Network locking method and apparatus for terminal

• US 8,903,361 B2
• Filed: 11/28/2012
• Issued: 12/02/2014
• Est. Priority Date: 12/20/2010
• Status: Active Grant

• Current Assignee: Huawei Device Company Limited (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Device Company Limited (Huawei Investment & Holding Co., Ltd.)
• Inventors: Weng, Haiyin
• Primary Examiner(s): Siddiqui, Kashif
• Assistant Examiner(s): TRAN, MONG-THUY THI
• Application Number:
  US13/687,941
• Publication Number:
  US 20130090091A1
• Time in Patent Office: 734 Days
• Field of Search: 455/411, 455/410, 455/418, 455/558, 726/9
• US Class Current: 455/411
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/48 using secure binding, e.g. securely binding identity modules to devices, services or applications
• CPC Class Codes: H04W 8/183 Processing at user equipment or user record carrier

Abstract

Embodiments of the present disclosure provide a network locking method and apparatus for a terminal. The method mainly includes: utilizing an IMSI number carried on a SIM card of the terminal to register the SIM card with a network, and obtaining a PLMN number of the network; comparing a PLMN number segment of the network with a valid PLMN number segment pre-stored on the terminal, and allowing or limiting, according to a comparison result, use of the SIM card by the terminal. According to the embodiments of the present disclosure, the SIM card is registered with the network by utilizing the IMSI number carried on the SIM card and a data card is verified in the terminal and network combined verification manner, which may ensure security of network locking for the terminal.

Claims

1. A network locking method for a terminal, comprising:

registering a subscriber identity module (SIM) card of the terminal with a network based on an international mobile subscriber identity (IMSI) number carried on the SIM card, obtaining a public land mobile network (PLMN) number of the network;

forming a valid PLMN number segment according to a first set digits of an IMSI number of at least one SIM card allowed to be used by the terminal, and storing the valid PLMN number segment on the terminal through codes;

obtaining the valid PLMN number segment pre-stored on the terminal by using the plurality of first digits of the IMSI number;

comparing the PLMN number of the network with the valid PLMN number segment pre-stored on the terminal and allowing or limiting, according to a comparison result, use of the SIM card by the terminal; and

performing security verification on the terminal after upgrading the terminal, wherein the security verification comprises;

calculating one Hash value according to multiple image files loaded on the board and forming a digital certificate according to the Hash value;

signing the digital certificate by using a private key of a preset pair of public and private keys and putting the signed digital certificate into a boot image file of the board; and

performing integrity verification on the digital certificate by using a public key of the preset pair of public and private keys, obtaining the Hash value in the digital certificate and comparing the Hash value with a pre-stored valid Hash value, wherein if the two are not consistent, it is determined that the board is insecure;

otherwise, it is determined that the board is secure.

2. The network locking method for the terminal according to claim 1, wherein the valid PLMN number segment is formed of first set digits of an IMSI number of one or multiple SIM cards allowed to be used by the terminal.

3. The network locking method for the terminal according to claim 1, wherein the comparing the PLMN number of the network with the pre-stored valid PLMN number segment and allowing or limiting, according to the comparison result, the use of the SIM card by the terminal comprises:

comparing the PLMN number of the network with the pre-stored valid PLMN number segment, wherein if the PLMN number of the network belongs to the stored valid PLMN number segment, it is determined that the SIM card is valid, and the use of the SIM card by the terminal is allowed;

otherwise, the use of the SIM card by the terminal is allowed or limited according to a state of registering the SIM card with the network.

4. The network locking method for the terminal according to claim 3, wherein the allowing or limiting, according to the state of registering the SIM card with the network, the use of the SIM card by the terminal comprises:

if the state of registering the SIM card with the network is roaming, reading the IMSI number from the SIM card, comparing the first set digits of the IMSI number with the pre-stored valid PLMN number segment and determining whether the first set digits of the IMSI number belong to the stored valid PLMN number segment, wherein if yes, it is determined that the SIM card is valid and, the use of the SIM card by the terminal is allowed;

otherwise, it is determined that the SIM card is invalid, and the use of the SIM card by the terminal is limited.

5. A network locking apparatus for a terminal, comprising:

a registration network public land mobile network (PLMN) number obtaining module implemented by a processor, configured to register a subscriber identity module (SIM) card of the terminal with a network based on an international mobile subscriber identity (IMSI) number carried on the SIM card, obtain a PLMN number of the network, and obtain a valid PLMN number segment pre-stored on the terminal by using the IMSI number; and

a SIM card verification processing module implemented by the processor, configured to compare a PLMN number segment of the network with the valid PLMN number segment pre-stored on the terminal, and allow or limit, according to a comparison result, use of the SIM card by the terminal;

a valid PLMN number segment storing module, configured to form the valid PLMN number segment according to first set digits of an IMSI number of at least one SIM cards allowed to be used by the terminal, and store the valid PLMN number segment on a board inside the terminal through codes; and

a board verifying module, configured to perform security verification on the board after upgrading of the board is completed, wherein the security verification comprises;

calculating one Hash value according to multiple image files loaded on the board and forming a digital certificate according to the Hash value;

signing the digital certificate by using a private key of a preset pair of public and private keys and putting the signed digital certificate into a boot image file of the board; and

performing integrity verification on the digital certificate by using a public key of the preset pair of public and private keys, obtaining the Hash value in the digital certificate and comparing the Hash value with a pre-stored valid Hash value, wherein if the two are not consistent, it is determined that the board is insecure;

otherwise, it is determined that the board is secure.

6. The network locking apparatus for the terminal according to claim 5, wherein the SIM card verification processing module comprises:

a determination module, configured to compare the PLMN number of the network with the pre-stored valid PLMN number segment, and judge whether the PLMN number of the network belongs to the stored valid PLMN number segment; and

an allowing or limiting module, configured to, when a determination result of the determination module is yes, determine that the SIM card is valid and allow the use of the SIM card by the terminal;

otherwise, allow or limit, according to a state of registering the SIM card with the network, the use of the SIM card by the terminal.

7. The network locking apparatus for the terminal according to claim 6, wherein allowing or limiting module is further configured to, if the state of registering the SIM card with the network is roaming, read the IMSI number from the SIM card, compare the first set digits of the IMSI number with the pre-stored valid PLMN number segment and judge whether the first set digits of the IMSI number belong to the stored valid PLMN number segment, wherein if yes, it is determined that the SIM card is secure, and the use of the SIM card by the terminal is allowed;

otherwise, it is determined that the SIM card is invalid, and the use of the SIM card by the terminal is limited.