding software SIM card identification. Soft SIM card for network communication.

In the above solution, the network side equipment includes: a base station, an MME, an HSS, and a verification server; wherein,

The base station is configured to send the received terminal hardware identification and the corresponding soft SIM card identification to the MME; and after receiving the successful matching feedback from the MME, allow the terminal to perform a corresponding soft SIM card for the terminal. Telecommunication;

The MME is configured to send the received terminal hardware identifier and the corresponding soft SIM card identifier to the HSS; and after receiving the successful matching feedback from the HSS, feedback the successful matching to the base station;

The HSS is used to send the received terminal hardware identification and the corresponding soft SIM card identification to the verification server; and after receiving the successful matching feedback from the verification server, feedback the matching success to the MME;

The verification server is used to match the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification; and when matching, feedback the matching success to the HSS .

In the security protection method, device, system and terminal for a soft SIM card provided by the embodiments of the present invention, after receiving a request for accessing information related to the soft SIM card stored in the eMMC RPMB area, the soft SIM card verifies the validity of the request; After passing, the soft SIM card allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area. Since the user data and SIM card information that the soft SIM card needs to store is stored in the RPMB area, it can effectively It can prevent malicious theft of sensitive data, improve the security of soft SIM card application, and does not need to modify the hardware equipment, and the implementation cost is low; when accessing the network, the terminal will use its own hardware identification and corresponding soft SIM card identification. Send to the network side; the network side matches the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification, and when the matching is determined, the terminal is allowed to pass the corresponding identification. The soft SIM card is used for network communication. In this way, malicious stealing of sensitive data can be effectively prevented, the security of the soft SIM card application is improved, the hardware device does not need to be modified, and the implementation cost is low.

Description of drawings

In the drawings, which are not necessarily to scale, like reference numerals may describe like parts in the different views. Similar reference numbers with different letter suffixes may denote different instances of similar components. The accompanying drawings generally illustrate, by way of example and not limitation, the various embodiments discussed herein.

1 is a schematic flowchart of a security protection method for a soft SIM card according to an embodiment of the present invention;

2 is a schematic diagram of an eMMC architecture according to an embodiment of the present invention;

3 is a schematic diagram of a storage area of an eMMC according to Embodiment 1 of the present invention;

4 is a schematic diagram of the interaction of various devices for verifying whether the terminal is legal through the network side according to Embodiment 1 of the present invention;

5 is a schematic diagram of a specific processing flow for verifying whether a received request is legal according to Embodiment 1 of the present invention;

6 is a schematic flowchart of another security protection method for a soft SIM card according to an embodiment of the present invention;

7 is a schematic structural diagram of a security protection device for a soft SIM card according to Embodiment 2 of the present invention;

FIG. 8 is a schematic structural diagram of a terminal according to Embodiment 2 of the present invention;

FIG. 9 is a schematic structural diagram of a security protection system of a soft SIM card according to Embodiment 2 of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

The security mechanism based on eMMC can realize the security protection of the soft SIM card at a relatively low cost on the basis of the existing hardware architecture.

At present, whether the soft SIM card scheme is based on dedicated Flash or the soft SIM card scheme based on TrustZone, these schemes need to make changes to the baseband chip to support these schemes, so the implementation cost is relatively high. At the same time, in recent years, smart terminals tend to use eMMC to connect Flash chips to support large-capacity Flash, and terminal manufacturers do not need to adapt to different Flash. In addition, eMMC itself has a mechanism that can protect an area. Therefore, based on the existing eMMC security mechanism, the existing security mechanism of the smart terminal can be fully utilized to improve the security of the soft SIM card without increasing its own cost. .

Based on this, in various embodiments of the present invention: after receiving a request for accessing information related to the soft SIM card stored in the eMMC RPMB area, the soft SIM card verifies the validity of the request; after the verification is passed, the soft SIM card The card allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area.

Example 1

The security protection method of the soft SIM card in this embodiment, as shown in Figure 1, includes the following steps:

Step 101: After receiving a request for accessing the soft SIM card-related information stored in the eMMC RPMB area, the soft SIM card verifies the validity of the request;

Here, the relevant information of the soft SIM card may include: user data and SIM card data.

As shown in Figure 2, at present, smart terminals tend to connect to Flash based on eMMC, which does not need to be adapted to Flash, and can support large-capacity Flash.

