WO2014012468A1 - Procédé, appareil et système de configuration de données pour carte de circuit intégré universelle, programme informatique et support de stockage - Google Patents

Procédé, appareil et système de configuration de données pour carte de circuit intégré universelle, programme informatique et support de stockage Download PDF

Info

Publication number
WO2014012468A1
WO2014012468A1 PCT/CN2013/079364 CN2013079364W WO2014012468A1 WO 2014012468 A1 WO2014012468 A1 WO 2014012468A1 CN 2013079364 W CN2013079364 W CN 2013079364W WO 2014012468 A1 WO2014012468 A1 WO 2014012468A1
Authority
WO
WIPO (PCT)
Prior art keywords
uicc
service
identifier
carrier device
key
Prior art date
Application number
PCT/CN2013/079364
Other languages
English (en)
Chinese (zh)
Inventor
乐祖晖
罗红
Original Assignee
***通信集团公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***通信集团公司 filed Critical ***通信集团公司
Publication of WO2014012468A1 publication Critical patent/WO2014012468A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/35—Protecting application or service provisioning, e.g. securing SIM application provisioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Definitions

  • M2M machine-to-machine terminals
  • M2M generally refers to the communication of machine equipment with other devices or systems over a mobile communication network.
  • the smart card provided by the operator needs to be installed on the M2M terminal. Since the environment of the M2M terminal is different from that of the ordinary mobile phone terminal, it is necessary to use the M2M dedicated intelligence in the M2M terminal.
  • the M2M dedicated smart card generally refers to the upgraded smart card of the existing smart card based on the existing smart card to meet the needs of the M2M industry.
  • the M2M-dedicated smart card carries the code number resource provided by the operator, that is, the M2M terminal accesses the identity of the mobile communication network, and the M2M-dedicated smart card can also carry and handle different kinds of application scenarios and technologies provided by the operator.
  • the current M2M dedicated ffi smart cards are divided into the following two types: MP card and MS card.
  • MP card is the abbreviation of M2M Plug In card, which can be plugged-in SIM card. It can adapt to special environment and special card-based materials. It has high physical performance and can meet longer service life and harsher environment. Requirements.
  • the MS card is the abbreviation of M2M SMD (Surface Mount Device) card, which is a splicing SIM card, which fully has all the functions of the traditional SIM card, and adopts SMD patch.
  • M2M SMD Surface Mount Device
  • the packaging process allows the SIM card chip to be soldered directly to the M2M terminal module for tight, robust physical connections and reliable interface communication.
  • the carrier data in the existing MP card and the MS card is pre-configured by the operator, and the MP card and the MS card are in use. After that, the carrier data cannot be replaced, and the M2M terminal can only communicate with the predetermined operator, which limits the scope of use of the M2M terminal.
  • the main object of the present invention is to provide a data configuration method for three universal integrated circuit cards, which can dynamically configure carrier data of a universal integrated circuit card in an M2M terminal, and expand the use range of the M2M terminal.
  • Another object of the present invention is to provide a data configuration apparatus for four universal integrated circuit cards, which can dynamically configure carrier data of a general-purpose integrated circuit in an M2M terminal, and expand the use range of the M2M terminal.
  • Another object of the present invention is to provide a data configuration system for a universal integrated circuit card, which can dynamically configure carrier data of a universal integrated circuit card in an M2M terminal, and expand the range of the M2M terminal.
  • Another object of the present invention is to provide a storage medium, which can dynamically configure carrier data of an integrated circuit card in an M2M terminal, and expand the use range of the M2M terminal.
  • a data configuration method for a universal integrated circuit card includes: receiving a service provisioning request, where the service opening request carries a universal integrated circuit card UICC identifier and a first carrier device identifier;
  • a computer program for executing a data configuration method of the above-described universal integrated circuit card is a computer program for executing a data configuration method of the above-described universal integrated circuit card.
  • a storage medium for storing the above computer program is a storage medium for storing the above computer program.
  • a universal integrated circuit card management platform includes: a first receiving unit and a first sending unit; the first receiving unit is configured to receive a service opening request, where the service opening request carries a universal integrated circuit card UICC identifier and a first carrier device identifier, where the service provisioning request is sent to the first sending unit;
  • the first sending unit is configured to send a pre-stored UICC certificate corresponding to the UICC identifier to the first carrier device that is corresponding to the first carrier device identifier, where the UICC certificate carries the UICC Identification and UICC public key;
  • the first receiving unit is further configured to receive the encrypted first service key corresponding to the UICC identifier sent by the first carrier device, and send the encrypted first service key to the Said first transmitting unit;
  • the first sending unit is further configured to send the encrypted first service key to the
  • the UICC identifies the corresponding UICC.
  • a first carrier device comprising: a second receiving unit, a service key generating unit, a second sending unit, and a first service interaction unit;
  • the second receiving unit is configured to receive a UICC certificate sent by a universal integrated circuit card UICC management platform, where the UICC certificate carries a UICC identifier and a UICC public key, and sends the UICC certificate to the service key generating unit. ;
  • the service key generating unit is configured to: when the UICC certificate is verified to pass, generate a first service key corresponding to the UICC identifier according to a preset method, and use the UICC public key to use the first service
  • the key is encrypted, the first service key is sent to the first service interaction unit, and the encrypted first service key is sent to the second sending unit.
  • the second receiving unit is further configured to acquire, by the UICC, the first service key And then the sent service execution response is performed, where the service activation execution response carries the UICC identifier pre-stored by the UICC;
  • the first service interaction unit is configured to use the first service key and the UICC to perform a universal integrated circuit card, including: a third receiving unit, a decrypting unit, a third sending unit, and a second service interaction Unit
  • the third receiving unit is configured to receive the encrypted first service key sent by the universal integrated circuit card UICC management platform, and send the encrypted first service key to the decryption unit; Decrypting the encrypted first service key by using a pre-stored UICC private key corresponding to the UICC public key, acquiring the first service key, and transmitting the first service key to the second service An interaction unit, and sending a first sending instruction to the third sending unit, where the third sending unit is configured to send a service opening execution response to the first carrier device after receiving the first sending instruction, The service provisioning execution response carries pre-saved
  • the second service interaction unit is configured to perform service interaction with the first carrier device by using the first service key.
  • a household terminal comprising: a third storage unit and a universal integrated circuit card UICC;
  • the third storage unit is configured to store the UICC
  • the UICC is configured to receive the encrypted first service key sent by the UICC management platform, and decrypt the encrypted first service key by using a pre-stored UICC private key corresponding to the UICC public key. Transmitting a service opening response to the first carrier device, where the service opening execution response carries a pre-saved UICC identifier; using the first service key and the first carrier device Conduct business interactions.
  • a data configuration system for a universal integrated circuit card comprising: a universal integrated circuit card UICC management platform, a first carrier device, and a UICC;
  • the UICC management platform is configured to receive a service provisioning request, where the service provisioning request carries a UICC identifier and a first carrier device identifier, and sends the advance to the first carrier device corresponding to the first carrier device identifier.
  • the saved UICC certificate corresponding to the UICC identifier Receiving the encrypted first service key corresponding to the UICC identifier sent by the first carrier device, and sending the encrypted first service key to the UICC corresponding to the UICC identifier;
  • the first carrier device is configured to receive a UICC certificate sent by the UICC management platform, where the UICC certificate carries the UICC identifier and the UICC public key; when the UICC certificate is verified, according to The preset method generates a first service key corresponding to the UICC identifier, encrypts the first service key by using the UICC public key, and uses the UICC management platform to encrypt the first service key.
  • the UICC is configured to receive the encrypted first service key sent by the UICC management platform, and use the pre-stored UICC private key corresponding to the UICC public key to encrypt the encrypted first service key. Decrypting the key to obtain the first service key; sending a service activation execution response to the first carrier device, where the service activation execution response carries the UICC identifier saved in advance; using the first service The key performs business interaction with the first carrier device.
  • the UICC management platform obtains the encrypted first service key corresponding to the UICC identifier generated by the first carrier device according to the UICC identifier and the first carrier device identifier carried in the service provisioning request. After obtaining the encrypted first service key, the UICC decrypts the encrypted first service key by using the pre-stored UICC private key, and uses the decrypted first service key and the first carrier. The device performs business interaction.
  • the first carrier device identifier is carried by the UICC management platform according to the first carrier device identifier, and the first carrier device corresponding to the first carrier device identifier is opened according to the first carrier device identifier.
  • the universal integrated circuit proposed by the present invention The data configuration method, device and system of the card solve the technical problem that the M2M terminal can only communicate with the predetermined operator in the prior art, and expand the use range of the M2M terminal; Convenient and easy to popularize. Description
  • FIG. 1 is a flow chart of a first implementation of a universal integrated circuit card according to the present invention.
  • FIG. 2 is a flow chart showing the implementation of a method for generating a universal integrated circuit card certificate according to the present invention.
  • FIG. 3 is a flow chart showing the implementation of the first embodiment of the universal integrated circuit card according to the present invention.
