WO2012106878A1

WO2012106878A1 - Information security processing method and device

Info

Publication number: WO2012106878A1
Application number: PCT/CN2011/076998
Authority: WO
Inventors: 马涛
Original assignee: 华为技术有限公司
Priority date: 2011-07-08
Filing date: 2011-07-08
Publication date: 2012-08-16
Also published as: CN102301381A

Abstract

Provided are an information security processing method and device. The method includes: storing the device feature code or the variation code thereof in the one-time write-in region of the chip of a device so as to establish a locking relationship between the device and the device feature code; and checking the locking relationship between the device and the device feature code, wherein when it is found that the device feature code or the variation code thereof does not accord with the device, the device cannot work normally, or when it is found that the device feature code or the variation code thereof accords with the device, the device works normally. By way of the solution mentioned above, the device feature code or the variation code thereof can be stored in the one-time write-in region of the chip of the device, thus realizing an information security processing function with a high security level, effectively preventing illegal users from copying or stealing numbers and protecting the interests of manufacturers, operators and users.

Description

Method and device for information security processing

The present invention relates to the field of communication technologies, and more particularly to a method and apparatus for information security processing. Background technique

Smart Card or IC Card, which widely uses chip identification information, covers communications, financial finance, social insurance, transportation, hospitality, health care, government administration, merchandising, entertainment, school management, and other fields. . The use of smart cards or IC cards brings great convenience to people.

Smart cards or IC cards in this area store some confidential data, which is required to be illegally altered. The confidential data described here is different from the user private data. The confidential data is set by the manufacturer or the operator to ensure the interests of the manufacturer, the operator and the user, but the user does not have the authority to modify and shield the data. . Therefore, the device needs to provide a method to ensure the security of the confidential data, and it is necessary to consider the legal authorization modification while ensuring data security. However, some illegal users have made damage to the interests of manufacturers, operators and users by modifying the tomb, stealing and copying the confidential data on the smart card or IC card for the copying or hacking of the smart card or IC card. Therefore, the existing information security processing method has a low security level and is easily copied or hacked by illegal users. Summary of the invention

The invention provides a method and device for information security processing, which can realize a high security level information security processing function.

In one aspect, a method for information security processing is provided, the method comprising: storing a device code of a device or a code of a device feature code in a write-once area of a chip of the device to establish a lock between the device and the device feature code Relationship, wherein the change code of the device feature code is a part of the device feature code, the device feature code processed by the algorithm, a part of the device feature code processed by the algorithm, a part of the device feature code processed by the algorithm, and a part of the device feature code processed by the algorithm Or a part of a part of the device feature code processed by the algorithm; checking the locking relationship between the device and the device feature code, when it is verified that the device code or the device code change code does not match the device, the device does not work normally, or When it is verified that the change code of the device feature code or the device feature code matches the device, the device is normally working. Work.

In another aspect, an apparatus for information security processing is provided, the apparatus comprising a first storage unit and a verification unit, wherein the first storage unit is configured to store a device signature or a device signature in a write-once area of a chip of the device a change code to establish a locking relationship between the device and the device feature code, wherein the device code change code is a part of the device feature code, the algorithm processed device feature code, a part of the device processed feature code processed by the algorithm, and processed by the algorithm a portion of the device signature, a portion of the algorithm-processed device signature or a portion of the algorithm-processed portion of the device signature; the verification unit is configured to verify the locking relationship between the device and the device signature, when the device signature is verified or When the change code of the device feature code does not match the device, the device does not work normally, or when it is verified that the device code or the device code change code matches the device, the device works normally.

Through the above solution, the device signature code or the device signature code change code can be stored in the write-once area of the chip of the device, thereby realizing a high security level information security processing function, effectively preventing illegal users from copying or hacking, and protecting the manufacturer. , the interests of operators and users. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments of the present invention will be briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. Other drawings may also be obtained from those of ordinary skill in the art in view of the drawings.

1 is a flow chart of a method of information security processing in accordance with an embodiment of the present invention.