Among them, as shown in Figure 3, in the storage area of the eMMC external Flash, the RPMB area is a protected area. Therefore, the user data and SIM card data that need to be stored by the soft SIM card can be placed in the RPMB area process protection, thereby Prevent malicious theft of sensitive data.

Here, for sensitive data (such as keys, etc.) in the user data, the hardware information of the terminal (such as the serial number of the terminal ARM chip or the international mobile equipment identity code (IMEI, International MobileEquipment Identity) of the terminal, etc.) can be used as encryption Sensitive data is further encrypted and protected. Correspondingly, when the encrypted data is obtained, the sensitive data is obtained after decryption with the corresponding encryption factor. In this way, the security of the soft SIM card application can be further guaranteed.

Before performing this step, the method may further include:

When the terminal accesses the network, the soft SIM card sends the hardware identification of the terminal and its own identification to the network side to verify the legitimacy of the terminal;

After receiving the legitimate indication of the terminal on the network side, the soft SIM card enables the terminal to perform network communication through the soft SIM card.

Wherein, the hardware identification of the terminal may be: IMEI, etc.; the identification of the soft SIM card may be an International Mobile Subscriber Identification Number (IMSI, International Mobile Subscriber Identification Number), etc. As shown in FIG. 4, when the data is activated, the soft SIM The card reports its own identification and the hardware identification of the terminal where it is located to the network side through a short message, and the verification server on the network side stores the corresponding relationship between the hardware identification of the terminal and the identification of the soft SIM card, and then the corresponding relationship can only be changed through manual channels, thereby to change the binding relationship. Each time the terminal restarts to access the network, the access request (Attach_request) will carry the IMEI and IMSI. After receiving the request, the network side will check whether the terminal is legal by querying the corresponding relationship between the IMEI and the IMSI.

Specifically, after receiving the access request carrying the IMEI and IMSI from the terminal, the base station (eNodeB) sends the access request to the MME; after receiving the access request, the MME sends the query request containing the IMEI and IMSI to the HSS ; After the HSS receives the query request, it sends the query request to the verification server; after the verification server receives the query request, it matches the corresponding relationship between the IMEI and IMSI saved by itself with the IMEI and IMSI in the query request, and returns the match to the HSS Result; HSS returns the matching result to MME; MME returns the matching result to the terminal (soft SIM card) through the base station. Wherein, if the IMEIs corresponding to the IMSIs are the same, and the matching result is successful, it means that the terminal is legal and can perform network communication through the soft SIM card; if the IMEIs corresponding to the IMSIs are not the same, and the matching result is that the matching fails, it means that the terminal is It is illegal, and network communication cannot be performed through the soft SIM card.

Before performing this step, the method may further include:

Binding the terminal where the soft SIM card is located with the SIM card;

Correspondingly, before verifying the validity of the request, the method may further include:

The soft SIM card verifies the legality of the request when it is determined that the terminal corresponding to the request is legal according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card.

The determining that the terminal corresponding to the request is legitimate is specifically:

The soft SIM card compares the terminal identifier corresponding to the binding relationship with the terminal identifier corresponding to the request. If the two are the same, it is determined that the terminal corresponding to the request is legitimate, and if the two are different, it is determined that the request corresponds to the request. The terminal is invalid, and in this case, the request is rejected.

The verification of the validity of the request, as shown in Figure 5, specifically includes:

Step 1: The soft SIM card uses SHA (such as SHA-256) to calculate the MAC value according to the Counter value and key value of the eMMC where it is located;

Among them, before the external program accesses user data and sends a request to the soft SIM card, it uses the Key value and the Counter value, and uses the same SHA (for example: SHA-256) as the soft SIM card to calculate the MAC value; and calculates the MAC value. carried in the request.

Step 2: the soft SIM card compares the calculated MAC value with the MAC value carried in the request;

Step 3: The soft SIM card determines the validity of the request according to the comparison result.

Specifically, when the two are the same, it indicates that the request is legal; when the two are different, it indicates that the request is illegal.

When the request is invalid, the soft SIM card does not allow the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area.

Step 102: After the verification is passed, the soft SIM card allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area.