  • FIG. 4 is a schematic diagram of a method for generating a transmission subkey according to the present invention.
  • FIG. 5 is a flow chart showing the implementation of the second embodiment of the universal integrated circuit card according to the present invention.
  • FIG. 6 is a flow chart showing a second implementation of the universal integrated circuit card according to the present invention.
  • FIG. 7 is a flow chart of a third implementation of the universal integrated circuit card according to the present invention.
  • FIG. 8 is a flow chart showing a fourth implementation of the universal integrated circuit card according to the present invention.
  • FIG. 9 is a flow chart of a first implementation of terminating a universal integrated circuit card according to the present invention.
  • FIG. 10 is a flowchart of an implementation of a first embodiment of terminating a universal integrated circuit card according to the present invention.
  • FIG. 1I is a flowchart of an implementation of a second embodiment of terminating a universal integrated circuit card according to the present invention.
  • FIG. 12 is a flow chart of a second implementation of terminating a universal integrated circuit card according to the present invention.
  • FIG. 13 is a flowchart of a third implementation of terminating a remote integrated circuit card according to the present invention.
  • FIG. 14 is a flow chart of a fourth implementation of terminating a universal integrated circuit card according to the present invention.
  • FIG. 15 is a flowchart of a first implementation of a universal integrated circuit card switching operator according to the present invention.
  • FIG. 16 is a flowchart of an implementation of a first embodiment of a universal integrated circuit card switching operator according to the present invention.
  • FIG. 17 is a flowchart of an implementation of a second embodiment of a universal integrated circuit card switching operator according to the present invention.
  • FIG. 18 is a second implementation flowchart of a universal integrated circuit card switching operator according to the present invention.
  • FIG. 19 is a flowchart showing the third implementation of the universal integrated circuit card switching operator of the present invention.
  • FIG. 20 is a flowchart of a fourth implementation of a universal integrated circuit card switching operator according to the present invention.
  • FIG. 21 is a schematic structural diagram of a general-purpose integrated circuit card management platform according to the present invention.
  • FIG. 22 is a schematic structural diagram of a first carrier device according to the present invention.
  • FIG. 23 is a schematic structural diagram of a universal integrated circuit card according to the present invention.
  • FIG. 24 is a schematic structural diagram of a user terminal according to the present invention.
  • FIG. 25 is a schematic structural diagram of a data configuration system of a universal integrated circuit card according to the present invention.
  • the data configuration scheme of the card can realize dynamic data configuration of the universal integrated circuit card in the M2M terminal, and expands the use range of the M2M terminal.
  • FIG. 1 is a flow chart of a first implementation of a universal integrated circuit card according to the present invention. As shown in Figure 1, the steps described below are included:
  • step! 01 The universal integrated circuit card UICC management platform receives the service opening request message, where the service opening request message carries the UICC identifier and the first carrier device identifier.
  • the Universal Integrated Circuit Card is a removable smart card that stores information such as user information, authentication keys, phone books, and short messages.
  • the UICC identifier may be a UICC ID, or may be other identifier information of the UICC.
  • the UICC management platform can receive the service provisioning request in the following two ways:
  • the first carrier device MN01 that the user applies for is received by the user, and the service request request carries the UICC identifier.
  • the first carrier device sends a service open request to the UICC management platform.
  • the service provisioning request carries the UICC identifier and the first carrier device identifier pre-stored by the first carrier device.
  • the user can obtain the UICC identifier corresponding to the UICC.
  • the user applies to the first carrier device to open the UICC, the user submits a service request request to the first carrier device, where the service request is requested. Carrying the UICC logo.
  • the UICC management platform directly receives the service provisioning request submitted by the user, where the service open request message carries the UICC identifier and the first carrier device identifier.
  • Step 102 The UICC management platform sends a pre-stored UICC certificate corresponding to the UICC identifier to the first carrier device corresponding to the first carrier device identifier, where the UICC certificate carries the UICC identifier and the UICC public key.
  • the UICC management platform queries whether the UICC corresponding to the UICC identifier is activated. If not activated, Bay ij sends a pre-saved UICC certificate corresponding to the UICC identifier to the first carrier device; if activated, the first sentence The business device sends an error message. Specifically, the UICC is activated, that is, the UICC has opened a service interaction with an operator device; the UICC is not activated, that is, the UICC does not open a service interaction with a carrier device, or The UICC has been terminated with the operator.
  • FIG. 2 is a flow chart showing the implementation of a method for generating a universal integrated circuit card certificate according to the present invention. As shown in Figure 2, the steps described below are included:
  • Step 201 After receiving the key request sent by the UICC vendor device, the UICC randomly generates a UICC public-private key pair, sends the UICC public key to the UICC vendor device, and saves the UICC private key.
  • Step 202 The UICC management platform receives the UICC card information sent by the UICC vendor device, where the UICC card information carries the UICC identifier and the UICC public key.
  • the UICC management platform uniformly manages the UICC identifier. Specifically, the UICC management platform may randomly generate two or more UICC identifiers, and allocate the two or more UICC identifiers to the UICC vendor device, where the UICC vendor device is After receiving the two or more UICC identifiers sent by the UICC management platform, the UICC is generated according to each of the two or more UICC identifiers.
  • Step 203 The UICC management platform sends the UICC card information to the certification center.
  • the UICC management platform After receiving the UICC card information sent by the UICC vendor, the UICC management platform sends the UICC card information to the authentication center.
  • Step 204 When the authentication center passes the authentication of the UICC card information, the UICC certificate is returned to the UICC management platform, where the UICC certificate carries the UICC identifier and the UICC public key.
  • the authentication center After receiving the UICC card information sent by the UICC management platform, the authentication center authenticates the UICC card information according to the authentication method in the prior art.
  • the UICC management platform returns a UICC certificate
  • the UICC certificate carries the UICC identifier and the UICC public key.
  • Step 205 The UICC management platform saves the UICC certificate corresponding to the UICC identifier.
  • the UICC management platform proceeds to step 103: when the first carrier device verifies the UICC certificate, according to a preset method
  • the first service key corresponding to the UICC identifier is encrypted, and the first service key is encrypted by using the UICC public key, and the encrypted first service key is sent to the UICC corresponding to the UICC identifier by using the UICC management platform.
  • the first carrier device verifies the received UICC certificate, and when the first carrier device verifies the UICC certificate, according to The key generation method in the prior art generates a first service key corresponding to the UICC identifier, encrypts the first service key by using the UICC public key, and the first carrier device sends the encrypted first service key to the first service key.
  • the UICC management platform forwards the received encrypted first service key to the UICC corresponding to the UICC identifier.
  • Step 104 The UICC decrypts the encrypted first service key by using a pre-stored UICC private key corresponding to the UICC public key to obtain the first service key.
  • the UICC decrypts the encrypted first service key by using the pre-stored UICC private key to obtain the first service key.
  • Step 105 The first carrier device obtains a service opening execution response sent by the UICC after acquiring the first service key, where the service opening execution response carries a UICC identifier pre-saved by the UICC.
  • the UICC Before the step of obtaining the first service key, the UICC returns a service opening response response to the UICC management platform, where the service opening execution response carries the UICC identifier pre-stored by the UICC, and the UICC management platform receives the UICC management platform. After the service sent by the UICC is activated, the UICC corresponding to the UICC identifier is marked as activated, and the service activation execution response is sent to the first carrier device.
  • Step 106 The first carrier device and the UICC use the first service key for service interaction.
  • the UICC management platform is based on the first carrier device identifier, because the first carrier device identifier is carried in the service provisioning request sent by the user.
  • FIG. 3 is a flow chart showing the implementation of the first embodiment of the universal integrated circuit card according to the present invention. As shown in Figure 3, the steps described below are included:
  • Step 301 The first carrier device MN01 receives a service request request submitted by the user, where the service request request carries a UICC ID.
  • Step 302 The MN01 sends a service opening request to the UICC management platform, where the service opening request carries the UICC ID and the first carrier device identifier.
  • Step 303 The UICC management platform queries whether the UICC corresponding to the UICC ID is activated. If not, the process proceeds to step 304. Otherwise, step 305 is performed.
  • Step 304 The UICC management platform sends the pre-saved UICC certificate corresponding to the UICC ID to the MN01, and step 306 is performed.
  • Step 305 The UICC management platform sends an error message to the MNOi to end the opening process of the universal integrated circuit card.
  • Step 306 When the MN01 verifies the UICC certificate, the first service key AUCICkey1 corresponding to the UICC ID is generated according to a preset method, and the AUCICkey1 is encrypted by using the UICC public key PubUICCkey to obtain the encrypted first service key.
  • Step 307 The MN01 sends the encrypted first service key [AUICCkeyl]PubUICCkey to the UICC management platform.
  • Step 308 The UICC management platform forwards the encrypted first service key [AUICCkey I JPubUiCCkey to the UICC corresponding to the UICC ID.
  • the UICC management platform may send the encrypted first service key [AUICCkeyl]PubUICCkey to the UICC corresponding to the UICC identifier using a wired network or a wireless network.
  • the data interaction between the UICC management platform and the UICC can be encrypted and authenticated by transmitting the subkey TUICCkey.
  • the UICC management platform forwards the encrypted first service key [AUICCkeyi] PubUICCkey to the UICC corresponding to the UICC identifier
