WO2019134493A1

WO2019134493A1 - Subscriber identity module data writing method, device, platform, and storage medium

Info

Publication number: WO2019134493A1
Application number: PCT/CN2018/121307
Authority: WO
Inventors: 乐祖晖
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2018-01-08
Filing date: 2018-12-14
Publication date: 2019-07-11
Also published as: CN110022552A

Abstract

Disclosed in embodiments of the present application are a subscriber identity module writing method, electronic device, a card writing platform, and a storage medium. The method is applied in the card writing platform, comprising: receiving a card writing request sent by a mobile device, wherein the card writing request at least carries a first card identifier of a first subscriber identity module in the mobile device; obtaining, according to the first card identifier, subscriber identity information bound to the first subscriber identity module; sending subscriber identity module data to a second subscriber identity module in the mobile device; and establishing a binding relationship between the second subscriber identity module and the subscriber identity information according to the subscriber identity module data.

Description

User identification module data writing method, device, platform and storage medium

Cross-reference to related applications

The present application is filed on the basis of the Chinese Patent Application No. PCT Application No. 2011.

Technical field

The present application relates to the field of mobile communications, but is not limited to the field of mobile communications, and in particular, to a subscriber identity module (SIM) data writing method, a mobile device, a card writing platform, and a storage medium.

Background technique

User identification data can only be used for communication of mobile devices by writing to the user identification module. In the prior art, there are various ways to write user identification data to the user identification module. For example, the user identification module pre-writes all necessary user identification data before entering the market, and the user obtains direct use. However, this limits the problem of the user selecting a Mobile Network Operator (MNO) to which the subscriber identity module belongs. For example, only part of the user identification data is written to the user identification module, and then the card is written by the user to the business hall or by interacting with the information on the network side. However, in this case, the operator must deploy a dedicated channel dedicated to the user identification module, such as a BIP channel, or a pre-set card certificate to the user identification module, for example, CI. certificate.

Either way, users may need to manually enter their user identity information, and the user identity module needs to be bound to the user, which is cumbersome.

Summary of the invention

The embodiment of the present application is intended to provide a user identity module writing method, an electronic device, a card writing platform, and a storage medium.

The technical solution of the present application is implemented as follows:

The first aspect of the embodiment of the present application provides a user identity identification module data writing method, where the application is applied to a card writing platform, including:

Receiving a write card request sent by the mobile device, where the write card request carries at least a first card identifier of the first user identity module in the mobile device;

Acquiring user identity information bound to the first user identity module according to the first card identifier;

Transmitting user identity module data to a second user identity module in the mobile device;

And establishing, according to the user identity module data, a binding relationship between the second user identity module and the user identity information.

In a second aspect, the embodiment of the present application provides a method for writing a data of a user identity module, which is applied to a mobile device, and includes:

Reading at least the first card identifier from the first user identity module;

Sending a write card request carrying at least the first card identifier to the card writing platform;

Receiving user identity module data sent by the card writing platform based on the first card identifier;

The user identification module data is written into the second user identity module.

In a third aspect, an embodiment of the present application provides a card writing platform, including:

The first receiving unit is configured to receive a write card request sent by the mobile device, where the write card request carries at least the first card identifier of the first user identity module in the mobile device;

An acquiring unit, configured to acquire, according to the first card identifier, user identity information that is bound to the first user identity identification module;

a first sending unit, configured to send user identity module data to a second user identity module in the mobile device;

The establishing unit is configured to establish, according to the user identity module data, a binding relationship between the second user identity module and the user identity information.

In a fourth aspect, an embodiment of the present application provides an electronic device, where the electronic device is a mobile device, where

The reading unit is configured to read the first card identifier from at least the first user identity module;

a second sending unit, configured to send, to the card writing platform, a write card request that carries at least the first card identifier;

a second receiving unit, configured to receive user identification module data acquired by the writing card application based on the writing card request;

And a writing unit configured to write the user identity module data into the second user identity module.

In a fifth aspect, an embodiment of the present application provides an electronic device, including: a transceiver, a memory, a processor, and a computer program stored on the memory and executed by the processor;

The processor is coupled to the transceiver and the memory, respectively, for implementing the method provided by any one of the foregoing first or second aspects by executing the computer program.

In a sixth aspect, the embodiment of the present application is a computer storage medium, where the computer storage medium stores a computer program; after the computer program is executed, the method provided by any one of the foregoing first aspect or the second aspect can be implemented.

The SIM data writing method, the mobile device, the card writing platform and the storage medium provided by the embodiment of the present application acquire the first user that has been bound to the user identity information before writing the user identity module to the second user identity module. The information such as the card identifier of the identity module, so that the user identity information of the second user identity module can be obtained according to the user identity information bound by the first user identity module.