In practical application, the scheme of verifying whether the terminal is legal through the network side can be adopted alone. Based on this, this embodiment also provides another security protection method for a soft SIM card. As shown in FIG. 6 , the method includes the following steps:

Step 601: When accessing the network, the terminal sends its own hardware identification and the corresponding soft SIM card identification to the network side;

Specifically, the terminal may carry its own hardware identifier and the corresponding soft SIM card identifier through the access request.

Wherein, the hardware identifier of the terminal may be: IMEI, etc.; the identifier of the soft SIM card may be IMSI, etc.

Step 602: The network side matches the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification, and when the matching is determined, the terminal is allowed to pass the corresponding software identification. SIM card for network communication.

Specifically, the base station sends the received terminal hardware identifier and the corresponding soft SIM card identifier to the mobility management entity MME;

The MME sends the received terminal hardware identifier and the corresponding soft SIM card identifier to the home subscriber server HSS;

The HSS sends the received terminal hardware identification and the corresponding soft SIM card identification to the verification server;

The verification server matches the received terminal hardware identifier and the corresponding soft SIM card identifier with the terminal hardware identifier stored by itself and the corresponding soft SIM card identifier.

Here, when the verification server determines that the received terminal hardware identification and the corresponding soft SIM card identification match with the terminal hardware identification stored by itself and the corresponding soft SIM card identification, it will feedback to the HSS that the matching is successful;

The HSS feeds back the matching success to the MME; the MME feeds back the matching success to the base station;

After receiving the successful matching feedback from the MME, the base station allows the terminal to perform network communication through the corresponding soft SIM card.

In practical application, as shown in FIG. 4 , when the data is activated, the soft SIM card reports its own identity and the hardware identity of the terminal where it is located to the network side through a short message, and the verification server on the network side stores the hardware identity of the terminal and the soft SIM card. The corresponding relationship of the logo, and then the corresponding relationship can only be changed through manual channels, so that the binding relationship can be changed. Each time the terminal restarts to access the network, the access request (Attach_request) will carry the IMEI and IMSI. After receiving the request, the network side will check the corresponding relationship between the IMEI and the IMSI at this time to confirm whether the terminal is legal.

After receiving the access request carrying the IMEI and IMSI from the terminal, the base station (eNodeB) sends the access request to the MME; after receiving the access request, the MME sends the query request containing the IMEI and IMSI to the HSS; the HSS receives the access request. After the query request arrives, the query request is sent to the verification server; after the verification server receives the query request, it matches the corresponding relationship between the IMEI and IMSI saved by itself with the IMEI and IMSI in the query request, and returns the matching result to the HSS; HSS Return the matching result to the MME; the MME returns the matching result to the terminal through the base station. Wherein, if the IMEIs corresponding to the IMSIs are the same, and the matching result is successful, it means that the terminal is legal and can perform network communication through the soft SIM card; if the IMEIs corresponding to the IMSIs are not the same, and the matching result is that the matching fails, it means that the terminal is It is illegal, and network communication cannot be performed through the soft SIM card.

In the security protection method for a soft SIM card provided in this embodiment, after receiving a request for accessing information related to the soft SIM card stored in the eMMC RPMB area, the soft SIM card verifies the validity of the request; after the verification is passed, the soft SIM card The card allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area, because the user data and SIM card information that the soft SIM card needs to store is stored in the RPMB area, so it can effectively prevent malicious access to sensitive data. Steal, improve the security of soft SIM card applications. Also, the implementation does not increase the hardware cost.

In addition, when the terminal accesses the network, the soft SIM card sends the hardware identification of the terminal and the identification of the soft SIM card to the network side to verify the legitimacy of the terminal; the soft SIM card receives the After the terminal is legally indicated on the network side, the terminal is allowed to communicate with the network through the soft SIM card, and the terminal is managed uniformly through the network side. In this way, it has good manageability and can further ensure the application of the soft SIM card. security.

When the soft SIM card determines that the terminal corresponding to the request is legal according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card, the legality of the request is verified. Security of SIM card applications.

Embodiment 2

In order to implement the method of the first embodiment, this embodiment provides a security protection device for a soft SIM card. As shown in FIG. 7 , the device may include: a first verification unit 71 and an access unit 72; wherein,

The first verification unit 71 is used to verify the legitimacy of the request after receiving a request for accessing the relevant information of the soft SIM card stored in the eMMC RPMB area;

The access unit 72 is configured to allow the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area after the verification is passed.