  • the UICC management platform may use the transmission subkey TUICCkey to encrypt [AUICCkey 1 JPubUiCCkey, UICC in After receiving the [AUICCkey l]PubUICCkey encrypted by the UICC management platform using TUICCKEY, the encrypted [AUICCkey i]PubUiCCkey is decrypted using TUICCkey to obtain [AUICCkey l]PubUICCkey.
  • FIG. 4 is a schematic diagram of a method for generating a transmission subkey according to the present invention.
  • the UICC management platform and the UICC vendor device are respectively connected to the encryption machine 1 and the encryption machine 2, and the transmission root key TRootkey, the UICC management platform and the UICC vendor device are respectively pre-stored in the encryption machine 1 and the encryption machine 2, respectively. All can be based on 11[(:: 10 obtains the transmission subkey 111 ⁇ 0« ⁇ .
  • the UICC management platform sends the UICC ID to the encryption machine 1, and the encryption machine 1 uses the pre-saved transmission root key TRootkey to the UICC ID.
  • Encryption is obtained with 1) 1 ((10 corresponds to the transmission subkey 1!11 ( 03 ⁇ 4 , and returns TUICCkey to the UICC management platform.
  • the UICC vendor device sends the UICC ID to the encryption machine 2, the encryption machine 2
  • the UICC ID is encrypted using the pre-saved transport root key TRooikey, the transport subkey TUICCkey corresponding to the UICC ID is obtained, and the TUICCkey is returned to the UICC vendor device.
  • Step 309 The UICC decrypts the encrypted first service key [AUICCkeyI]Pi*UICCkey by using a pre-stored UICC private key PriUICCkey corresponding to the UICC public key PubUICCkey to obtain a first service key AUICCkey1.
  • the UICC can decrypt the encrypted first service key [AUICCkeyi]PubUICCkey according to the decryption method in the prior art to obtain the first service key AUICCkey1.
  • Step 3i The UICC returns a service activation response to the UICC management platform after obtaining the AUICCkey1, and the service activation execution response carries the UICC ID pre-saved by the UICC.
  • Step 311 The UICC management platform marks the UICC corresponding to the UICC ID as activated.
  • Step 312 The UICC management platform sends a service open execution response to the MNOi.
  • Step 3I 3 MNOi and UICC enable the ffi first service key AUICCkey1 to perform business interaction.
  • FIG. 5 is a flow chart showing the implementation of the second embodiment of the universal integrated circuit card according to the present invention. As shown in Figure 5, the steps described below are included:
  • Step 501 The UICC management platform receives a service provisioning request submitted by the user, where the service opening request carries a UICC ID and a first carrier device identifier.
  • Step 502 The UICC management platform queries whether the UICC corresponding to the UICC ID is activated. If not, the process proceeds to step 503. Otherwise, step 504 is performed.
  • Step 503 The UICC management platform sends a pre-stored UICC certificate corresponding to the UICC ID to the MNOi corresponding to the first carrier device identifier, where the UICC certificate carries the UICC ID and the UICC public key, and step 505 is performed.
  • Step 504 The UICC management platform sends an error prompt message to the user, and ends the opening process of the universal integrated circuit card.
  • Step 505 When the MN01 verifies the UICC certificate, the first service key AUCICkey1 corresponding to the UICC ID is generated according to a preset method, and the AUTCCkeyi is encrypted by using the UICC public key PubUICCkey to obtain the encrypted first service key [AUICCkey 1]PubUICCkey.
  • Step 506 The MN01 sends the encrypted first service key [AUICCk:eyl]PubUICCkey to the UICC management platform.
  • Step 507 The UICC management platform forwards the encrypted first service key [AUICCkey I ]PubUICCkey to the UICC corresponding to the UICC ID.
  • Step 508 The UICC decrypts the encrypted first service key [AUICCkeylJPubUICCkey by using the pre-stored UICC private key PriUICCkey corresponding to the UICC public key PubUICCkey to obtain the first service key AUICCkeyl.
  • Step 509 After obtaining the AUCICkey1, the UICC returns a service activation execution response to the UICC management platform, where the service activation execution response carries the UICC IDo saved in advance by the UICC.
  • Step 5ih The UICC management platform sends a service activation execution response to the MN01.
  • Step 5I2 The MNOi and the UICC perform the service interaction of the ffi first service key AUCCkey1.
  • the UICC management platform obtains the UICC identifier generated by the first carrier device and the UICC identifier according to the UICC identifier and the first carrier device identifier carried in the service provisioning request.
  • the UICC decrypts the encrypted first service key using the pre-stored UICC private key after obtaining the encrypted first service key, and obtains the decrypted first service key.
  • the first service key interacts with the first carrier device.
  • the first carrier device identifier is carried by the UICC management platform, and the UICC management platform opens the first carrier device corresponding to the first carrier device identifier for the universal integrated circuit card according to the first carrier device identifier.
  • Inter-service interaction so operators can flexibly configure the operator data in the universal integrated circuit card flexibly, without the M2M terminal need to be customized according to the operator in the production process, so the universal integrated circuit card proposed by the present invention Data configuration method, device and system, solving the prior art M2M terminal can only be scheduled
  • the technical problems of the operator's communication have expanded the scope of use of the M2M terminal.
  • FIG. 6 is a flow chart showing a second implementation of the universal integrated circuit card according to the present invention. As shown in Figure 6, the steps described below are included:
  • Step 601 Receive a service provisioning request, where the service provisioning request carries a universal integrated circuit card UICC identifier and a first carrier device identifier.
  • the UICC management platform receives the service activation request message, where the service activation request message carries the UICC identifier and the first carrier device identifier.
  • the UICC management platform can receive the service provisioning request in the following two manners: In the first mode, the first carrier device MN01 that the user applies for is received by the user, and the service request request carries the UICC identifier.
  • the first carrier device sends a service provisioning request to the UICC management platform, where the service provisioning request carries the UICC identifier and the first carrier device identifier pre-stored by the first carrier device.
  • the user can obtain the UICC identifier corresponding to the UICC.
  • the user applies to the first carrier device to open the UICC, the user submits a service request request to the first carrier device, where the service request is requested. Carrying the UICC logo.
  • the UICC management platform directly receives the service provisioning request submitted by the user, where the service opening request message carries the UICC identifier and the first carrier device identifier.
  • Step 602 Send a pre-stored UICC certificate corresponding to the UICC identifier to the first carrier device corresponding to the first carrier device identifier, where the UICC certificate carries the UICC identifier and the UICC public key.
  • the UICC management platform sends a pre-stored UICC certificate corresponding to the UICC identifier to the first carrier device corresponding to the first carrier device identifier, where the UICC certificate carries the UICC identifier and the UICC public key.
  • the UICC management platform may query whether the UICC corresponding to the UICC identifier is activated. If not activated, the pre-saved UICC certificate corresponding to the UICC identifier is sent to the first carrier device; if activated, the error message is sent to the first carrier device.
  • Step 603 Receive an encrypted first corresponding to the UICC identifier sent by the first carrier device.
  • the service key, and the encrypted first service key is sent to the UICC corresponding to the UICC identifier.
  • the UICC management platform receives the encrypted first service key corresponding to the UICC identifier sent by the first carrier device, and sends the encrypted first service key to the UICC corresponding to the UICC identifier.
  • FIG. 7 is a flow chart of a third implementation of the universal integrated circuit card according to the present invention. As shown in Figure 7, the steps described below are included:
  • Step 701 Receive a UICC certificate sent by the UICC management platform, where the UICC certificate carries a UICC identifier and a UICC public key.
  • the first carrier device receives the UICC certificate sent by the UICC management platform, where the UICC certificate carries the UICC identifier and the UICC public key.
  • the first carrier device may receive a user submitting a service request request, where the service request request carries a UICC identifier; and the first carrier device sends a service activation request to the UICC management platform.
  • the service open request carries the UICC identifier and the first carrier device identifier pre-stored by the first carrier device.
  • Step 702 When the UICC certificate is verified, the first service key corresponding to the UICC identifier is generated according to a preset method, and the first service key is encrypted by using the UICC public key, and the encrypted first is obtained by the UICC management platform. A service key is sent to the UICC corresponding to the UICC identity.
  • the first carrier device verifies the received UICC certificate, and when the first carrier device verifies the UICC certificate, according to The key generation method in the prior art generates a first service key corresponding to the UICC identifier, encrypts the first service key by using the UICC public key, and the first carrier device sends the encrypted first service key to the first service key.
  • the UICC management platform forwards the received encrypted first service key to the UICC corresponding to the UICC identifier.
  • Step 703 Acquire a service provisioning execution response sent by the UICC after acquiring the first service key, where the service opening execution response carries a UICC identifier pre-saved by the UICC.
  • the first carrier device obtains a service activation execution response sent by the UICC after acquiring the first service key, where the service activation execution response carries a UICC identifier pre-stored by the UICC.
  • Step 704 Let the first service key interact with the UICC.
  • the first carrier device performs service interaction using the first service key and the UICC.
  • FIG. 8 is a flow chart showing a fourth implementation of the universal integrated circuit card according to the present invention. As shown in Figure 8, the steps described below are included:
  • Step 801 Receive an encrypted first service key sent by the UICC management platform.
  • Step 802 Decrypt the encrypted first service key by using a pre-stored UICC private key corresponding to the UICC public key to obtain the first service key.
  • the UICC decrypts the encrypted first service key by using the pre-stored UICC private key to obtain the first service key.
  • Step 803 Perform a service activation response sent to the first carrier device, where the service activation response carries a pre-saved UICC identifier.
  • the UICC After obtaining the first service key, the UICC returns a service opening execution response to the UICC management platform, where the service opening execution response carries the UICC identifier pre-stored by the UICC, and the UICC management platform receives the UICC.