2 is a schematic diagram of an example of a method of information security processing according to an embodiment of the present invention. 3 is a schematic diagram of another example of a method of information security processing according to an embodiment of the present invention. 4 is a block diagram of an apparatus for information security processing in accordance with an embodiment of the present invention.

Figure 5 is a block diagram of an apparatus for information security processing in accordance with another embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without making creative labor are within the scope of the present invention.

1 is a flow chart of a method 10 of information security processing in accordance with an embodiment of the present invention. 11 is a change code of a device feature code or a device feature code in a write-once area of a chip of the device to establish a locking relationship between the device and the device feature code, wherein the device code change code is a part of the device A feature code, an algorithm-processed device feature code, a portion of the device-processed feature code processed by the algorithm, a portion of the algorithm-processed device feature code, or a portion of the algorithm-processed portion of the device feature code.

The write-once area of the chip of the device can be a one-time programmable non-volatile memory module, such as an electrical fuse (Electrical Fuse, EFUSE). In the write-once area storage device signature or the change code of the device signature, the hardware correspondence relationship between the chip and the device signature or the change code of the device signature is established.

The device feature code may be a card number of various smart cards or IC cards. In view of different application fields of the smart card or the IC card, for example, an International Mobile Equipment Identity (IMEI), a user identity module SIM card number , bank card number, traffic card number, social security card number, ID card number, driving 3 history card number or medical insurance card number.

Wherein, all device feature codes can be stored in the write-once area of the chip of the device. In addition, the change code of the device signature can be stored due to the limited storage space of the chip or to further increase the security performance. For example: a portion of the device feature code, the algorithm-processed device feature code, a portion of the device-processed feature code processed by the algorithm, a portion of the algorithm-processed device feature code, or a portion of a portion of the device feature code processed by the algorithm.

Algorithm processing involves processing using a hash algorithm or its derived algorithm.

12, the locking relationship between the verification device and the device signature, when it is verified that the device signature or the device signature does not match the device, the device does not work normally, or when the device signature or device is verified When the change code of the signature matches the device, the device works normally.

When the device is in operation, the locking relationship between the device and the device signature is verified. If it is verified that the device signature stored in the chip does not match the device, the device does not work properly. The device feature code referred to herein does not match the device. The device feature code does not match the chip of the device. For example, if the device is replaced with a chip, or the device signature stored in the chip or the code of the device signature is changed by the tomb, the locking relationship between the device and the device signature will be broken. If the test passes, the device will work properly.

Through the above solution, the device signature code or the device code change code can be stored in the write-once area of the chip of the device to establish a locking relationship between the device and the device feature code, thereby realizing high-security information security processing. , effectively protect the interests of producers, operators and users.

As a marketing tool, a communication carrier sells a designated terminal at a preferential price or service, and Specify the service period for this terminal. The operator needs to activate the lock card function (called SimLock) for the terminal that adopts its subsidy. Specifically, it is to lock the subsidized terminal. In this case, only the operator identity module (Subscriber Identity Module) is called the SIM card. ) can be used on this terminal.

When the service period arrives, these terminals need to be unlocked. SimLock is released.

The terminal after SimLock can recognize any SIM card, including SIM cards from other operators. In some regions, such as the European Union, the unlocking of the SIM card after the lock-up period expires is a function required by law.

The existing terminal lock card function is poor in security, and the terminal is easily unlocked during the service period, and other services are used, which causes loss to the original operator's interests. When the terminal software version is upgraded in order to release SimLock, the operator needs to generate different versions, so that the terminal can re-upgrade the software version, resulting in a large workload for the operator.

In the data field of the communication field, it is mainly used for theft prevention of the terminal, and it can not be used even if the SIM card is replaced after the terminal is lost. The protection of the interests of operators and users is a prerequisite for ensuring the lock function of the terminal products. When the IMEI of the terminal is stolen, copied or altered, or the terminal is illegally copied, it will also cause losses to the interests of the manufacturer, the operator and the user. In conjunction with method 10, the present invention provides another method of information security processing.