Here, the relevant information of the soft SIM card may include: user data and SIM card data.

As shown in Figure 2, at present, smart terminals tend to connect to Flash based on eMMC, which does not need to be adapted to Flash, and can support large-capacity Flash.

Among them, as shown in Figure 3, in the storage area of the eMMC external Flash, the RPMB area is a protected area. Therefore, the user data and SIM card data that need to be stored by the soft SIM card can be placed in the RPMB area process protection, thereby Prevent malicious theft of sensitive data.

Here, for the sensitive data in the user data, the hardware information of the terminal (such as the serial number of the terminal ARM chip or the IMEI of the terminal, etc.) can be used as the encryption factor to further encrypt and protect the sensitive data. After these encrypted data are decrypted with corresponding encryption factors, sensitive data can be obtained. In this way, the security of the soft SIM card application can be further guaranteed.

The device may further include: a second verification unit, configured to send the hardware identification of the terminal and the identification of the soft SIM card to the network side to verify the legitimacy of the terminal when the terminal accesses the network; And after receiving the legitimate instruction of the terminal on the network side, the terminal is made to perform network communication through the soft SIM card.

Wherein, the hardware identification of the terminal may be: IMEI, etc.; the identification of the soft SIM card may be IMSI, etc., as shown in Figure 4, when the data is activated, the soft SIM card reports its own identification and the terminal where it is located to the network side through a short message The verification server on the network side stores the corresponding relationship between the hardware identification of the terminal and the identification of the soft SIM card, and then the corresponding relationship can only be changed through manual channels, so as to change the binding relationship. Each time the terminal restarts to access the network, the access request (Attach_request) will carry the IMEI and IMSI. After receiving the request, the network side will check whether the terminal is legal by querying the corresponding relationship between the IMEI and the IMSI.

Specifically, after receiving the access request carrying the IMEI and IMSI sent by the second verification unit, the eNodeB sends the access request to the MME; after receiving the access request, the MME sends the access request containing the IMEI and IMSI to the HSS After receiving the query request, the HSS sends the query request to the verification server; after receiving the query request, the verification server matches the corresponding relationship between the IMEI and IMSI saved by itself with the IMEI and IMSI in the query request, and sends the query request to the verification server. The HSS returns the matching result; the HSS returns the matching result to the MME; the MME returns the matching result to the second verification unit through the base station. Wherein, if the IMEIs corresponding to the IMSIs are the same, and the matching result is successful, it means that the terminal is legal and can perform network communication through the soft SIM card; if the IMEIs corresponding to the IMSIs are not the same, and the matching result is that the matching fails, it means that the terminal is It is illegal, and network communication cannot be performed through the soft SIM card.

The device may further include: a third verification unit, configured to trigger the first verification when it is determined that the terminal corresponding to the request is legitimate according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card Unit 71 verifies the validity of the request.

The determining that the terminal corresponding to the request is legitimate is specifically:

Comparing the terminal identifier corresponding to the binding relationship with the terminal identifier corresponding to the request, if the two are the same, it is determined that the terminal corresponding to the request is legal, and if the two are different, it is determined that the terminal corresponding to the request is illegal, At this point, the request is denied.

The verification of the validity of the request, as shown in Figure 5, specifically includes:

Step 1: The first verification unit 71 uses SHA (for example: SHA-256) to calculate the MAC value according to the Counter value and key value of the eMMC where it is located;

Among them, before the external program accesses user data and sends a request to the soft SIM card, it uses the Key value and the Counter value, and uses the same SHA (for example: SHA-256) as the soft SIM card to calculate the MAC value; and calculates the MAC value. carried in the request.

Step 2: the first verification unit 71 compares the calculated MAC value with the MAC value carried in the request;

Step 3: The first verification unit 71 determines the validity of the request according to the comparison result.

Specifically, when the two are the same, it indicates that the request is legal; when the two are different, it indicates that the request is illegal.

When the request is invalid, the terminal corresponding to the request is not allowed to access the relevant information of the soft SIM card in the RPMB area.