If the first user identity module has established a binding relationship with the user, the user identity information corresponding to the first user identity module in the database has been verified by legality, for example, at least once with the public security system for checking information. The validity of the user is ensured, so that the user identity information is authenticated user identity information, so that when the user identity information of the second user identity module is bound, the user identity information can no longer be verified. Therefore, in the process of binding the user identity information of the second user identity module, not only the user does not need to manually input or the mobile device submits the user identity information, but also ensures the legality of the user identity information, and saves unnecessary users. The verification of the identity information greatly simplifies the steps of obtaining and authenticating the user identity information in the process of data transmission by the second user identity module, and has the characteristics of being simple and convenient.

DRAWINGS

FIG. 1 is a schematic structural diagram of a network system according to an embodiment of the present application;

2 is a schematic structural diagram of a certificate system according to an embodiment of the present application;

FIG. 3 is a schematic flowchart of a method for writing a first user identity module according to an embodiment of the present disclosure;

4 is a schematic flowchart of a method for writing a second user identity module according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a write card platform according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a mobile device according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure;

FIG. 8 is a schematic flowchart of a method for interacting information in communication according to an embodiment of the present application;

FIG. 9 is a schematic flowchart of still another method for writing a user identity module according to an embodiment of the present application;

FIG. 10 is a schematic flowchart of still another method for writing a user identity module according to an embodiment of the present application.

Detailed ways

As shown in FIG. 1 , the present example provides a network system, including: a card writing platform located on the network side and a mobile terminal such as a mobile phone. A write card application is provided in the mobile terminal, and the write card application can be a mobile network operator application, and can be used to provide various tasks for network operation. The write card application may be a universal application available to different mobile network operators, or may be a dedicated application of a different mobile network operator. An access control execution module is disposed on the mobile terminal, and the access control execution module can be a component in an Application Programming Interface (API). The access control execution module can access the user identification module. A plurality of user identity (SIM) cards, such as the user identity module 1 and the user identity module 2, may be provided within a mobile terminal. The user identity module 1 and the user identity module 2 herein may each be an independent user identity module that can be separated from the mobile terminal, or a virtual user identity (eSIM) card integrated on the chip in the mobile device.

Figure 2 shows a certificate system of a user identity module. A root certificate is set in the system. The node holding the root certificate can issue a carrier certificate to each mobile network operator, and the operator can identify the module to the user. Send the user identification module certificate, the platform certificate issued to the card writing platform, and issue the application certificate to the application that can access the user identification module. Certificate issuance here can be understood as certificate assignment or configuration. In FIG. 2, the mobile network operation includes MNO1, MNO2, and the like. Therefore, the holders of the root certificate respectively issued the MNO1 certificate and the MNO2 certificate to the MNO1 and MNO2, and the card vendor issuing the user identification module issued the card vendor certificate. The user identity module certificate issued by the MNO is usually carried with its own carrier identity and is not compatible with other operators. The user identity module certificate written by the general card vendor in the user identity module is a universal certificate and is compatible with different operators. For example, the subscriber identity module certificate can be a sequence of M bits including: a first part and a second part; the first part is a universal certificate sequence and the second part is a sequence representing an operator. If the second part of the user identity module certificate is blank or is the default value, the user identity module certificate may be regarded as a universal user identity module certificate, and has not been written by the operator to the operator identifier. Of course, this is only an example, and the specific implementation is not limited to any of the above.

Based on the network system and the certificate system shown in FIG. 1 and FIG. 2, when two user identity modules are installed or configured in one mobile device, the user identity module 1 has downloaded the profile from the operation platform of the MNO ( Profile file, that is, the SIM card 1 has already bound the user identity module and the user identity information of the user in the subscription database of the MNO, and when the profile file is written to the user identity module 2, the MNO can pass the identity of the user. The information of the identification module 1 interacts to obtain the user identity information of the user, so that the binding relationship can be established with the user identity module 2 (SIM card 2) based on the acquired user identity information, and the profile file is sent to the user identity module 2. The profile file may include: an integrated circuit card identity (ICCID) and an International Mobile Subscriber Identity (IMSI). The ICCID may also be referred to as a user identity module identifier, which may be used by the MNO to identify the user identity module. The IMSI includes a network identifier, which may be a number of the mobile network, and may be used to identify a mobile network to which the user identity module belongs, that is, a home MNO. In this case, the binding of the user identity information of another user identity module and the issuance of the profile file are completed by the binding of the user identity information by the user identity module.

The technical solutions of the present application are further elaborated below in conjunction with the drawings and specific embodiments.

As shown in FIG. 3, this embodiment provides a method for writing a user identity module, which is applied to a card writing platform, and includes:

Step S110: Receive a write card request sent by the mobile device, where the write card request carries at least the first card identifier of the first user identity module in the mobile device;

Step S120: Acquire user identity information bound to the first user identity recognition module according to the first card identifier.

Step S130: Send user identity module data to the second user identity module in the mobile device;

Step S140: Establish a binding relationship between the second user identity module and the user identity information according to the user identity module data.