2 is a schematic diagram of an example 20 of a method of information security processing in accordance with an embodiment of the present invention. The embodiment of the present invention is described by taking a terminal in the mobile communication technology as an example, but the apparatus that can perform the example 20 in the embodiment of the present invention is not limited thereto.

21 of FIG. 2 is similar to 11 of FIG. 1, storing a device code of a feature code or a device feature code in a write-once area of a chip of the device to establish a locking relationship between the device and the device feature code, wherein the device feature code The change code is a portion of the device feature code, the algorithm-processed device feature code, a portion of the device-processed feature code processed by the algorithm, a portion of the algorithm-processed device feature code, or a portion of the algorithm-processed portion of the device feature code.

IMEI is an abbreviation of International Mobile Equipment Identity Code. It is an "electronic serial number" consisting of 15 digits, which corresponds to each terminal, and the code is unique worldwide. The IMEI is the device feature code of the terminal. Each terminal will be assigned a globally unique set of numbers after assembly, and this number will be recorded by the manufacturer of the manufacturing from production to delivery.

IMEI is a 15-digit value whose structure is TAC (6 digits) + FAC (two digits) + SNR (6 digits) + SP (1 digit). Among them, the equipment type approval number (TAC) is assigned by the European model certification center. Factory assembly code (FAC) is coded by the manufacturer, usually indicating the manufacturer Home and its assembly site. The serial number (SNR) is also assigned by the manufacturer to identify the specific device in each TAC and FAC. SP spare code, used for backup.

When manufacturing the terminal, in the Customer Information Setting (CS) station, write the operator to develop information, that is, in the write-once area of the terminal, such as the chip's electric fuse (Electrical Fuse) Store full IMEI information. EFUSE is a one-time programmable non-volatile memory module.

At this time, the IMEI is stored in the chip EFUSE, thus establishing the hardware correspondence between the chip and the IMEI, and implementing the binding processing.

According to the composition of IMEI, the SNR of each mobile phone is different. It can be seen that the most meaningful for a batch of shipments is the SNR field, with a value range of 0-1,000,000. The SNR is converted to hexadecimal, which is expressed as follows.

1000000=0xF4240

HEX(SNR)->OxAAAAA (20 bits total)

As another embodiment of the present invention, since the chip EFUSE field is limited, a part of the IMEI information, for example, hexadecimal IMEI (OxAAAAA) corresponding to each terminal SNR, may be stored in the chip EFUSE.

As another embodiment of the present invention, all or a part of the IMEI information (for example, SNR) may be processed by a hash (HASH) algorithm or a hash algorithm, and the processed value is stored as a change code on the chip EFUSE. Or, a part of the value obtained after the processing is stored as a change code in the chip EFUSE.

22, in FIG. 2, generates a lock card key parameter carrying the lock card identification information, and the lock card key parameter is stored in a non-volatile parameter, file or database set in the non-malidata data area.

The lock card identification information indicates that the device is a lock card device, and when the device is successfully unlocked, the lock card identification information is replaced by the decrypted information. The decryption information is generated by performing an encryption algorithm using a device signature or a variation code of the device signature.

The encryption and decryption algorithm can adopt a security algorithm, such as Message Digest Alogorithm (MD9). The MD9 algorithm generates a unique corresponding decryption information for each IMEI, and the generated decoding information is 8 bytes. When the terminal is in production, an encryption server is configured. At the CS station of the production line, each IMEI is read by the MD9 algorithm, and corresponding decryption information is generated and stored on the encryption server. When the manufacturer provides the terminal to the operator, a database including the IMEI and the corresponding decryption information is simultaneously provided. As an embodiment of the present invention, the encryption may also employ an asymmetric encryption and decryption algorithm. The RSA algorithm is a kind of asymmetric encryption and decryption algorithm. The following uses the RSA algorithm as an example to expand the description.

RSA algorithm encryption is performed by using a pair of 1024-bit, 128-byte public key (Key-Public) and private key (Key-Private).

The RSA algorithm encryption step is divided into the following two steps.