In practical application, the second verification unit can be a central processing unit (CPU, Central Processing Unit), a microprocessor (MCU, Micro Control Unit), a digital signal processor (DSP, Digital) in the security protection device of the soft SIM card Signal Processor) or Programmable Logic Array (FPGA, Field-Programmable GateArray) combined with transceivers; the first verification unit 71, access unit 72, and third verification unit can be implemented by CPU and MCU in the security protection device of the soft SIM card , DSP or FPGA implementation.

In the security protection device for a soft SIM card provided in this embodiment, after receiving a request for accessing information related to the soft SIM card stored in the eMMC RPMB area, the first verification unit 71 verifies the validity of the request; after the verification is passed, The access unit 72 allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area, because the user data and SIM card information that the soft SIM card needs to store is stored in the RPMB area, so that maliciousness can be effectively prevented. The theft of sensitive data improves the security of soft SIM card applications. Also, the implementation does not increase the hardware cost.

In addition, when the terminal accesses the network, the second verification unit sends the hardware identification of the terminal and the identification of the soft SIM card to the network side to verify the legitimacy of the terminal; After receiving the legitimate instruction of the terminal, the terminal is made to perform network communication through the soft SIM card, in this way, the security of the application of the soft SIM card can be further ensured.

When the third verification unit determines that the terminal corresponding to the request is legal according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card, the third verification unit verifies the legality of the request, and verifies the terminal through the network side. Unified management is carried out, so that it has good manageability and can further ensure the security of the soft SIM card application.

Based on the above device, this embodiment also provides a terminal, the terminal includes the basic structure of the security protection device of the soft SIM card shown in FIG. 7 and its various modifications and equivalent replacements, which will not be repeated.

To implement the method of this embodiment, this embodiment further provides another terminal. As shown in FIG. 8 , the terminal includes: a storage unit 81 and a sending unit 82; wherein,

The storage unit 81 is used to store the hardware identification of the terminal and the corresponding soft SIM card identification;

The sending unit 82 is configured to send the stored hardware identifier of the terminal and the corresponding soft SIM card identifier to the network side when the terminal accesses the network; the hardware identifier of the terminal and the corresponding soft SIM card identifier Used to verify the legitimacy of the terminal.

In practical application, the storage unit 81 may be implemented by a memory in the terminal; the sending unit 82 may be implemented by a transmitter in the terminal.

To implement the method of this embodiment, this embodiment also provides a security protection system for a soft SIM card. As shown in FIG. 9 , the system includes: a terminal 91 and a network side device 92; wherein,

The terminal, when used to access the network, sends its own hardware identification and the corresponding soft SIM card identification to the network side device 92;

The network side device 92 is used to match the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification, and when the matching is determined, the terminal 91 is allowed to pass through. The corresponding soft SIM card performs network communication.

Here, the terminal 91 may carry its own hardware identifier and the corresponding soft SIM card identifier through the access request.

Wherein, the hardware identifier of the terminal 91 may be: IMEI, etc.; the identifier of the soft SIM card may be IMSI and the like.

The network side device 92 may include: a base station, an MME, an HSS, and a verification server; wherein,

The base station is configured to send the received terminal hardware identification and the corresponding soft SIM card identification to the MME; and after receiving the successful matching feedback from the MME, allow the terminal to perform a corresponding soft SIM card for the terminal. Telecommunication;

The MME is configured to send the received terminal hardware identifier and the corresponding soft SIM card identifier to the HSS; and after receiving the successful matching feedback from the HSS, feedback the successful matching to the base station;

The HSS is used to send the received terminal hardware identification and the corresponding soft SIM card identification to the verification server; and after receiving the successful matching feedback from the verification server, feedback the matching success to the MME;

The verification server is used to match the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification; and when matching, feedback the matching success to the HSS .

In practical application, as shown in FIG. 4 , when the data is activated, the soft SIM card reports its own identity and the hardware identity of the terminal where it is located to the network side through a short message, and the verification server on the network side stores the hardware identity of the terminal and the soft SIM card. The corresponding relationship of the logo, and then the corresponding relationship can only be changed through manual channels, so that the binding relationship can be changed. Each time the terminal 91 restarts to access the network, the access request (Attach_request) will carry the IMEI and IMSI. After receiving the request, the network side will check whether the terminal 91 is legal by querying the corresponding relationship between the IMEI and the IMSI at this time.