The user identification module can write data of various user identification modules. For example, the user identification module can be written to a Subscriber Identity Module (SIM), a global user identification module (Universal). Subscriber Identity Module (USIM), nano-user identity module, SIM card. The SIM card is smaller in area than the micro-user identity module being used, which is an upgraded version of the SIM. The nano-user identity module is also referred to as a fourth form factor integrated circuit board and is a new generation SIM. The SIM card, also known as the Miro user identity module, is another upgrade of the SIM, which is smaller than the ordinary user identity module.

The method for writing the user identity module provided by this embodiment may be a method applied to the card writing platform, and the card writing platform may be a card writing platform of various NMOs.

The user identity module may include at least an ICCID, an IMSI, etc., and may be the aforementioned profile file. Generally, in addition to the ICCID and the IMSI, the profile file carries data such as system files that need to be written to the user identity module.

In this embodiment, the mobile device sends a write request to the write card platform based on the first user identity module, that is, requests for obtaining the user identity module. In this embodiment, the card request carries at least a card identifier of the first user identity module that has established a binding relationship with the user in the mobile terminal, that is, the first card identifier.

In this case, after receiving the write request, the write card platform may obtain the identity information of the user according to the first card identifier of the first user identity module, that is, the user identity information, for example, the user's ID card. The number, the passport number or the user name and the user identification module operation password set by the user or the user account assigned to the user by the card writing platform. In this case, it is equivalent to completing the identity authentication of the user, and the user does not need to manually input or the mobile device sends the user identity information to the card writing platform. If the user identity information is obtained, the user who is bound by the second user identity module is authenticated, and the identity authentication of the user bound to the second user identity module is implemented, and the second user identity module can be sent to the second user identity module. The user identification module is sent, so the user identification data is sent to the second user identity module. And establishing a binding relationship between the second user identity module and the user identity information based on the user identity module that sends the second user identity module and the read user identity information. Obviously, in the embodiment, using a first user identity module that has been bound to the user identity information, the second user identity recognition can be completed while the user identity module of the second user identity module is delivered. The simple binding of the module's user identity information is easy to implement.

In this embodiment, the first user identity module and the second user identity module may be separate user identity modules that can be separated from the mobile device, or may be integrated on the chip of the mobile device. Integrated user identification module, such as a typical virtual user identity (eSIM) card.

It should be noted that, in the specific implementation, the step S130 and the step S140 do not have a certain sequence relationship, and the step S130 may be performed before the step S140 is performed, or the step S140 may be performed before the step S130. In some embodiments, in order to ensure the correctness of the establishment of the binding relationship, step S130 may be performed first, and then the step is performed after receiving the success notification of successful writing by the user identity module returned by the communication device or the second user identity module. S140. This can avoid the problem that the invalidity binding relationship is established caused by the unsuccessful transmission of the user identity module or the unsuccessful writing to the second user identity module after being transmitted to the communication device.

In some embodiments, the first user identification module certificate of the first user identity module is carried in the write card request;

The method further includes: verifying the legality of the first user identity module according to the first user identity module certificate; the step S120 may include: if the first user identity module passes the law And verifying, according to the first card identifier, user identity information bound to the first user identity module.

In this embodiment, in order to ensure the reliability of the identity information binding of the second user identity module and the legitimacy of the first user identity module, the card writing platform also needs to verify the legitimacy of the first user identity module. The user identification module certificate of the first user identity module is carried in the card requesting request, and the user identity module certificate may be issued by a card writing platform or other platform, and the card writing platform may pass through a local database. Matching the user identity module certificate, or interacting with the information of the device issuing the user identity module certificate, verifying the legitimacy of the first user identity module, thereby ensuring that the first user identity module is a card vendor The user identification module of the method, rather than a pseudo-user identification module forged by the mobile device through information; thereby ensuring the reliability and security delivered by the user identity module.

In some embodiments, the method further includes: transmitting a platform certificate of the card writing platform to the first user identity module;

Receiving verification information returned by the first user identity module to the verification result of the platform certificate;

The step S130 may include: after receiving the verification information that indicates that the platform certificate is verified, sending the user identity module to the second user identity module.

Before the user identity module is written to the second user identity module, the mobile terminal also needs to verify the legality of the card writing platform. Therefore, in the embodiment, the card writing platform also sends its own platform certificate to the mobile terminal certificate. The first user identification module, the first user identification module verifies the platform certificate, and if verified, the writing card platform is considered to be legal, and the user identification module received from the writing card platform can be safely written into the second user identification. Module.

In some embodiments. The method further includes:

Receiving a second user identity module certificate of the second user identity module;

Verifying the legality of the second user identity module according to the user identity module certificate;

The step S140 may include:

If the second user identity module has legality, the user identity module is sent to the second user identity module.

The operation of verifying the legitimacy of the second user identity module is further included in the embodiment of the present application, and the second user identity recognition module is prevented from being falsified, which causes the user identity module to leak.

The user identification module certificate is pre-configured in the second user identity module certificate, so the card writing platform also receives the second user identity module certificate, and the legality verification method of the second user identity module certificate can be The authentication method of a user identity module certificate is the same, and is not repeated here. Only after the validity of the second user identity module certificate is verified, the user identity module is sent to the second user identity module for The mobile terminal writes to the second user identity module.

