Provisioning method and terminal device
The present disclosure provides a provisioning method and a terminal device. The provisioning method is applied to the terminal device, including: the security module establishes a secure channel with the certificate authority CA server through one or more session keys shared by the security module and the CA server; and obtains one or more digital certificates from the CA server; wherein, the security module is to implement Universal Subscriber Identity Module (USIM) functions.
1. A provisioning method, applied to a terminal device, the method comprising:
establishing, by a security module, a secure channel with a Pseudonym Certificate Authority (PCA) server through one or more session keys shared by the security module and the PCA server;
signing, by the security module, one or more Pseudonym Certificate (PC) application messages with one or more private keys of one or more Enrollment Certificates (ECs); and
obtaining, by the security module, one or more PCs from the PCA server according to the one or more PC application messages;
wherein after obtaining the one or more PCs from the PCA sever, the method further comprises:
signing, by the security module, one or more messages transmitted directly on PC5 interface with one or more private keys of the one or more PCs; and
sending the signed one or more messages to other devices; and
wherein the security module is to implement Universal Subscriber Identity Module (USIM) functions.
2. The provisioning method of claim 1 , wherein obtaining the one or more PCs from the PCA server comprises:
receiving one or more feedback messages sent by the PCA server;
verifying one or more signatures of the received one or more feedback messages with one or more public keys of the PCA server; and
obtaining the one or more PCs.
3. The provisioning method of claim 1 , wherein obtaining the one or more PCs from the PCA sever comprises:
sending, by the security module, the one or more PCs to a Hardware Security Module (HSM); and
storing, by the HSM, the one or more PCs.
4. The provisioning method of claim 3 , wherein obtaining the one or more PCs from the PCA sever further comprises:
generating, by the HSM, one or more public and private key pairs for applying for the one or more PCs;
sending, by the HSM, the one or more public keys for applying for the one or more PCs to the security module; and
obtaining, by the security module, the one or more PCs from the PCA server with the one or more public keys.
5. A terminal device, comprising a transceiver and a processor; the processor is configured to control a security module to:
establish a secure channel with a Pseudonym Certificate Authority (PCA) server through one or more session keys shared by the security module and the PCA server;
sign one or more Pseudonym Certificate (PC) application messages with one or more private keys of one or more Enrollment Certificates (ECs); and
obtain one or more PCs from the PCA server according to the one or more PC application messages;
wherein after obtaining the one or more PCs from the PCA sever, the processor is further configured to control the security module to:
sign one or more messages transmitted directly on PC5 interface with one or more private keys of the one or more PCs; and
send the signed one or more messages to other devices; and
wherein the security module is to implement Universal Subscriber Identity Module (USIM) functions.
6. The terminal device of claim 5 , wherein in order to obtain the one or more PCs from the PCA server, the processor is configured to control the security module to:
receive one or more feedback messages sent by the PCA server;
verify a signature of the received one or more feedback messages with one or more public keys of the PCA server; and
obtain the one or more PCs.
7. The terminal device of claim 5 , wherein in order to obtain the one or more PCs from the PCA sever, the processor is further configured to:
control the security module to send the one or more PCs to a Hardware Security Module (HSM); and
control the HSM to store the one or more PCs.
8. The terminal device of claim 7 , wherein in order to obtain the one or more PCs from the PCA sever, the processor is further configured to:
control the HSM to generate one or more public and private key pairs for applying for the one or more PCs;
control the HSM to send the one or more public keys for applying for the one or more PCs to the security module; and
control the security module to obtain the one or more PCs from the PCA server with the one or more public keys.
9. The terminal device of claim 7 , wherein in order to obtain the one or more PCs from the PCA sever, the processor is further configured to control the security module to:
sign one or more messages transmitted directly on PC5 interface with the one or more private keys of the one or more PCs; and
send the signed one or more messages to other devices.