After receiving the access request carrying the IMEI and IMSI from the terminal 91, the base station (eNodeB) sends the access request to the MME; after receiving the access request, the MME sends the query request containing the IMEI and IMSI to the HSS; the HSS After receiving the query request, send the query request to the verification server; after receiving the query request, the verification server matches the corresponding relationship between the IMEI and IMSI saved by itself with the IMEI and IMSI in the query request, and returns the matching result to the HSS; The HSS returns the matching result to the MME; the MME returns the matching result to the terminal through the base station. Wherein, if the IMEIs corresponding to the IMSIs are the same, and the matching result is successful, it means that the terminal 91 is legal and can perform network communication through the soft SIM card; if the IMEIs corresponding to the IMSIs are not the same, and the matching result is a matching failure, it means that the terminal 91 It is illegal, and network communication cannot be performed through the soft SIM card.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, optical storage, and the like.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (14)

1. a kind of security protection method of soft SIM card, is characterized in that, described method comprises: After receiving the request for accessing the soft SIM card-related information stored in the eMMC playback protection memory block RPMB area, the soft SIM card verifies the legitimacy of the request; After the verification is passed, the soft SIM card allows the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area; Wherein, the verifying the legitimacy of the request includes: The soft SIM card utilizes the secure hash algorithm SHA to calculate the message authentication code MAC value according to the counter value and the key value of the eMMC where it is located; The soft SIM card compares the calculated MAC value with the MAC value carried in the request; The soft SIM card determines the validity of the request according to the comparison result. 2. The method according to claim 1, wherein, before receiving the request, the method further comprises: When the terminal accesses the network, the soft SIM card sends the hardware identification of the terminal and its own identification to the network side to verify the legitimacy of the terminal; After the soft SIM card receives the legal instruction of the terminal on the network side, the terminal enables the terminal to perform network communication through the soft SIM card. 3. The method according to claim 1, wherein before verifying the validity of the request, the method further comprises: The soft SIM card verifies the legality of the request when it is determined that the terminal is legal according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card. 4. The method according to claim 3, wherein the determining that the terminal is legitimate is: The soft SIM card compares the terminal identifier corresponding to the binding relationship with the terminal identifier corresponding to the request, and when the two are the same, it is determined that the terminal is legitimate. 5. a kind of security protection method of soft SIM card, is characterized in that, described method comprises: When accessing the network, the terminal sends its own hardware identifier and the corresponding soft SIM card identifier to the network side; The network side matches the received terminal hardware identifier and the corresponding soft SIM card identifier with the terminal hardware identifier stored by itself and the corresponding soft SIM card identifier, and when the matching is determined, the terminal is allowed to use the corresponding soft SIM card for Network communication, so that the terminal sends a request for accessing the soft SIM card-related information stored in the eMMC playback protection memory block RPMB area to the soft SIM card; the request is used for the soft SIM card to verify its legitimacy, and the verification passes Then, allow the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area; Wherein, the verifying the legitimacy of the request includes: The soft SIM card utilizes the secure hash algorithm SHA to calculate the message authentication code MAC value according to the counter value and the key value of the eMMC where it is located; The soft SIM card compares the calculated MAC value with the MAC value carried in the request; The soft SIM card determines the validity of the request according to the comparison result. 6. method according to claim 5, is characterized in that, described by the terminal hardware identification of receiving and the corresponding soft SIM card identification and the terminal hardware identification of self-storage and the corresponding soft SIM card identification are matched, including: The base station sends the received terminal hardware identifier and the corresponding soft SIM card identifier to the mobility management entity MME; The MME sends the received terminal hardware identifier and the corresponding soft SIM card identifier to the home subscriber server HSS; The HSS sends the received terminal hardware identification and the corresponding soft SIM card identification to the verification server; The verification server matches the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification. 