In some embodiments, the method further includes:

Transmitting a platform certificate of the card writing platform to the second user identity module;

Receiving verification information returned by the second user identity module to the verification result of the platform certificate;

The step S140 may specifically include:

After receiving the verification information characterizing the verification of the platform certificate and the second user identity module has legality, the user identity module is sent to the second user identity module.

Before the second user identity module writes the user identity module sent by the write platform to itself, it also verifies the legality of the write card platform again, thereby ensuring that the write user identity module is authentic and reliable, and avoiding The problem that the second user identity module cannot write after the dirty data or illegal user identification module is written to the user identity module.

In some embodiments, the first user identity module and the second user identity module are both installed in the same mobile device. After the first user identity module has verified the legality of the card writing platform, The second user identity module may omit this step, but to ensure high reliability and security, the second user identity module may repeatedly verify the validity of the card writing platform.

In the embodiment of the present application, the legality verification of the writing card platform may include the mobile terminal performing information interaction with the network device received by the mobile terminal, for example, performing information interaction with the holding node of the root certificate, and verifying the platform certificate. Legitimacy. In some embodiments, verification of the platform certificate of the write card platform may also be implemented by verification of a random number. For example, the user identity module generates a random number. In order to distinguish the random number, it may be referred to as a first random number, and is encrypted by the card private key and then sent to the card writing platform. After the card writing platform decrypts the random number based on the card public key, it generates another random number, which may be referred to as a second random number. The card writing platform encrypts its own platform certificate, the first random number and the second random number by using the platform private key, and sends the user identification module. After receiving the user identification module, the user identification module decrypts the platform public key, and if the decoding is performed, the two are extracted. A random number, if one of the two random numbers completely matches the first random number generated by the user identity module itself, the platform certificate of the card writing platform is considered to be verified by the legality.

Of course, the above is only an alternative method for verifying the legality of the two platform certificates. The specific implementation is not limited to any of the above.

The second user identity module certificate is a universal card certificate that is not bound to the mobile network operation. In the embodiment of the present application, the second user identity module certificate is a universal card certificate, which is a card certificate that can be recognized by various MNOs. The universal card certificate can also be transformed into its own user identity module certificate by the corresponding MNO platform through information rewriting; in this case, the modified user identity module certificate is a user identity that cannot be recognized by other MNO platforms. Module certificate. In this case, a user identification module holding a universal card certificate can be used by any MNO to issue a user identification module, breaking the limitation that only a specific MNO can be written into the user identification module, so that the user can The user chooses the MNO to write the user identification module to the second user identity module.

As shown in FIG. 4, this embodiment provides a method for writing a user identity module, which is applied to a mobile device, and includes:

Step S210: Read at least the first card identifier from the first user identity module;

Step S220: Send a write card request carrying at least the first card identifier to the card writing platform;

Step S230: Receive a user identity identification module that is sent by the card writing platform based on the first card identifier.

Step S240: Write the user identity module data into the second user identity module.

This embodiment provides a method for writing a user identity module applied to a mobile device. In this embodiment, a write card application may be installed in the mobile device, and the write card application may be a universal write card application, and the universal write card application may be connected to a plurality of MNO operation platforms.

In some embodiments, the universal write card application writes its own application identifier into the operation platform of different MNOs, and obtains the approval of the operation platforms of different MNOs, so that information interaction can be performed with different MNO operation platforms.

In other embodiments, the universal write card application has a dedicated write card platform disposed on the network side, and the write card platform can perform data interaction with the operation platform of different MNOs according to the foregoing write card rules, thereby assisting the universal write card. The application identifies a user identity module that writes different MNOs to the second user identity module.

In some embodiments, the write card application may be a write card application dedicated to a certain MNO issued by different MNOs, and may perform data interaction with a corresponding MNO write card platform to identify the second user. The user identification module is written in the module.

In this embodiment, the write card application has realized the communication address of the corresponding write card platform, and can directly perform data interaction with the write card platform based on the communication address of the write card platform. The communication address may be a network protocol (IP) address of the write card platform or a domain name, a tunnel identifier, or the like that can be located to the address of the write card platform. The tunnel identifier is identifier information of a tunnel for data transmission between the card writing platform and the write card application.

In this embodiment, the card application may read the card identifier of the first user identity module from the first user identity module, and the card identifier may be referred to as a first card identifier, which may be the foregoing user. Information such as the ICCID of the identity module.

In this embodiment, after the first user identity module identifier is read, it is carried in the write card request. The write request is a request for a user identity module write to the second user identity module. For example, when the application interface of the card writing application detects the writing instruction input by the user, if the current communication device installs the first user identification module, the writing card instruction indicates that the user identification needs to be written to the second user identity module. Module, the write card application will automatically read the first card identifier of the first user identity module. The write card request further includes a write card request field, the field informing the write card platform to request to acquire the user identity module.