1) The data to be encrypted C is a linear transformation of A (IMEI of the terminal) and B (Key-Public, public key), and the length is 128 bytes. C = fl(A, B)

2) D=Encrypt(Key-Private, C), through the RSA algorithm, encrypts the data C with Key-Private to obtain the decrypted information D. The decryption information D is used to unlock the terminal lock function, and the length is 128 bytes.

A may also be a change code of IMEI as mentioned in the previous embodiment, such as SNR in IMEI. Taking the terminal in the communication field as an example, the non-volatile value (NV) of the terminal's SimLock includes: The lock status parameter (the cartridge is called CardlockStatus) is used to save whether to support SimLock (lock card function) ( For example, the default value of 2 means that the lock card function is turned off, and 1 means that the lock card function is turned on. The lock card service parameter (CustomizeSimLockPlmnlnfo) is used to configure the start address of the Public Land Mobility Network (PLMN) that needs to be locked. Currently, the lock card function of multiple PLMN segments is supported. For example, for a specific operator, you can lock the group 135820xxxxx, which means that the number segment at the beginning of 135820 is locked, or 135831xxxxx means that the number segment at the beginning of 135831 is locked.

The SIMLock-related content CardlockStatus, CustomizeSimLockPlmnlnfo is saved as confidential data. The confidential data is set by the manufacturer or operator to ensure the interests of the manufacturer, operator and user, but the user does not have the authority to modify and shield the data. When the terminal locks the card, CardlockStatus is set to 1 and CustomizeSimLockPlmnlnfo fills in the PLMN number segment that needs to be locked.

Before the device leaves the factory, the terminal stores the lock card identification information to indicate that the device is a lock card terminal. The terminal generates a parameter: the lock card key parameter (the cartridge is called CardLockKey) to carry the lock card identification information. The lock key parameter storage method includes NV, file or database stored in the non-malidata data area, and the size can be reserved according to different encryption and decryption technologies, for example, 8 bytes or 128 bytes, when the SimLock is released. To save the corresponding decryption information of this IMEI. Users can modify or functionally block data on non-critical data areas.

When the operator needs to open the terminal with the lock function, in the lock terminal, CardlockStatus Set to 1, CustomizeSimLockPlmnlnfo to fill in the PLMN number segment that needs to be locked. Also set the CardLockKey to the default value. This default value is also the lock card identification information, for example, an 8-bit full F or a 128-byte full F. The values herein are for illustrative purposes only and may be any other values.

When the operator needs to close the terminal of the lock card function, CardlockStatus is set to 2 in the non-locked card terminal, and CustomizeSimLockPlmnlnfo does not need to be set. Also set the CardLockKey to all F (all bytes of 8 bytes or all F of 128 bytes).

When the manufacturer provides the terminal to the operator, the database including the IMEI and the corresponding decrypted information is simultaneously provided to the operator (the contents of the database include the C and D data of each terminal). When the manufacturer provides the device lock device terminal product to the operator, the database including the IMEI and the corresponding decryption is simultaneously provided to the operator (the content of the database includes the C and D data of each terminal), so that the decryption information is used when the SimLock is released. D replaces the lock card identification information (128 bytes of full F).

23 of FIG. 2 is similar to 12 of FIG. 1, and the locking relationship between the device and the device feature code is verified. When it is checked that the device code or the device code does not match the device, the device does not work normally, or when the device is inspected. When the change code of the device feature code or the device feature code matches the device, the device works normally.

When the terminal is working, the locking relationship between the device and the device signature is checked. If it is verified that the IMEI stored in the chip does not match the chip, the terminal does not work normally. For example, if the device replaces the change code of the IMEI or IMEI stored in the chip or chip, it will destroy the locking relationship between the chip and the IMEI. If the test passes, the terminal can work normally.

At 24 of Fig. 2, decryption information is acquired and a decryption algorithm is executed based on the decrypted information.

When the operator needs to release the SimLock to the user's terminal, the operator obtains the data C of the terminal (including the IMEI and the public key information, and the operator determines whether the user meets the condition for releasing the SimLock) through the web application (Web UI) of the user interface. At this time, the operator searches the database, obtains the decryption information D (128 bytes) corresponding to the IMEI of the user, and uses the file to be decrypted, for example, by means of mail, data copy, or the like.