7. The method according to claim 6, wherein, when the matching is determined, allowing the terminal to perform network communication through a corresponding soft SIM card, comprising: When the verification server determines that the received terminal hardware identifier and the corresponding soft SIM card identifier match the terminal hardware identifier stored by itself and the corresponding soft SIM card identifier, it reports to the HSS that the matching is successful; The HSS feeds back the matching success to the MME; the MME feeds back the matching success to the base station; After receiving the successful matching feedback from the MME, the base station allows the terminal to perform network communication through the corresponding soft SIM card. 8. A security protection device for a soft SIM card, wherein the device comprises: a first verification unit and an access unit; wherein, The first verification unit is used to verify the legitimacy of the request after receiving a request for accessing the relevant information of the soft SIM card stored in the eMMC RPMB area; The access unit is used to allow the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area after the verification is passed; Wherein, the first verification unit is specifically used for: calculating the MAC value by using SHA according to the Counter value and the key value of the eMMC where it is located; comparing the calculated MAC value with the MAC value carried in the request; and according to The result of the comparison determines the legitimacy of the request. 9 . The device according to claim 8 , wherein the device further comprises: a second verification unit, configured to, when the terminal accesses the network, verify the hardware identifier of the terminal and the information of the soft SIM card. 10 . The identification is sent to the network side to verify the legitimacy of the terminal; and after receiving the legal instruction of the terminal from the network side, the terminal is made to perform network communication through the soft SIM card. 10. The device according to claim 8, characterized in that, the device further comprises: a third verification unit, configured to determine according to the stored binding relationship between the terminal where the soft SIM card is located and the soft SIM card When the terminal is legal, the first verification unit is triggered to verify the legality of the request. 11. A terminal, characterized in that the terminal comprises the security protection device for a soft SIM card according to any one of claims 8 to 10. 12. A terminal, characterized in that the terminal comprises: a storage unit and a sending unit; wherein, The storage unit is used to store the hardware identification of the terminal and the corresponding soft SIM card identification; The sending unit is used for sending the stored hardware identification of the terminal and the corresponding soft SIM card identification to the network side when the terminal accesses the network; the hardware identification of the terminal and the corresponding soft SIM card identification are used for In order to verify the legitimacy of the terminal, when it is determined that the terminal is legal, the terminal is allowed to perform network communication through the corresponding soft SIM card, so that the terminal sends access to the soft SIM card and is stored in the eMMC playback protection memory. The request of the soft SIM card-related information in the block RPMB area; the request is used for the soft SIM card to verify its legitimacy, and after the verification is passed, the terminal corresponding to the request is allowed to access the relevant information of the soft SIM card in the RPMB area; Wherein, the verifying the legitimacy of the request includes: The soft SIM card utilizes the secure hash algorithm SHA to calculate the message authentication code MAC value according to the counter value and the key value of the eMMC where it is located; The soft SIM card compares the calculated MAC value with the MAC value carried in the request; The soft SIM card determines the validity of the request according to the comparison result. 13. A security protection system for a soft SIM card, wherein the system comprises: a terminal and a network side device; wherein, The terminal, when used to access the network, sends its own hardware identification and the corresponding soft SIM card identification to the network side device; The network side device is used to match the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification, and when the matching is determined, the terminal is allowed to pass the corresponding software SIM card identification. The soft SIM card performs network communication, so that the terminal sends a request for accessing the soft SIM card-related information stored in the eMMC playback protection memory block RPMB area to the soft SIM card; the request is used for the soft SIM card to verify its legality property, after the verification is passed, allow the terminal corresponding to the request to access the relevant information of the soft SIM card in the RPMB area; Wherein, the verification of the legitimacy of the request includes: The soft SIM card utilizes the secure hash algorithm SHA to calculate the message authentication code MAC value according to the counter value and the key value of the eMMC where it is located; The soft SIM card compares the calculated MAC value with the MAC value carried in the request; The soft SIM card determines the validity of the request according to the comparison result. 14. The system according to claim 13, wherein the network side equipment comprises: a base station, an MME, an HSS, and a verification server; wherein, The base station is configured to send the received terminal hardware identification and the corresponding soft SIM card identification to the MME; and after receiving the successful matching feedback from the MME, allow the terminal to perform a corresponding soft SIM card for the terminal. Telecommunication; The MME is configured to send the received terminal hardware identifier and the corresponding soft SIM card identifier to the HSS; and after receiving the successful matching feedback from the HSS, feedback the successful matching to the base station; The HSS is used to send the received terminal hardware identification and the corresponding soft SIM card identification to the verification server; and after receiving the successful matching feedback from the verification server, feedback the matching success to the MME; The verification server is used to match the received terminal hardware identification and the corresponding soft SIM card identification with the terminal hardware identification stored by itself and the corresponding soft SIM card identification; and when matching, feedback the matching success to the HSS .