After receiving the write request, the card writing platform may obtain the user identity information of the user according to the first card identifier of the first user identity module; and further determine that the second user identity module sends the user identity module, and is based on The user identity module and the user identity information are sent, and the binding relationship between the user identity information and the second user identity module is established.

In some embodiments, an access control execution module is further disposed in the mobile device; the access control execution module may be one of constituent components of the API, and is used to control various applications to access the user identification module to ensure user identification. The security of the data on the module and the application security of the user identity module. The access control execution module verifies the legitimacy of the write card application. The verification of the legality of the write card application may include: verifying whether the write card application has access rights to access the user identity module. For example, the write card application submits its own application information to the access execution control module, and the access control execution module applies the write card to the submitted application information to match the application information that allows access to the user identification module, and if the matching is successful, The write card application is considered to have access to a user identity module that is a legitimate application for accessing the user identity module. In some embodiments, after receiving the application information of the write card application, the access control module sends the application information to the user identity recognition module, and the user identity recognition module accesses the user identity with the application on the allowed device stored in the internal device. The application information list of the identification module is matched, and then the matching result is notified to the access control execution module. After receiving the matching result of the user identity module, the access control execution module deny the card application through which the user identity module is accessed or allows the card application to access the user identity module.

The application information herein may include: an application identifier (AID) and/or an application certificate. The application certificate here can issue a certificate to the certificate system that determines that the application is a legitimate application that verifies the various authentication processes. The certificate may include information such as a certificate serial number.

The step S210 may include:

After the write card application passes the validity verification of the access control execution module, the access control execution module reads the first card identifier from at least the first user identity recognition module.

In the embodiment, by the setting of the access control execution module, the data interaction between the write card application and the user identity recognition module needs to be accessed by the access control execution module, thereby ensuring the correctness of the user identity recognition module.

In some embodiments, the user identity module sent by the card-writing platform to the second user identity module may carry application information, such as the application certificate and/or the application identifier, such that subsequent user identification is facilitated. The module, with the assistance of the access control execution module, determines whether the application to which the request is accessed has the right to access the user identity module to ensure data security on the user identity module and security of use of the user identity module.

As shown in FIG. 5, the embodiment of the present application provides a card writing platform, including:

The first receiving unit 110 is configured to receive a write card request sent by the mobile device, where the write card request carries at least the first card identifier of the first user identity module in the mobile device;

The obtaining unit 120 is configured to acquire user identity information bound to the first user identity module according to the first card identifier;

The first sending unit 130 is configured to send a user identity module to the second user identity module in the mobile device;

The establishing unit 140 is configured to establish, according to the user identity identification module, a binding relationship between the second user identity module and the user identity information.

The write card platform can include one or more write card servers. In summary, the first receiving unit 110 and the first sending unit 130 in the card writing platform may correspond to a transceiver, and can be used by the mobile device to perform various information interactions.

The obtaining unit 120 may correspond to a processor, and may query the user identity information on a local storage medium. In some cases, the obtaining unit 120 may also correspond to a communication interface, and may query user identity information bound to the first card identifier from other devices.

The establishing unit 140 may include: a processor, where the user identity module sent to the second user identity module and the user identity may be stored in a local database connected to the card writing platform or in a dedicated database connected to the card writing platform. Information, thereby completing the corresponding storage of the second user identity module and the user identity information of the user, that is, the establishment of the binding relationship.

In some embodiments, the write card request carries a first user identity module certificate of the first user identity module;

The card writing platform further includes:

The first verification unit may be configured to be corresponding to the processor, and configured to verify the validity of the first user identity module according to the first user identity module certificate;

The obtaining unit 120 may be configured to acquire user identity information bound to the first user identity recognition module according to the first card identifier, if the first user identity module performs the validity verification.

In some embodiments, the first sending unit 130 is further configured to send the platform certificate of the card writing platform to the first user identity module; the first receiving unit 110 is further configured to receive the first And verifying, by the user identity module, the verification information returned by the verification result of the platform certificate; and after receiving the verification information indicating that the platform certificate is verified, sending the user identity module to the second user identity module.

In some embodiments, the first receiving unit 110 is further configured to receive a second user identity module certificate of the second user identity module; the first verification unit is further configured to determine, according to the user identity Identifying a module certificate, verifying the validity of the second user identity module; the first sending unit 130 is further configured to: if the second user identity module has legality, to the second user identity module Send the user identification module.

In some embodiments, the first sending unit 130 is further configured to send the platform certificate of the card writing platform to the second user identity module; the first receiving unit 110 is further configured to receive the first The verification information returned by the second user identity module to the verification result of the platform certificate; after receiving the verification information indicating the verification of the platform certificate verification, and the second user identity recognition module has legality, to the second The user identity module sends the user identity module.

In some embodiments, the second user identity module certificate is a universal card certificate that is not bound to the mobile network operation.

As shown in FIG. 6, the embodiment provides a mobile device, including:

The reading unit 210 is configured to read at least the first card identifier from the first user identity module;

The second sending unit 220 is configured to send, to the card writing platform, a write card request that carries at least the first card identifier;

The second receiving unit 230 is configured to receive a user identity recognition module that is acquired by the write card application based on the write card request;

The writing unit 240 is configured to write the user identity module into the second user identity module.

The reading unit 210 may correspond to a processor or a processing circuit or a processing chip capable of executing a code or a program, and may read a card identifier of the first user identity module from the first user identity module, ie, the first One card logo.

The second sending unit 220 and the second receiving unit 230 may correspond to a communication interface of the communication device, and may be used for information interaction with the card writing platform, thereby assisting the card writing platform to acquire user identity information, and identifying the user identity. The module is written to the second user identification module.

In some embodiments, an access control execution module is further disposed in the mobile device;

The reading unit 210 may be configured to read, by the access control execution module, at least the first user identification module, after the write card application is verified by the validity of the access control execution module. The first card identifier.

As shown in FIG. 7 , an embodiment of the present application provides an electronic device, including: a transceiver 310, a memory 320, a processor 330, and a computer program stored on the memory 310 and executed by the processor 330;

The communication device can include a transceiver 310, a memory 320, a processor 330, and a computer program stored on the memory 320 and executed by the processor 330;

The processor 330 is connected to the transceiver 310 and the memory 320, respectively, for example, to the transceiver and the memory 320 via the integrated circuit bus IIC.

The processor 330 may be configured to execute the verification information processing method provided by the foregoing one or more technical solutions by executing the computer program, for example, may perform one or more technologies applied to a card writing platform and/or a mobile device. The user identification module data writing method provided by the solution.

The transceiver 310 can be any type of interface that can be used for communication, such as a cable interface or a fiber optic cable interface. For example, the transceiver 310 can provide an interface for information interaction between the processor and other devices. The communication interface can be divided into a serial interface and a parallel interface. The commonly used communication interfaces are standard communication interfaces RS-232, RS-485, and RS. -422 and so on.

The memory 320 may be a memory 320 including a storage medium in the communication device, and may be a random access memory 320, a read only memory 320, a storage hard disk, or the like. For example, the memory can be either volatile memory or non-volatile memory, and can include both volatile and nonvolatile memory. The non-volatile memory may be a read only memory (ROM), a programmable read-only memory (PROM), or an erasable programmable read-only memory (Erasable Programmable Read-Only Memory). , EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Ferromagnetic Random Access Memory (FRAM), Flash Memory, Magnetic Surface Memory , CD, or Compact Disc Read-Only Memory (CD-ROM); the magnetic surface memory can be a disk storage or a tape storage. The volatile memory can be a Random Access Memory (RAM) that acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access. Memory (Dynamic Random Access Memory) (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), enhancement Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Synchronous Dynamic Random Access Memory (SLDRAM), Direct Rambus Random Access Memory (DRRAM) ). Memory 802 described in this application embodiment is intended to comprise, without being limited to, these and any other suitable types of memory.

The processor 330 can be various types of processors, a central processing unit, a microprocessor, an application processor, a programmable array, or an application specific integrated circuit. For example, the processor 403 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software. The above processor may be a general purpose processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or the like. The processor may implement or perform the methods, steps, and logic blocks disclosed in the embodiments of the present application. A general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiment of the present application may be directly implemented as a hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, the storage medium being located in the memory, the processor reading the information in the memory, and completing the steps of the foregoing methods in combination with the hardware thereof.

The electronic device may be the aforementioned mobile device, such as a communication terminal such as a mobile phone, a tablet computer, a wearable device, an in-vehicle device, or an Internet of Things terminal, or may be a write card server of the write card platform.

The embodiment of the present application provides a computer storage medium, where the computer storage medium stores a computer program; after the computer program is executed by the processor, one or more technologies applied to the card writing platform and/or the mobile device may be executed. The user identification module data writing method provided by the solution.

The computer storage medium may be: a mobile storage device, a read-only memory (ROM, Read-Only Mem or y), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. medium. Optionally, the computer storage medium is preferably a non-transitory storage medium, or a non-volatile storage medium.

Several specific examples are provided below in connection with any of the above embodiments:

Example 1:

In this example, the certificate system is shown in Figure 2. The holder node of the root certificate issues an MNO certificate to different operators, and the operator then issues a SIM card certificate, a platform certificate, and an application certificate (for application signature).

Secure communication between the card-writing platform and the carrier application through the Secure Transport Layer Protocol (TLS);

The hash value of the operator application certificate is preset in the SIM card 1. The access control execution module loads the hash value from the SIM card 1 to verify whether the hash value of the operator application certificate is consistent with the hash value read in the card. If the two hash values are equal, the carrier application has access to the SIM card 1, otherwise the access is denied;

The SIM card 1 and the card writing platform realize mutual authentication through the SIM card, ensuring the legality of the writing card platform and the SIM card 1; thereby realizing the acquisition of the user identity information, and the acquired identity information does not need to be verified again to the third party system. , thereby reducing unnecessary verification. The SIM card 2 presets the root certificate and the SIM card certificate, and implements mutual authentication with the card writing platform of the operator 1 to negotiate the key to complete the profile download.

Example 2:

As shown in FIG. 8, the example provides an information interaction method applied to a mobile device, which may include:

Step 1: The access control execution module acquires an access control rule of the SIM card 1;

Step 2: The SIM card 1 returns an access control rule to the access control module, and the access control rule is used to control access control of the SIM card by various applications on the access control execution module.

Step 3: The MNO1 application (installed on the mobile device as one of the write card applications) acquires the SIM card 1 information. At this time, the access control execution module receives the access request of the MNO1 application.

Step 4: The access control execution module verifies the legality of the MNO1 application according to the access control rule. The verification of the legality is mainly to verify whether the MNO1 application is an application having the right to access the SIM card 1, that is, whether the MNO1 can be accessed. Legal application of SIM card 1.

Step 5: If the MNO1 application has legality, the access control execution module acquires the SIM card 1 information from the SIM card 1, where the SIM card 1 information may include: a card identifier of the SIM card 1, a SIM card certificate, and the like. Here, it is equivalent to transmitting a request for acquiring the SIM card 1 information to the SIM card 1;

Step 6: The SIM card 1 returns the SIM card 1 information to the access control execution module.

Step 7: The access control execution module returns the SIM card 1 information through the MNO1 application.

Specifically, in step 1, the access control execution module loads the access control rule (the hash value of the application certificate from the SIM card 1; the SIM card 1 returns the access control rule.

In step 3, the MNO1 application wishes to acquire the card information of the SIM card 1 (or send an acquisition request to the SIM card 1).

Step 4 may include: the access control execution module verifies whether the MNO1 application has permission to access the SIM card 1 (whether the MNO1 certificate hash value is consistent with that stored in the SIM card 1).

If the MNO1 application does not have access to the SIM card 1, the error message is returned, and the process ends. If the MNO1 application has access to the SIM card 1, the request for acquiring the SIM card 1 information (or command) is sent to the SIM card 1; the SIM card 1 returns the card information. The MNO1 application receives the card information.

The method provided in this example can be used for data interaction between the write card application and the first SIM card and the second SIM card, and implements access control of the SIM card by an application such as a write card application.

Example 3:

As shown in FIG. 9, this example provides a method for verifying the two-way legality between a card writing platform and a SIM card, which may include:

Step 11: The MNO1 application obtains the SIM card 1 information, including card information such as the SIM card certificate and the card identifier (Note: In order to enhance security, the user may be required to input a service password to verify that the user is a legitimate holder of the SIM card 1). For example, the MNO1 is applied to an input interface such as an input box of an application interface outputting a service password, and after detecting the service password input by the user, the information carried in the access request of the MNO1 application requesting access to the SIM card is convenient for access control of the access control execution module. .

Step 12: The SIM card 1 returns SIM card information such as a SIM card certificate, a card identifier, and a random number (RAND) 1;

Step 13: The MNO1 application submits the returned data of the SIM card information to the card writing platform;

Step 14: The card writing platform verifies the legality of the card certificate of the SIM card 1, and if the RAND2 is legally generated;

The card-writing platform returns the platform certificate, RAND1, RAND2, and signature 2 (using the platform private key to sign the above information);

Step 15: The MNO1 application sends the above information to the SIM card 1;

Step 16: The SIM card 1 verifies the validity of the platform certificate. If the signature of the platform public key is legally verified, if the RAND1 is verified to be consistent with the RAND1 generated by the previous card, if the above verification is passed, the signature 1 is generated. The key pair returns the RAND1, RAND2 information to sign);

Step 17: SIM card 1 returns signature 1;

Step 18: The MNO1 application returns a signature 1;

Step 19: The card writing platform verifies the signature 1. If the verification is made, the SIM card 1 is a legal SIM card issued by the operator 1. The method for verifying the signature 1 may include: extracting the random number by using the SIM card public key, and if the extracted random number includes the RAND2 generated by the card writing platform itself, the verification may be considered as passing.

Step 20: The user identity information bound to the SIM card can be used to bind to another SIM card, and it is determined that the user identity information bound to the SIM card is legally verified.

As shown in FIG. 9, after the validity verification of the SIM card 1 is completed, the SIM card data such as a profile file can be sent to the SIM card 2.

Example 4:

As shown in FIG. 10, this example provides a two-way legality verification between a card writing platform and a SIM card, which may include:

Step 21: The MNO1 application acquires card information such as a SIM card certificate, a card vendor certificate, an application certificate, and an MNO certificate of the SIM card 2.

Step 22: After receiving the obtained request, the SIM card 2 verifies the application certificate and generates RAND1; the application certificate is an application certificate applied by the MNO1, and if the verification is passed, the RAND1 is generated.

Step 23: The SIM card 2 returns a SIM card certificate, a card vendor certificate, a card identifier, RAND1, and card information.