Based on the encryption and decryption technology, short decryption information can be printed out, which is convenient for users to carry. Long decryption information can be output in the form of electronic files for use in releasing SimLock.

The terminal can acquire the decrypted information D through user input and execute a decryption algorithm.

The RSA algorithm decryption steps are as follows:

Decryption processing: C=Decrypt(Key-public, D), using RSA algorithm, using Key-public Decrypting the decrypted information D to obtain data (. If the decryption is successful, the terminal can work according to the non-locking card terminal; if the decryption fails, the terminal can still work according to the lock card terminal.

25 of FIG. 2, when the decryption algorithm is successfully executed according to the decrypted information, the decrypted information is stored to replace the lock card identification information carried by the lock key parameter.

If the decryption is successful, CardLockKey stores the decryption information D. In this way, each time the user turns on the computer, the CardLockKey can be used to release the SimLock. The terminal is processed by the non-locking card terminal, and the operator no longer needs to uninstall the SIMLock for different terminals to upgrade the software version.

If the decrypted information D input by the user is decrypted by the public key, the result is not equal to C, then the SimLock failure is cancelled, and D is not required to be written into the CardLockKey, and the terminal is processed by the lock card terminal.

Through the above scheme, the device signature or the device signature change code can be stored in the write-once area of the chip of the device to establish a locking relationship between the device and the device signature, and use the device signature or the device signature change. The code performs the encryption and decryption algorithm, thereby realizing the high security level information security processing, effectively protecting the interests of the manufacturer, the operator and the user, and when the device lock function is released, the cartridge is easy to operate, reducing the workload of the operator. .

3 is a schematic diagram of an example 300 of a method of information security processing in accordance with an embodiment of the present invention. The embodiment of the present invention takes a terminal in the communication field as an example.

In Figure 3, 301, the terminal is powered on.

In 302 of Figure 3, the terminal performs a hardware secure boot (Boot) scheme for booting. First boot from the Onchipprom image of the chip. The program in the Onchiprom image cannot be modified. Onchiprom image verification Bootload image correctness, Bootload image verification Bootrom image and Vxworks.bin image security. The Vxworks.bin image verification machine requires data security. Ensure that the image and confidential data have not been illegally modified through a layer-by-layer security check. The image represents a binary code module that can be run after compilation

If the verification fails, that is, the "failure" of 302 in Fig. 3, proceed to 304 in Fig. 3, the code stops running, and the user is prompted for the cause of the error.

If passed, that is, "pass" of 302 of Fig. 3, proceed to 303 of Fig. 3.

In Figure 3, 303, when the Vxworks.bin image is run, the IMEI and the chip's EFUSE value are first verified.

If the verification fails, that is, the "failure" of 303 in Fig. 3, it indicates that the terminal IMEI may be modified by the user, the startup fails, and the user is prompted for the failure, and proceeds to 304 of FIG.

If the check passes, that is, "pass" of 303 of Fig. 3, it proceeds to 305 of Fig. 3. Figure 305, then verify the SimLock feature, the code first looks at CardlockStatus. If CardlockStatus=2, that is, "No" of 305 in Figure 3, indicating that the lock card function is off, then the terminal is a terminal without a lock card, and the terminal is handled as a non-lock card terminal, proceeding to Figure 3

306.

If CardlockStatus=l, that is, YES of 305 in Fig. 3, it means that the lock card function is turned on, and the terminal is considered to be the lock card terminal, and proceeds to 307 of Fig. 3.

In Figure 3, 307, the CardLockKey value is determined (to determine if the SimLock function has been removed).

If the value of CardLockKey is found to be all F, that is, YES of 307 in Fig. 3, it is finally determined that the terminal is the terminal that has the function of unlocking the card, and proceeds to 308 of Fig. 3, and is processed by the card terminal.

If it is found that CardLockKey is not all F, that is, "No" of 307 in Fig. 3, proceed to 309 of Fig. 3, and directly use the CardLockKey content for decryption verification.