  • the UICC corresponding to the UICC identifier is marked as activated, and the service activation execution response is sent to the first carrier device.
  • Step 804 Perform service interaction with the first carrier device by using the first service key.
  • FIG. 9 The flow chart of the first implementation of terminating the universal integrated circuit card of the present invention. As shown in Figure 9, the following steps are included:
  • Step 90h The UICC management platform receives the service termination request sent by the first carrier device, where the service termination request carries the UICC identifier and the first packet authentication code generated by the first carrier device according to the first service key.
  • the UICC management platform queries whether the UICC corresponding to the UICC identifier is activated, and if activated, sends a service termination request to the UICC identifier. Corresponding UICC, otherwise, send to the first carrier device Error message.
  • the UICC management platform may further receive a service cancellation request submitted by the user before receiving the service termination request sent by the first carrier device, where the service cancellation request carries a UICC identifier, and the UICC management platform query corresponds to the UICC identifier. Whether the UICC is activated, if activated, forwards the service cancellation request to the first carrier device, otherwise, sends an error message to the user.
  • Step 902 The UICC management platform sends a service termination request to the UICC corresponding to the UICC identifier.
  • the UICC management platform sends a service termination request to the UICC corresponding to the UICC identifier.
  • Step 903 When the UICC checks the first packet authentication code by ⁇ , the service interaction with the first carrier device is terminated.
  • the UICC may perform the verification on the received first message authentication code according to the verification method of the message authentication code in the prior art, and terminate when the UICC checks the first message authentication code. Perform business interaction with the first carrier device.
  • Step 904 The first carrier device obtains a service termination execution response sent by the UICC after terminating the service interaction with the first carrier device, where the service termination execution response carries the UICC identifier.
  • the service termination execution response is sent to the UICC management platform, and the service termination execution response carries the UICC identifier.
  • the UICC management platform marks the UICC corresponding to the UICC identifier as being inactive, and sends a service termination execution response to the first carrier device.
  • steps 901 to 904 it is possible to terminate the service interaction between the universal integrated circuit card and the first carrier device.
  • the following is a detailed description of the termination process of the universal integrated circuit card in combination with two specific embodiments:
  • FIG. 10 is a flowchart of an implementation of a first embodiment of terminating a universal integrated circuit card according to the present invention. As shown in Figure 10, the steps described below are included:
  • Step 1001 The MNOi receives a service cancellation request submitted by the user, where the service cancellation request is Carry a UICC ID.
  • Step 1002 The MNO1 generates a first message authentication code corresponding to the UICC ID according to the first service key, and sends a service termination request to the UICC management platform, where the service termination request carries the UICC ID and the first message authentication code.
  • the MN01 may perform the first message authentication code corresponding to the UICC ID generated according to the first service key according to the method for generating the message authentication code in the prior art.
  • step! 003 The UICC management platform queries whether the UICC corresponding to the UICC ID is activated. If not, the process proceeds to step 1004. Otherwise, step 1005 is performed.
  • Step 1004 The UICC management platform returns an error message to the MN01, and ends the process of terminating the universal integrated circuit card.
  • Step 1005 The UICC management platform sends a service termination request to the UICC corresponding to the UICC ID.
  • Step 1006 When the UICC passes the first message authentication code check, the service interaction with the MN01 is terminated.
  • Step 1007 The UICC sends a service termination execution response to the UICC management platform after terminating the service interaction with the MNOi, where the service termination execution response carries the UICC ID.
  • Step 1008 The UICC management platform marks the UICC corresponding to the UICC ID as being inactive.
  • Step 1009 The UICC management platform sends a service termination execution response to the MN01.
  • FIG. 11 is a flow chart showing the implementation of a second embodiment of terminating a universal integrated circuit card according to the present invention. As shown in Figure 11, the steps described below are included:
  • Step 1101 The UICC management platform receives a service cancellation request submitted by a user, where the service cancellation request carries a UICC ID.
  • Step 1102 The UICC management platform queries whether the UICC corresponding to the UICC ID is activated. If not, the process proceeds to step 1103. Otherwise, step 1104 is performed.
  • Step 1103 UICC Management Platform ⁇ The user returns an error message and ends the process of terminating the general integrated circuit card.
  • Step 1104 The UICC management platform forwards the service cancellation request to the MN01.
  • Step 1105 M 01 sends a service termination request to the UICC management platform according to the first packet authentication code corresponding to the UICC ID generated by the first service key, where the service termination request carries UICC ID and first message authentication code.
  • Step 1106 The UICC management platform sends a service termination request to the UICC corresponding to the UICC ID.
  • Step 1107 When the UICC passes the first message authentication code check, the service interaction with the MN01 is terminated.
  • Step 1108 The UICC sends a service termination execution response to the UICC management platform after terminating the service interaction with the MNI01, where the service termination execution response carries the UICC ID.
  • Step 1109 The UICC management platform marks the UICC corresponding to the UICC ID as being inactive.
  • Step 1110 The UICC management platform sends a service termination execution response to the MN01.
  • the UICC management platform terminates the universal integrated circuit card and the first carrier device identifier according to the UICC identifier and the first carrier device identifier carried in the service termination request. Business interaction between the first carrier devices.
  • FIG. 12 is a flow chart of a second implementation of terminating a universal integrated circuit card according to the present invention. As shown in Figure 12, the steps described below are included:
  • Step 120 Receive a service termination request sent by the first carrier device, where the service termination request carries a UICC identifier and a first packet authentication code generated by the first carrier device according to the first service key.
  • the UICC management platform receives the service termination request sent by the first carrier device, where the service termination request carries the UICC identifier and the first message generated by the first carrier device according to the first service key. code.
  • the UICC management platform queries whether the UICC corresponding to the UICC identifier is activated, and if activated, sends a service termination request to the UICC identifier.
  • the corresponding UICC otherwise, sends an error message to the first carrier device.
  • the UICC management platform may further receive a service cancellation request submitted by the user before receiving the service termination request sent by the first carrier device, where the service cancellation request carries a UICC identifier, and the UICC management platform queries the UICC identifier corresponding to the UICC identifier. Whether the UICC is activated, if it has been activated, the first carrier device of the Bay forwards the service cancellation request, otherwise, sends an error message to the ffi household. step! 202: Send a service termination request to a UICC corresponding to the UICC identifier.
  • the UICC management platform sends a service termination request to the UICC corresponding to the UICC identifier.
  • the UICC management platform receives the service termination execution response sent by the UICC after terminating the service interaction with the first carrier device, where the service termination execution response carries the UICC identifier, and the UICC management platform receives the service sent by the UICC. After terminating the execution response, the UICC corresponding to the UICC identity is marked as not activated, and the service termination execution response is sent to the first operational device.
  • FIG. 13 is a flowchart of a third implementation of terminating a universal integrated circuit card according to the present invention. As shown! 3, including the steps described below:
  • Step 1301 Send a service termination request to the UICC management platform, where the service termination request carries a UICC identifier and a first packet authentication code generated according to the first service key.
  • the first carrier device sends a service termination request to the UICC management platform, where the service termination request carries the UICC identifier and the first packet authentication code generated by the first carrier device according to the first service key.
  • Step 1302 Acquire a service termination execution response sent by the UICC, where the service termination execution response carries a UICC identifier.
  • the first carrier device obtains a service termination execution response sent by the UICC after terminating the service interaction with the first carrier device, where the service termination execution response carries
  • FIG. 14 is a flow chart of a fourth implementation of terminating a universal integrated circuit card according to the present invention. As shown in Figure 14, the steps described below are included:
  • Step 1401 Receive a service termination request sent by the UICC management platform, where the service termination request carries a UICC identifier and a first packet authentication code generated by the first carrier device according to the first service key.
  • the UICC receives the service termination request sent by the UICC management platform, where the service termination request carries the UICC identifier and the first packet authentication code generated by the first carrier device according to the first service key.
  • Step 1402 When the first message authentication code is verified, the device is terminated with the first carrier device. Line business interaction.
  • the UICC may perform the verification of the received first message authentication code according to the verification method of the message authentication code in the prior art, and when the UICC checks the first message authentication code through the date, Terminate the business interaction with the first carrier device.
  • Step 1403 Send a service termination execution response to the first carrier device, where the service termination execution response carries a UICC identifier.
  • the service termination execution response is sent to the UICC management platform, where the service termination execution response carries the UICC identifier.
  • the UICC management platform marks the UICC corresponding to the UICC identifier as being inactive, and sends a service termination execution response to the first carrier device.
  • the implementation process of the universal integrated circuit card switching operator may also be included.
  • 15 is a flow chart of the first implementation of the integrated circuit card switching operator of the present invention. As shown in Figure 15, the steps described below are included:
  • Step 1501 The UICC management platform receives the operator handover request, where the operator handover request carries the UICC identifier and the second carrier device identifier.
  • the UICC management platform can receive the operator handover in the following two manners.
  • the second carrier device MN02 that the user applies for handover receives the operator handover request submitted by the user, and the operator handover application is performed.
  • the second carrier device carries a service switching request to the UICC management platform, where the service switching request carries the UICC identifier and the second carrier device identifier pre-stored by the second carrier device.
  • the UICC management platform directly receives the operator handover request submitted by the user, where the operator handover request carries the UICC identifier and the second carrier device identifier.
  • Step 1502 When the first carrier device allows the UICC to switch to the operator device corresponding to the UICC identifier, the UICC management platform sends a UICC certificate to the second carrier device corresponding to the second carrier device identifier, where the UICC certificate carries There is a UICC identity and a UICC public key.
  • the UICC management platform queries the UICC identifier according to the UICC identifier.
  • the UICC management platform forwards the carrier switching request to the first carrier device to which the UICC corresponding to the UICC identifier belongs, and the first carrier device returns the operator switching response to the UICC management platform, UICC management.
  • the platform After receiving the operator handover response of the UICC handover operator corresponding to the UICC identifier sent by the first carrier device, the platform sends a UICC certificate to the second carrier device corresponding to the second carrier device identifier, where the UICC is sent.
  • the certificate carries the UICC identifier and the UICC public key.
  • Step 1503 When the second carrier device verifies the UICC certificate, the second service key corresponding to the UICC identifier is generated according to the preset method, and the second service key is encrypted by using the UICC public key, and the UICC identifier is matched. The encrypted second service key is sent to the UICC management platform
  • the second carrier device verifies the received UICC certificate, and when the second carrier device verifies the UICC certificate, according to
  • the key generation method in the prior art generates a second service key corresponding to the UICC identifier, encrypts the second service key by using the UICC public key, and the second carrier device encrypts the second corresponding to the UICC identifier.
  • the business key is sent to the UICC management platform.
  • Step 1504 The UICC management platform sends the encrypted second service key corresponding to the UICC identifier to the first carrier device, and receives the UICC identifier generated by the first carrier device according to the encrypted second service key.
  • the second message authentication code The second message authentication code.
  • the UICC management platform After receiving the encrypted second service key corresponding to the UICC identifier sent by the second carrier device, the UICC management platform sends the encrypted second service key to the first operation.
  • the first device device generates and is generated according to the encrypted second service key.
  • the second packet authentication code corresponding to the UICC identifier is sent to the UICC management platform.
  • Step 1505 The UICC management platform encrypts the second service key and the second message authentication code.
  • Step 1506 When the UICC checks the second message identification code, the second encrypted second pair is used. The service key is decrypted to obtain the second service key.
  • Step 1507 The second carrier device acquires an operator handover execution response sent by the UICC after acquiring the second service key, where the operator handover execution response carries the UICC identifier.
  • step! 508 The second carrier device interacts with the UICC using the second service key.
  • FIG. 16 is a flowchart of an implementation of a first embodiment of a universal integrated circuit card switching operator according to the present invention. As shown in Figure 16, the steps described below are included:
  • step! 601 The second carrier device MN02 receives the operator handover request submitted by the user, where the operator handover request carries the UICC ID.
  • Step 1602 The MN02 forwards the operator handover request to the UICC management platform, where the operator handover request carries the UICC ID and the second operator identifier.
  • Step 1603 The UICC management platform queries the operator device identifier currently belonging to the UICC corresponding to the UICC ID.
  • Step 1604 The UICC management platform forwards the operator switching request to the operator equipment MNOi to which the UICC corresponding to the UICC ID belongs.
  • Step 1605 The MNOI returns a carrier handover response to the UICC management platform.
  • the operator switching response may carry the information that the MNOi allows the UICC corresponding to the UICC identifier to switch the carrier device, and may also carry the information that the MNOI does not allow the UICC corresponding to the UICC identifier to switch the carrier device.
  • Step 1606 When the MNOI allows the UICC corresponding to the UICC ID to switch the carrier device, the UICC management platform sends the pre-stored UICC certificate corresponding to the UICC ID to the MN02, where the UICC certificate carries the UICC ID and the UICC public key PubUICCkey. .
  • Step 1607 When the MN02 verifies the UICC certificate, the second service key AUICCkey2 corresponding to the UICC ID is generated according to a preset method, and the AUICCkey2 is encrypted by using the PubUICCkey.
  • Step 1608 The MN02 sends an encrypted first step 1609 corresponding to the UICC ID to the UICC management platform: The UICC management platform sends the [AUICCkey2]PubUICCkey to the MN01.
  • Step 1610 The MN01 generates a second message authentication code according to [AUICCkey2] PubUICCkey.
  • Step 1611: M 01 sends the second message authentication code to the UICC management platform.
  • Step 1614 After obtaining the AUICCkey2, the UICC returns an operator handover execution response to the UICC management platform, where the operator handover execution response carries the UICC ID.
  • Step 1615 The UICC management platform modifies the current carrier device of the UICC to M 02.
  • Step 1616 The UICC management platform returns an operator handover execution response to the MN01.
  • Step 1617 The UICC management platform returns a carrier handover execution response to the MN02.
  • Step 1618 The MN02 interacts with the UICC using the second service key AUICCkey2.
  • FIG. 17 is a flowchart of an implementation of a second embodiment of a universal integrated circuit card switching operator according to the present invention. As shown in FIG. 17, the steps described below are included;
  • Step 1701 The UICC management platform receives the operator handover request submitted by the user, where the operator handover request carries the UICC ID and the second carrier device identifier.
  • Step ⁇ 02 The UICC management platform queries the operator device identifier currently belonging to the UICC corresponding to the UICC ID.
  • Step 1703 The UICC management platform forwards the operator switching request to the operator equipment MNOi to which the UICC corresponding to the UICC ID belongs.
  • Step ⁇ 04 MN01 returns the operator handover response to the UICC management platform.
  • Step 1705 When the MNOi allows the UICC corresponding to the UICC identifier to switch to the operator device, the UICC management platform sends the pre-stored UICC certificate corresponding to the UICC ID to the MN02, where the UICC certificate carries the UICC ID and the UICC public key PubUICCkey.
  • Step 1706 When the MN02 verifies the UICC certificate, the second service key AUICCkey2 corresponding to the UICC ID is generated according to a preset method, and the AUICCkey2 is encrypted by using the PubUICCkey.
  • Step 1707 The MN02 sends the encrypted second service key [AUICCkey2] PubUICCkey corresponding to the UICC ID to the UICC management platform.
  • Step 1708 The UICC management platform sends [AUICCkey2] PubUICCkey to MNO1.
  • Step 1709 MNO1 generates a second message authentication code according to [AUICCkey2] PubUICCkey.
  • step! 710 The MNO1 sends the second packet authentication code to the UICC management platform.
  • Step 1711 The UICC management platform sends a step 1712 to the UICC corresponding to the UICC ID: when the UICC checks the second message authentication code through the date, decrypts [AUICCkey2]PubUICCk:ey using the UICC private key PriUICCkey to obtain the second.
  • Step 1713 After obtaining the AUICCkey2, the UICC returns an operator handover execution response to the UICC management platform, where the operator handover execution response carries the UICC ID.
  • Step 1714 The UICC management platform modifies the current carrier device of the UICC to MN02.
  • the UICC management platform returns an operator handover execution response to the MNO1.
  • Step 1716 The UICC management platform returns a carrier handover execution response to the MN02.
  • Step 1717 The MN02 and the UICC use the second service key AUICCkey2 for service interaction.
  • FIG. 18 is a second implementation flowchart of a universal integrated circuit card switching operator according to the present invention. As shown in FIG. 18, the method includes the following steps: Step 1801: Receive an operator handover request, where the operator handover request carries a UICC identifier and a second carrier device identifier.
  • the UICC management platform receives the operator handover request, where the operator handover request carries the UICC identifier and the second carrier device identifier.
  • the UICC management platform can receive the operator handover request in the following two manners: In the first mode, the second carrier device MN02 that the user applies for handover receives the operator handover request submitted by the user, and the operator switches the application.
  • the second carrier device carries a service switching request to the UICC management platform, where the service switching request carries the UICC identifier and the second carrier device identifier pre-stored by the second carrier device.
  • the UICC management platform directly receives the operator handover request submitted by the user, where the operator handover request carries the UICC identifier and the second carrier device identifier.
  • Step 1802 When the first carrier device allows UICC switching operation corresponding to the UICC identifier The UICC certificate is sent to the second carrier device corresponding to the second carrier device identifier, where the UICC certificate carries the UICC identifier and the UICC public key.
  • the UICC management platform sends a UICC certificate to the second carrier device corresponding to the second carrier device identifier, where the UICC certificate is generated. It carries the UICC logo and the UICC public key.
  • Step 1803 Receive an encrypted second service key corresponding to the UICC identifier sent by the second carrier device, and send the encrypted second service key corresponding to the UICC identifier to the first carrier. device.
  • the UICC management platform receives the encrypted second service key corresponding to the UICC identifier sent by the second carrier device, and sends the encrypted second service key to the first carrier device.
  • the first carrier device generates a second packet authentication code corresponding to the UICC identifier according to the encrypted second service key, and sends the second packet authentication code to the UICC management platform.
  • Step 1804 Receive a second packet authentication code corresponding to the UICC identifier generated by the first carrier device according to the encrypted second service key.
  • the UICC management platform receives the second packet authentication code corresponding to the UICC identifier generated by the first carrier device according to the encrypted second service key.
  • Step 1805 Send the encrypted second service key and the second message authentication code to the UICC corresponding to the UICC identifier.
  • the UICC management platform sends the encrypted second service key and the second message authentication code to the UICC corresponding to the UICC identifier.
  • FIG. 19 is a flowchart showing the third implementation of the universal integrated circuit card switching operator of the present invention. As shown in Figure 19, the steps described below are included:
  • Step 1901 Receive an encrypted second service key corresponding to the UICC identifier sent by the UICC management platform.
  • the first carrier device receives the encrypted second service key corresponding to the UICC identifier sent by the UICC management platform.
  • Step 1902 The UICC management platform sends a second packet authentication code corresponding to the UICC identifier generated according to the encrypted second service key.
  • the first carrier device sends the encrypted second according to the UICC management platform.
  • FIG. 20 is a flowchart of a fourth implementation of a universal integrated circuit card switching operator according to the present invention. As shown in Figure 20, the steps described below are included:
  • Step 2001 Receive the encrypted second service key and the second message authentication code sent by the UICC management platform.
  • the UICC receives the encrypted second service key and the second message authentication code sent by the UICC management platform.
  • Step 2002 When the second message authentication code is verified, the encrypted second service key is decrypted by using the UICC private key to obtain the second service key.
  • the encrypted second service key is decrypted by using the UICC private key to obtain the second service key.
  • Step 2003 Send a carrier handover execution response to the second carrier device, where the operator switching execution response carries the UICC identifier.
  • the UICC sends an operator handover execution response to the second carrier device, where the operator handover execution response carries the UICC identifier.
  • Step 2004 Perform a service interaction with the second carrier device by using the second service key.
  • the UICC uses the second service key to perform service interaction with the second carrier device.
  • the UICC management platform obtains the encrypted information corresponding to the UICC identifier generated by the first carrier device according to the UICC identifier and the first carrier device identifier carried in the service provisioning request.
  • the first service key, the UICC decrypts the encrypted first service key using the pre-stored UICC private key after acquiring the encrypted first service key, and uses the decrypted first service key.
  • the UICC management platform opens the first carrier corresponding to the first carrier device identifier according to the first carrier device identifier according to the first carrier device identifier.
  • the data configuration method of the circuit card solves the technical problem that the M2M terminal can only communicate with a predetermined operator in the prior art, and expands the use range of the M2M terminal; in addition, the method of the present invention is convenient to implement, and Popularization.
  • FIG. 21 is a schematic structural diagram of a general-purpose integrated circuit card management platform according to the present invention. As shown in FIG. 21, the method includes: a first receiving unit 2101 and a first sending unit 2102;
  • the first receiving unit 2101 is configured to receive a service provisioning request, where the service provisioning request carries a universal integrated circuit card UICC identifier and a first carrier device identifier, and sends the service provisioning request to the first sending Unit 2102;
  • the first sending unit 2102 is configured to send, to the first carrier device corresponding to the first carrier device identifier, a pre-stored UICC certificate corresponding to the UICC identifier, where the UICC certificate carries the UICC identity and UICC public key;
  • the first receiving unit 2101 is further configured to receive the encrypted first service key corresponding to the UICC identifier sent by the first carrier device, and send the encrypted first service key to The first sending unit 2102.
  • the first sending unit 2102 further sends the encrypted first service key to the UICC corresponding to the UICC identifier.
  • the first receiving unit 2101 is specifically configured to receive the service provisioning request sent by the first carrier device, where the service opening request carries the UICC identifier and the first carrier device The first carrier device identifier saved in advance;
  • the service opening request carries the UICC identifier and the first carrier device identifier.
  • the universal integrated circuit card management platform further includes: a query unit 2103;
  • the query unit 2103 is configured to query whether the UICC corresponding to the UICC identifier is activated, and if not activated, send the UICC certificate to the first carrier device, otherwise, to the first carrier. The device sends an error message.
  • the universal integrated circuit card management platform further includes: a marking unit 2104;
  • the first receiving unit 2101 is further configured to receive a service activation execution response that is sent by the UICC after acquiring the first service key, where the service activation response carries the UICC identifier, and the service is The opening execution response is sent to the marking unit 2104 and the first sending unit 2102;
  • the marking unit 2104 is configured to mark the UICC corresponding to the UICC identifier as having been Activate
  • the first sending unit 2102 is further configured to send the service provisioning execution response to the first carrier device.
  • the universal integrated circuit card management platform further includes: a first storage unit 2105; the first receiving unit 210! is further configured to receive UICC card information sent by the UICC vendor device, where the UICC card information is carried The UICC identifier and the UICC public key, and the UICC card information is sent to the first sending unit 2102 ;
  • the first sending unit 2102 is further configured to send the UICC card information to the authentication center.
  • the first receiving unit 210! is further configured to: when the authentication center authenticates the UICC card information, Receiving the UICC certificate returned by the authentication center, the UICC certificate carrying the UICC identifier and the UICC public key, and sending the UICC certificate to the first storage unit 2105;
  • the first storage unit 2105 is configured to save the UICC certificate corresponding to the UICC identifier.
  • the first receiving unit 2101 is further configured to receive a service termination request sent by the first carrier device, where the service termination request carries the UICC identifier and is compared with the first carrier device according to the The first message authentication code generated by the first service key, the service termination request is sent to the first sending unit 2102;
  • the first sending unit 2102 is further configured to send the service termination request to a UICC corresponding to the UICC identifier.
  • the query unit 2103 is further configured to query whether a UICC corresponding to the UICC identifier is activated, and if activated, send the service termination request to a UICC corresponding to the UICC identifier, otherwise, Sending an error message to the first-operator device.
  • the first receiving unit 2101 is further configured to receive a service cancellation request submitted by the user, where the service cancellation request carries the UICC identifier, and the service cancellation request is sent to the query unit 2103. ;
  • the query unit 2103 is further configured to query whether the UICC corresponding to the UICC identifier is activated, and if activated, forward the service cancellation request to the first carrier device, otherwise, send the service cancellation request to the user Error message.
  • the first receiving unit 2101 is further configured to receive the service termination execution response sent by the UICC after terminating a service interaction with the first carrier device, where the service termination execution response carries The UICC identifier, the service termination execution response is sent to the marking unit 2104 and the first sending unit 2102;
  • the marking unit 2104 is further configured to mark the UICC corresponding to the UICC identifier as not being the first sending unit 2102, and to send the service termination execution response to the first carrier device.
  • the first receiving unit 2101 is further configured to receive a carrier switching request, where the operator switching request carries the UICC identifier and the second carrier device identifier, and sends the operator switching request to The first sending unit 2102;
  • the first sending unit 2102 is further configured to: when the first carrier device allows the UICC corresponding to the UICC identifier to switch the carrier device, to the second carrier corresponding to the second carrier device identifier
  • the device sends the UICC certificate, where the UICC certificate carries the UICC identifier and the UICC public key;
  • the first receiving unit 2101 is further configured to receive the encrypted second service key corresponding to the UICC identifier sent by the second carrier device, and send the encrypted second service key to The first sending unit 2102;
  • the first sending unit 2102 is further configured to send the encrypted second service key to the first carrier device;
  • the first receiving unit 2101 is further configured to receive a second packet authentication code corresponding to the UICC identifier generated by the first carrier device according to the encrypted second service key, The second message authentication code is sent to the first sending unit 2102;
  • the first sending unit 2102 is further configured to send the encrypted second service key and the second message authentication code to a UICC corresponding to the UICC identifier.
  • the first receiving unit 2101 is specifically configured to receive the operator switching request sent by the second carrier device, where the operator switching request carries the UICC identifier and the second Carrier equipment identification;
  • the carrier switching request carries With the UICC identifier and the second carrier device identifier.
  • FIG. 22 is a schematic structural diagram of a first carrier device according to the present invention. As shown in FIG. 22, the method includes: a second receiving unit 2201, a service key generating unit 2202, a second sending unit 2203, and a first service interaction unit 2204;
  • the second receiving unit 220! is configured to receive a UICC certificate sent by a universal integrated circuit card UICC management platform, where the UICC certificate carries a UICC identifier and a UICC public key, and sends the UICC certificate to the service key.