Step 24: The MNO1 application submits the SIM card certificate, the card vendor certificate, the card identifier, the RAND1 and the card information to the card writing platform;

Step 25: The card writing platform verifies the legality of the SIM card certificate of the SIM card 2, and if the RAND2 is legally generated;

Step 26: The card writing platform returns the platform certificate, the MNO1 certificate, the RAND1, the RAND2, and the signature 2 (using the platform private key to sign the above information);

Step 27: The MNO1 application sends the above information to the SIM card 2;

Step 28: The SIM card 2 verifies the validity of the platform certificate. If the signature of the platform public key is legally verified, if the RAND1 is verified to be consistent with the RAND1 generated by the previous card, if the above verification is passed, the signature 1 is generated. The key pair returns the RAND1, RAND2 information to sign);

Step 29: SIM card 2 / eSIM returns signature 1;

Step 30: The MNO1 application returns a signature 1;

Step 31: The card writing platform verifies the signature 1. If the verification is performed, the SIM card 2 is a legal card, and the profile can be downloaded; the card writing platform negotiates the key with the SIM card 2 to complete the profile download.

The key negotiation here may be various key negotiation or the like for subsequent communication.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.

The units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing module, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage device includes the following steps: the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. A medium that can store program code.

The foregoing is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present application. It should be covered by the scope of protection of this application. Therefore, the scope of protection of the present application should be determined by the scope of the claims.

Claims

A user identification module data writing method is applied to a card writing platform, and includes:

Receiving a write card request sent by the mobile device, where the write card request carries at least a first card identifier of the first user identity module in the mobile device;

Acquiring user identity information bound to the first user identity module according to the first card identifier;

Transmitting user identity module data to a second user identity module in the mobile device;

And establishing, according to the user identity module data, a binding relationship between the second user identity module and the user identity information.
The method of claim 1 wherein

The write card request carries a first user identity module certificate of the first user identity module;

The method further includes:

Verifying the legality of the first user identity module according to the first user identity module certificate;

And obtaining, according to the first card identifier, user identity information that is bound to the first user identity identification module, including:

If the first user identity module performs the validity verification, the user identity information bound to the first user identity module is obtained according to the first card identifier.
The method of claim 2, wherein

The method further includes:

Transmitting a platform certificate of the card writing platform to the first user identity module;

Receiving verification information returned by the first user identity module to the verification result of the platform certificate;

Sending the user identity module data to the second user identity module in the mobile device, including:

After receiving the verification information characterizing the verification of the platform certificate, the user identity module data is sent to the second user identity module.
The method according to claim 1 or 2, wherein

The method further includes:

Receiving a second user identity module certificate of the second user identity module;

Verifying the legality of the second user identity module according to the user identity module certificate;

Sending the user identity module data to the second user identity module in the mobile device, including:

If the second user identity module has legality, the user identity module data is sent to the second user identity module.
The method of claim 4, wherein

The method further includes:

Transmitting a platform certificate of the card writing platform to the second user identity module;

Receiving verification information returned by the second user identity module to the verification result of the platform certificate;

If the second user identity module has legality, the user identity module data is sent to the second user identity module, including:

After receiving the verification information characterizing the verification of the platform certificate and the second user identity module has legality, the user identity module data is sent to the second user identity module.
The method of claim 5 wherein said second user identity module certificate is a universal card certificate that is not bound to a mobile network operation.
A user identity module data writing method is applied to a mobile device, including:

Reading at least the first card identifier from the first user identity module;

Sending a write card request carrying at least the first card identifier to the card writing platform;

Receiving user identity module data sent by the card writing platform based on the first card identifier;

The user identification module data is written into the second user identity module.
The method of claim 7, wherein the mobile device is further provided with an access control execution module;

The reading the first card identifier from the at least the first user identity module includes:

After the write card application passes the validity verification of the access control execution module, the access control execution module reads the first card identifier from at least the first user identity recognition module.
A card writing platform, including:

The first receiving unit is configured to receive a write card request sent by the mobile device, where the write card request carries at least the first card identifier of the first user identity module in the mobile device;

An acquiring unit, configured to acquire, according to the first card identifier, user identity information that is bound to the first user identity module;

a first sending unit, configured to send user identity module data to a second user identity module in the mobile device;

The establishing unit is configured to establish, according to the user identity module data, a binding relationship between the second user identity module and the user identity information.
An electronic device, the electronic device being a mobile device, comprising:

a reading unit configured to read at least the first card identifier from the first user identity module;

a second sending unit, configured to send, to the card writing platform, a write card request that carries at least the first card identifier;

a second receiving unit, configured to receive user identification module data acquired by the writing card application based on the writing card request;

And a writing unit configured to write the user identity module data into the second user identity module.
An electronic device comprising: a transceiver, a memory, a processor, and a computer program stored on the memory and executed by the processor;

The processor is coupled to the transceiver and the memory, respectively, for implementing the user identity module data writing method provided by any one of claims 1 to 6 or 7 to 8 by executing the computer program.
A computer storage medium storing a computer program; after the computer program is executed, the user identification module data writing method provided in any one of claims 1 to 6 or 7 to 8 can be implemented.