If the check is passed, it indicates that the terminal at this time is the terminal after the SimLock is released, and the terminal is handled as a non-locked card terminal, and proceeds to 306 of FIG.

If the verification fails, the SimLock failure is cancelled and the user is prompted for the failure. The process proceeds to 308 of Figure 3, and the card terminal is processed.

According to the embodiment of the present invention, through layer verification, high-security information security processing can be realized, and the interests of manufacturers, operators, and users are effectively protected, and when the device lock function is released, the cartridge is easy to implement, and the reduction is reduced. The workload of the operator.

4 is a block diagram of an apparatus 40 for information security processing in accordance with an embodiment of the present invention.

The device 40 includes a first storage unit 41 and an inspection unit 42.

The first storage unit 41 stores the change code of the device feature code or the device feature code in the write-once area of the chip of the device to establish a locking relationship between the device and the device feature code, wherein the change code of the device feature code is a part of the device. A feature code, an algorithm-processed device feature code, a portion of the device-processed feature code processed by the algorithm, a portion of the algorithm-processed device feature code, or a portion of the algorithm-processed portion of the device feature code.

The device feature code may be a card number of various smart cards or IC cards, in view of being a smart card or an IC card Different application fields, such as International Mobile Equipment Identity (IMEI), User Identity Module SIM Card Number, Bank Card Number, Traffic Card Number, Social Security Card Number, ID Card Number, Driving History Certificate number or medical insurance card number, etc.

All device signatures can be stored. In addition, since the storage space of the chip is limited, or to further increase the security performance, the change code of the device signature can be stored. For example: a portion of the device feature code, the algorithm-processed device feature code, a portion of the device-processed feature code, a portion of the algorithm-processed device feature code, or a portion of the algorithm-processed portion of the device feature code.

The checking unit 42 checks the locking relationship between the device and the device feature code. When it is checked that the device code or the device code does not match the device, the device does not work normally, or when the device feature code or device feature code is verified. When the change code matches the device, the device works normally.

Figure 5 is a block diagram of an apparatus 50 for information security processing in accordance with another embodiment of the present invention.

The first storage unit 51 and the verification unit 52 of the apparatus 50 are the same as or similar to the first storage unit 41 and the inspection unit 42 of the apparatus 40, respectively. The difference is that the apparatus 50 further includes: a generating unit 53, a decrypting unit 54, and a second storing unit 55.

The generating unit 53 is configured to generate a lock card key parameter carrying the lock card identification information, and the lock card key parameter is stored in a non-volatile parameter, file or database set in the non-malidata data area.

The decryption unit 54 is for acquiring decryption information and executing a decryption algorithm based on the decryption information.

The second storage unit 55 is configured to store the decryption information in place of the lock card identification information carried by the lock key parameter when the decryption algorithm is successfully executed according to the decryption information. The device 50 implements the method 10, the example 20, and the example 300. For details, refer to the method 10 and the example 20 and the example 300, and details are not described herein again.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in a combination of electronic hardware or computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

It will be apparent to those skilled in the art that, for the convenience of the description and the cleaning process, the specific operation of the system, the device and the unit described above may be referred to the corresponding processes in the foregoing method embodiments, and details are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the present invention The technical solution may be embodied in the form of a software product in essence or in part of the prior art, the computer software product being stored in a storage medium, including a plurality of instructions for causing one The computer device (which may be a personal computer, server, or network device, etc.) performs all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. .

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

A method for information security processing, the method comprising:

A device code or a device code change code is stored in a write-once area of the chip of the device to establish a locking relationship between the device and the device feature code, wherein

The change code of the device feature code is a part of the device feature code, the device feature code processed by the algorithm, a part of the device feature code processed by the algorithm, a part of the device feature code processed by the algorithm or Part of the device feature code processed by the algorithm;

Verifying a locking relationship between the device and the device feature code, when the device detects that the device code or the device code does not match the device, the device does not work normally; or when the device is verified When the change code of the feature code or the device feature code matches the device, the device operates normally.

2. The method according to claim 1, wherein the one-time write area storage of the chip of the device comprises:

Stored in the electrical fuse EFUSE of the chip of the device.