  • the service key generating unit 2202 is configured to: when the first carrier device verifies the UICC certificate, generate a first service key corresponding to the UICC identifier according to a preset method, and use the UICC public key. Encrypting the first service key, sending the first service key to the first service interaction unit 2204, and transmitting the encrypted first service key to the second sending unit 2.203;
  • the second sending unit 2203 is configured to send the encrypted first service key to the UICC corresponding to the UICC identifier
  • the second receiving unit 2201 is further configured to acquire a service activation execution response that is sent by the UICC after acquiring the first service key, where the service provisioning execution response carries the foregoing pre-save of the UICC UICC logo;
  • the first service interaction unit 2204 is configured to perform service interaction using the first service key and the UICC.
  • the second receiving unit 2201 is further configured to receive a service request request submitted by the user, where the service request request carries the UICC identifier, and the service request request is sent to the second sending Unit 2203;
  • the second sending unit 2203 is further configured to send the service provisioning request to the UICC management platform, where the service opening request carries the UICC identifier and the first pre-stored by the first carrier device A carrier device identifier.
  • the second sending unit 2203 is further configured to send a service termination request to the UICC management platform, where the service termination request carries the UICC identifier and the first carrier device according to the a first message authentication code generated by a service key;
  • the second receiving unit 2201 is further configured to acquire, by the UICC, the termination and the first operation.
  • the service termination response is sent after the service device performs the service interaction, and the service termination execution response carries the UICC identifier.
  • the second receiving unit 2201 is further configured to receive the encrypted second service key that is sent by the UICC management platform and that is corresponding to the UICC identifier;
  • the second sending unit 2203 is further configured to send, to the UICC management platform, a second packet authentication code corresponding to the UICC identifier generated according to the encrypted second service key.
  • FIG. 23 is a schematic structural diagram of a universal integrated circuit card according to the present invention. As shown in FIG. 23, the method includes: a third receiving unit 2301, a decrypting unit 2302, a third sending unit 2303, and a second service interaction unit 2304;
  • the third receiving unit 2301 is configured to receive the encrypted first service key sent by the universal integrated circuit card UICC management platform, and send the encrypted first service key to the decryption unit 2.302;
  • the decrypting unit 2302 is configured to decrypt the encrypted first service key by using a pre-stored UICC private key corresponding to the UICC public key, to obtain a first service key, and to use the first service key. Sending to the second service interaction unit 2304, and sending a first sending instruction to the third sending unit 2303;
  • the sending unit 2303 is configured to: after receiving the first sending instruction, send a service opening execution response to the first carrier device, where the service opening execution response carries a pre-stored UICC identifier;
  • the second service interaction unit 2304 is configured to perform service interaction with the first operator device by using the first service key.
  • the universal integrated circuit card further includes: a public-private key pair generating unit 2305 and a second storage unit 2306;
  • the third receiving unit 2301 is further configured to receive a key request sent by the UICC vendor device, and send the key request to the public and private key pair generating unit 2305;
  • the public-private key pair generating unit 2305 is configured to randomly generate a UICC public-private key pair, send the UICC public key to the third sending unit 2303, and send the UICC private key to the second storage unit 2306;
  • the third sending unit 2303 is further configured to send the UICC public key to the UICC.
  • the second storage unit 2306 is configured to save the UICC private key.
  • the universal integrated circuit card further includes: a service termination unit 2307;
  • the third receiving unit 2301 is further configured to receive a service termination request sent by the UICC management platform, where the service termination request carries the UICC identifier and the first carrier device is configured according to the first service The first message authentication code generated by the key, the service termination request is sent to the service termination unit 2307 and the third sending unit 2303;
  • the service termination unit 2307 is configured to terminate service interaction with the first carrier device when the first message authentication code is verified, and send a second sending to the third sending unit 2303.
  • the sending unit 2303 is further configured to: after receiving the second sending instruction, send a service termination execution response to the first operator equipment, where the service termination execution response carries the UICC identifier.
  • the receiving unit 2301 further receives the encrypted second service key and the second message authentication code corresponding to the UICC identifier sent by the UICC management platform, and the encrypted The second service key is sent to the decryption unit 2302;
  • the decrypting unit 2302 is further configured to: when the second packet authentication code passes, pass the UICC private key to decrypt the encrypted second service key, to obtain the first a second service key, the second service key is sent to the second service interaction unit 2304, and a third sending instruction is sent to the third sending unit 2303;
  • the second sending unit 2303 is further configured to: after receiving the third sending instruction, send an operator handover execution response to the second carrier device, where the operator switching execution response carries the UICC Identification
  • the second service interaction unit 2304 is configured to perform service interaction with the second operator device by using the second service key.
  • FIG. 24 is a schematic structural diagram of a user terminal according to the present invention. As shown in FIG. 24, the method includes: a third storage unit 2401 and a universal integrated circuit card UICC2402;
  • the third storage unit 2401, ⁇ stores the UICC 2402;
  • the UICC 2402 is configured to receive an encrypted first service key sent by the UICC management platform. Decrypting the encrypted first service key by using a pre-stored UICC private key corresponding to the uicc public key to obtain a first service key; sending a service activation execution response to the first carrier device, where the service is activated The execution response carries a pre-saved UICC identifier; the first service key is used to perform service interaction with the first carrier device.
  • the UICC management platform acquires the encrypted first one corresponding to the UICC identifier generated by the first carrier device according to the UICC identifier and the first carrier device identifier carried in the service provisioning request.
  • a service key after obtaining the encrypted first service key, the UICC decrypts the encrypted first service key by using a pre-stored UICC private key, and uses the first service key obtained after decryption.
  • the first carrier device performs business interaction.
  • the UICC management platform opens the first carrier device corresponding to the first carrier device identifier for the universal integrated circuit card according to the first carrier device identifier, because the first carrier device identifier is carried in the service provisioning request sent by the user.
  • the data configuration device solves the technical problem that the M2M terminal can only communicate with the predetermined operator in the prior art, and expands the scope of the M2M terminal; in addition, the method of the present invention is convenient to implement and convenient to popularize. .
  • FIG. 25 is a schematic structural diagram of a data configuration system of a universal integrated circuit card according to the present invention. As shown in FIG. 25, the system includes: a universal integrated circuit card UICC management platform 2501, a first carrier device 2502, and a UICC2503;
  • the UICC management platform 2501 is configured to receive a service provisioning request, where the service opening request includes a UICC identifier and a first carrier device identifier, and the first carrier device corresponding to the first carrier device identifier is
  • the 2502 sends a pre-stored UICC certificate corresponding to the UICC identifier, where the UICC certificate carries the UICC identifier and a UICC public key corresponding to the UICC identifier; and receives the message sent by the first carrier device 2502.
  • the UICC identifies the corresponding encrypted first service key, and sends the encrypted first service key to the first carrier device 2502 of the UICC for receiving the UICC management platform 2501.
  • the UICC certificate carrying the UICC identifier and the UICC public key
  • the first service key corresponding to the UICC identifier is generated according to a preset method, and the first service key is encrypted by using the UICC public key, and the UICC management platform 2501 is used by the UICC management platform 2501.
  • the encrypted first service key is sent to the UICC 2503 corresponding to the UICC identifier; and the service activation execution response sent by the UICC 2503 after the first service key is obtained, where the service activation response is carried
  • the UICC identifier saved in advance by the UICC; performing service interaction with the UICC 2503 by using the first service key;
  • the UICC 2503 is configured to receive the encrypted first service key sent by the UICC management platform 2501, and use the pre-stored UICC private key corresponding to the UICC public key to pair the encrypted first service key. Decrypting, obtaining the first service key; sending a service provisioning execution response to the first carrier device 2502, where the service provisioning execution response carries a pre-saved UICC identifier; using the first service key Performing business interaction with the first carrier device 2502.
  • the UICC management platform obtains the encrypted first one corresponding to the UICC identifier generated by the first carrier device according to the UICC identifier carried in the service provisioning request and the first carrier device identifier. a service key, the UICC decrypts the encrypted first service key using the pre-stored UICC private key after obtaining the encrypted first service key, so that the first service key obtained after decryption Perform business interaction with the first carrier device.
  • the UICC management platform opens the first carrier device corresponding to the first carrier device identifier for the universal integrated circuit card according to the first carrier device identifier, because the first carrier device identifier is carried in the service provisioning request sent by the user.
  • the data configuration system solves the technical problem that the M2M terminal can only communicate with the predetermined operator in the prior art, and expands the scope of the M2M terminal; in addition, the method of the present invention is convenient to implement and convenient to popularize. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)
  • Telephone Function (AREA)

Abstract

L'invention porte sur un procédé, un appareil et un système de configuration de données pour carte de circuit intégré universelle (UICC), un programme informatique et un support de stockage. Le procédé consiste à : recevoir une requête d'ouverture de service, un identificateur d'UICC et un identificateur de premier dispositif d'opérateur étant contenus dans la requête d'ouverture de service; envoyer un certificat d'UICC pré-stocké correspondant à l'identificateur d'UICC à un premier dispositif d'opérateur correspondant à l'identificateur de premier dispositif d'opérateur, l'identificateur d'UICC et une clé publique d'UICC étant contenus dans le certificat d'UICC; et recevoir une première clé de cryptage de service cryptée correspondant à l'identificateur d'UICC envoyée par le premier dispositif d'opérateur, et envoyer la première clé de cryptage de service cryptée à une UICC correspondant à l'identificateur d'UICC. Par comparaison à l'état antérieur de la technique, le procédé, l'appareil et le système de configuration de données pour carte de circuit intégré universelle, le programme informatique et le support de stockage proposés selon la présente invention peuvent configurer dynamiquement des données d'opérateur dans une carte de circuit intégré universelle dans un terminal M2M, étendant ainsi la plage d'utilisation de terminaux M2M.
PCT/CN2013/079364 2012-07-17 2013-07-15 Procédé, appareil et système de configuration de données pour carte de circuit intégré universelle, programme informatique et support de stockage WO2014012468A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210247048.3 2012-07-17
CN201210247048.3A CN103546886B (zh) 2012-07-17 2012-07-17 通用集成电路卡的数据配置方法、装置及***

Publications (1)

Publication Number Publication Date
WO2014012468A1 true WO2014012468A1 (fr) 2014-01-23

Family

ID=49948277

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/079364 WO2014012468A1 (fr) 2012-07-17 2013-07-15 Procédé, appareil et système de configuration de données pour carte de circuit intégré universelle, programme informatique et support de stockage

Country Status (2)

Country Link
CN (1) CN103546886B (fr)
WO (1) WO2014012468A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113795039A (zh) * 2021-09-23 2021-12-14 中交信通网络科技有限公司 运营商网络切换方法、装置、设备和计算机可读存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102250685B1 (ko) 2014-07-01 2021-05-12 삼성전자 주식회사 eUICC(embedded Universal Integrated Circuit Card)를 위한 프로파일 설치 방법 및 장치
KR102160597B1 (ko) * 2014-07-17 2020-09-28 삼성전자 주식회사 eUICC의 프로파일 설치 방법 및 장치
KR20160124648A (ko) * 2015-04-20 2016-10-28 삼성전자주식회사 프로파일 다운로드 및 설치 장치
ES2743576T3 (es) 2015-04-13 2020-02-19 Samsung Electronics Co Ltd Procedimiento y aparato de gestión de un perfil de un terminal en un sistema de comunicación inalámbrica
US10003974B2 (en) * 2015-06-19 2018-06-19 Apple Inc. Electronic subscriber identity module management under multiple certificate authorities
CN108112011A (zh) * 2016-11-24 2018-06-01 中国电信股份有限公司 远程管理嵌入式通用集成电路卡的方法、装置和***
ES2950192T3 (es) 2017-08-28 2023-10-05 Huawei Tech Co Ltd Método de verificación de información y dispositivo relacionado
CN113852957A (zh) * 2020-06-09 2021-12-28 ***通信有限公司研究院 安全服务器、sp服务器、终端、安全授权方法及***

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101005359A (zh) * 2006-01-18 2007-07-25 华为技术有限公司 一种实现终端设备间安全通信的方法及装置
US20090209232A1 (en) * 2007-10-05 2009-08-20 Interdigital Technology Corporation Techniques for secure channelization between uicc and a terminal
CN101765105A (zh) * 2009-12-17 2010-06-30 北京握奇数据***有限公司 实现通信加密的方法和***、移动终端
CN102209317A (zh) * 2010-03-29 2011-10-05 中兴通讯股份有限公司 提供签约数据的方法及***

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056149B (zh) * 2009-11-09 2015-01-28 中兴通讯股份有限公司 机器对机器设备及其处理方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101005359A (zh) * 2006-01-18 2007-07-25 华为技术有限公司 一种实现终端设备间安全通信的方法及装置
US20090209232A1 (en) * 2007-10-05 2009-08-20 Interdigital Technology Corporation Techniques for secure channelization between uicc and a terminal
CN101765105A (zh) * 2009-12-17 2010-06-30 北京握奇数据***有限公司 实现通信加密的方法和***、移动终端
CN102209317A (zh) * 2010-03-29 2011-10-05 中兴通讯股份有限公司 提供签约数据的方法及***

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113795039A (zh) * 2021-09-23 2021-12-14 中交信通网络科技有限公司 运营商网络切换方法、装置、设备和计算机可读存储介质
CN113795039B (zh) * 2021-09-23 2023-11-24 中交信通网络科技有限公司 运营商网络切换方法、装置、设备和计算机可读存储介质

Also Published As

Publication number Publication date
CN103546886B (zh) 2016-09-07
CN103546886A (zh) 2014-01-29

Similar Documents

Publication Publication Date Title
WO2014012468A1 (fr) Procédé, appareil et système de configuration de données pour carte de circuit intégré universelle, programme informatique et support de stockage
CN111052777B (zh) 支持无线通信***中设备间简档转移的方法和装置
US9621540B2 (en) Secure provisioning of computing devices for enterprise connectivity
JP6185152B2 (ja) サービスにアクセスする方法、アクセスするためのデバイスおよびシステム
US20190116046A1 (en) Privacy preserving tag
CN107006049A (zh) 一种智能设备及其建立设备间蓝牙连接的方法、装置
CN108762791A (zh) 固件升级方法及装置
EP4068834A1 (fr) Procédé de configuration de sécurité initiale, module de sécurité et terminal
CN105376059A (zh) 基于电子钥匙进行应用签名的方法和***
WO2020057314A1 (fr) Procédé, dispositif et système permettant d'émettre un certificat d'esim en ligne
TW201719476A (zh) 一種在設備之間進行授權的方法和裝置
KR20200028786A (ko) Ssp 단말과 서버가 디지털 인증서를 협의하는 방법 및 장치
CN101527714A (zh) 制证的方法、装置及***
CN104507130A (zh) 一种支持移动通信网络切换的sim卡及***
KR20190117302A (ko) eUICC 버전을 협상하는 방법 및 장치
CN104507072B (zh) 一种通信网络切换的方法
CN113613227B (zh) 蓝牙设备的数据传输方法和装置、存储介质及电子装置
WO2015186072A1 (fr) Chiffrement et déchiffrement de données entre un dispositif de communication et une carte intelligente ayant une fonction de communication en champ proche
CN114499990A (zh) 车辆控制方法、装置、设备及存储介质
WO2013160441A1 (fr) Procédé, serveur et système d'accès à un service
CN109756451B (zh) 一种信息交互方法及装置
CN105554759A (zh) 一种鉴权方法和鉴权***
KR101709276B1 (ko) 엔드 포인트 보안서버 관리 시스템
US11076282B2 (en) Telecommunications apparatus with a radio-linked smart card
CN110636491A (zh) 面向服务的可信执行模块及通信方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13819835

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13819835

Country of ref document: EP

Kind code of ref document: A1