The method according to claim 1, wherein the device feature code processed by the algorithm, a part of the device feature code processed by an algorithm, a part of the device feature code processed by an algorithm or Part of the apparatus feature code processed by the algorithm comprises: the device feature code processed by a hash algorithm or a derivative algorithm of a hash algorithm, or a part of the processing by a hash algorithm or a hash algorithm a device feature code, or a portion of the device feature code processed by a hash algorithm or a hash algorithm derived algorithm, or a portion of the device feature code processed by a hash algorithm or a hash algorithm derived algorithm.

The method according to claim 1, wherein the device feature code comprises: an international mobile device identity code IMEI, a user identity module SIM card number, a bank card number, a traffic card number, a social security card number, an ID card Number, driving 3 history card number or medical insurance card number.

5. The method of claim 4, wherein:

When the device feature code is an international mobile device identity code IMEI, the change code of the device feature code is the sequence number SNR in the international mobile device identity code IMEI.

The method according to any one of claims 1 to 5, wherein the method further comprises:

Generating a lock card key parameter carrying the lock card identification information, and storing the lock card key parameter The non-volatile parameter, file or database set in the non-critical data area, wherein the lock card identification information indicates that the device is a lock card device, and the lock card identification information is successful when the device releases the lock card successfully. Replaced by decrypted information,

The decryption information is generated by performing an encryption algorithm using the device signature or the change code of the device signature.

The method according to claim 6, wherein the method further comprises: acquiring the decryption information and executing a decryption algorithm according to the decryption information;

When the decryption algorithm is successfully executed according to the decryption information, the decryption information is stored to replace the lock card identification information carried by the lock card key parameter.

The method according to claim 6 or 7, wherein the encryption algorithm or the decryption algorithm comprises:

Asymmetric encryption and decryption algorithm or message digest algorithm ninth edition.

9. An apparatus for information security processing, the apparatus comprising:

a first storage unit, configured to store a change code of the device feature code or the device feature code in the write-once area of the chip of the device, to establish a locking relationship between the device and the device feature code, where

a verification unit, configured to check a locking relationship between the device and the device feature code, if it is verified that the device code or the device code change code does not match the device, the terminal cannot work normally, if the check is The change code of the device feature code or the device feature code is consistent with the device, and the terminal works normally.

10. Apparatus according to claim 9 wherein:

The first storage unit is specifically configured to store a device feature code or a change code of the device feature code in the electrical fuse EFUSE of the chip of the device.

The device according to claim 9, wherein the device feature code processed by the algorithm, a part of the device feature code processed by an algorithm, a part of the device feature code processed by an algorithm or Part of the apparatus feature code processed by the algorithm comprises: the device feature code processed by a hash algorithm or a derivative algorithm of a hash algorithm, or a part of the processing by a hash algorithm or a hash algorithm Device signature, or A portion of the device signature code processed by a hash algorithm or a hash algorithm derived algorithm, or a portion of the device signature code processed by a hash algorithm or a hash algorithm derived algorithm.

The device according to claim 9, wherein the device feature code comprises: an international mobile device identity code IMEI, a user identity module SIM card number, a bank card number, a traffic card number, a social security card number, and an ID card. Number, driving 3 history card number or medical insurance card number.

13. Apparatus according to claim 12 wherein:

14. Apparatus according to any one of claims 9-13, wherein the apparatus further comprises:

a generating unit, configured to generate a lock card key parameter carrying the lock card identification information, where the lock card key parameter is stored in a non-volatile parameter, a file or a database set in the non-malidata data area, where

The lock card identification information indicates that the device is a lock card device, and when the device is successfully unlocked, the lock card identification information is replaced by the decrypted information.

The device according to claim 14, wherein the device further comprises: a decrypting unit, configured to acquire the decrypted information and execute a decryption algorithm according to the decrypted information; and a second storage unit, configured to When the decryption information is successful, the decryption information is stored to replace the lock card identification information carried by the lock card key parameter.

The device according to claim 14 or 15, wherein the encryption algorithm or the decryption algorithm comprises: