技术领域technical field
本发明实施例涉及通信技术领域，尤其涉及一种提升可信执行环境安全性的方法、系统及终端。Embodiments of the present invention relate to the field of communication technologies, and in particular, to a method, system, and terminal for enhancing the security of a trusted execution environment.
背景技术Background technique
随着移动网络和智能终端的高速发展以及消费电子产品智能化的普及，移动应用的种类和数量越来越多。当前的移动应用已经不仅限于对智能终端的基本功能、娱乐功能方面的扩展，它所涉及的领域逐渐扩大到各行各业，例如：移动支付相关的金融应用、内容版权保护应用以及云计算下瘦终端的安全应用等，这些行业应用都需要更高安全级别的终端运行环境。With the rapid development of mobile networks and smart terminals and the popularization of intelligent consumer electronics products, the types and quantities of mobile applications are increasing. The current mobile applications are not limited to the expansion of the basic functions and entertainment functions of smart terminals. Terminal security applications, etc. These industry applications require a terminal operating environment with a higher security level.
然而，智能终端的操作系统本身的设计主要侧重于功能性方面要求，并非从安全性角度出发，同时加上整个系统的开放性、庞大性、复杂性而无法杜绝相应的系统漏洞，致使一些利用这些漏洞的恶意程序不断出现，从而造成应用程序处于危险之中。虽然可以利用一些软件防护手段，如防火墙、杀毒软件等进行相应的保护，但由于新型病毒程序的层出不穷以及经常性的系统更新升级，导致无法做到软件上的完全保护。However, the design of the operating system of the smart terminal is mainly focused on functional requirements, not from the perspective of security. At the same time, due to the openness, complexity, and complexity of the entire system, it is impossible to eliminate the corresponding system loopholes, resulting in some exploits Malicious programs with these vulnerabilities continue to emerge, putting applications at risk. Although some software protection methods, such as firewalls and anti-virus software, can be used for corresponding protection, due to the endless emergence of new virus programs and frequent system updates, complete software protection cannot be achieved.
基于这些问题，业界进行了深入的研究工作，提出一种新型解决思路，即把同一硬件设备划为两种相互独立且硬件上隔离的执行环境：普通执行环境(Rich Execution Environment，REE)和可信执行环境(Trusted ExecutionEnvironment，TEE)。平台上的软硬件资源可以分别标识为两种执行环境状态，标识为安全执行状态的软硬件资源只能由可信执行环境所访问，而标识为普通执行状态的软硬件资源则可以为两种执行环境所访问。普通执行环境运行目前常用的移动操作系统如Android等，可信执行环境运行一个功能简单、代码量小、封闭且可人为审核控制的安全操作系统。安全性要求较高的应用部署在安全操作系统中，并为部署在移动操作系统中的普通应用提供安全服务。当普通应用调用相应的安全应用执行时，硬件设备由普通执行环境切换到可信执行环境执行，此时整个硬件设备处于可信状态，设备与外界的交互都得到控制，保证都是真实可信的行为。Based on these problems, the industry has carried out in-depth research work and proposed a new solution, which is to divide the same hardware device into two independent and hardware-isolated execution environments: common execution environment (Rich Execution Environment, REE) and executable Trusted Execution Environment (TEE). The software and hardware resources on the platform can be identified as two execution environment states respectively. The software and hardware resources marked as safe execution state can only be accessed by the trusted execution environment, while the software and hardware resources marked as normal execution state can be of two types: The execution environment is accessed. The ordinary execution environment runs the currently commonly used mobile operating systems such as Android, and the trusted execution environment runs a secure operating system with simple functions, small code size, closedness, and human audit control. Applications with high security requirements are deployed in the security operating system and provide security services for common applications deployed in the mobile operating system. When a common application calls the corresponding security application for execution, the hardware device is switched from the normal execution environment to the trusted execution environment for execution. At this time, the entire hardware device is in a trusted state, and the interaction between the device and the outside world is controlled to ensure that it is authentic and credible. the behavior of.
TEE的软硬件执行环境和REE类似，通过芯片的特有技术(如ARM的Trustzone技术，或者Intel多CPU技术)，实现TEE和REE的物理运行环境的隔离，从而保障在TEE运行环境中的应用程序的安全性。TEE使用的外设都需要具备安全属性，这样才可以避免TEE访问外设的时候造成的安全数据泄漏风险。The software and hardware execution environment of TEE is similar to that of REE. Through the unique technology of the chip (such as ARM's Trustzone technology, or Intel multi-CPU technology), the isolation of the physical operating environment of TEE and REE is realized, thereby ensuring the application in the TEE operating environment. security. The peripherals used by the TEE need to have security attributes, so as to avoid the risk of security data leakage when the TEE accesses the peripherals.
在一个具体的应用中，例如用户在使用手机的过程中，遇到支付等敏感操作，就需要从REE中切换到TEE中完成相应操作，用户的密码、账号等信息均在TEE的环境下完成输入。TEE技术的出现在一定程度上保证了手机支付应用和数据的隔离，比之原有的在REE中完成所有支付活动自然是提升了安全性。但是TEE技术本身并不能完全保证用户数据不被篡改或者攻击，且TEE并不是一个完全封闭的操作系统和运行环境，TEE中的应用依然需要通过REE实现与远程服务器的数据交互，例如在线支付过程中，TEE中的应用需要和远程服务器进行通信，TEE中的应用通过REE向远程服务器发起连接请求，由REE中的操作系统完成数据的连接功能，另外在对TEE中应用定期更新，修补软件漏洞和升级安全算法时也需要通过REE与远程服务器进行数据交互，安全性还是无法保障。In a specific application, for example, when a user encounters sensitive operations such as payment while using a mobile phone, he needs to switch from REE to TEE to complete the corresponding operation. The user's password, account number and other information are all completed in the TEE environment. enter. The emergence of TEE technology guarantees the isolation of mobile payment applications and data to a certain extent, which naturally improves the security compared to the original completion of all payment activities in REE. However, TEE technology itself cannot completely guarantee that user data will not be tampered with or attacked, and TEE is not a completely closed operating system and operating environment. Applications in TEE still need to use REE to realize data interaction with remote servers, such as online payment process Among them, the application in the TEE needs to communicate with the remote server. The application in the TEE initiates a connection request to the remote server through the REE, and the operating system in the REE completes the data connection function. In addition, the application in the TEE is regularly updated to patch software vulnerabilities And when upgrading the security algorithm, it is also necessary to exchange data with the remote server through REE, and the security cannot be guaranteed.
发明内容Contents of the invention
有鉴于此，本发明实施例提供了一种提升可信执行环境安全性的方法、系统及终端，能够通过智能卡提升TEE的安全性。In view of this, the embodiments of the present invention provide a method, system and terminal for enhancing the security of a trusted execution environment, which can enhance the security of a TEE through a smart card.
本发明实施例第一方面提供了一种提升可信执行环境TEE安全性的方法，包括：The first aspect of the embodiment of the present invention provides a method for improving the security of the trusted execution environment TEE, including:
获取可信应用向目标服务器发起的连接请求，所述连接请求中包含所述目标服务器的标识；Obtain a connection request initiated by the trusted application to the target server, where the connection request includes an identifier of the target server;
通过调制解调器获取智能卡中存储的服务器列表；Obtain the list of servers stored in the smart card via a modem;
根据所述目标服务器的标识判断所述目标服务器是否包含在所述服务器列表中；judging whether the target server is included in the server list according to the identifier of the target server;
若是，则允许所述可信应用与所述目标服务器建立连接，若否，则拒绝所述可信应用与所述目标服务器建立连接。If yes, allow the trusted application to establish a connection with the target server; if not, deny the trusted application to establish a connection with the target server.
结合本发明实施例的第一方面，在本发明实施例第一方面的第一种实施方式中，在所述可信应用与所述目标服务器建立连接之后，所述方法还包括：With reference to the first aspect of the embodiments of the present invention, in the first implementation manner of the first aspect of the embodiments of the present invention, after the trusted application establishes a connection with the target server, the method further includes:
将所述可信应用的标识通过所述调制解调器发送至所述智能卡，以请求所述智能卡根据所述智能卡中存储的与所述可信应用的标识对应的认证算法对所述可信应用进行认证。sending the identifier of the trusted application to the smart card through the modem, so as to request the smart card to authenticate the trusted application according to an authentication algorithm stored in the smart card corresponding to the identifier of the trusted application .
结合本发明实施例第一方面的第一种实施方式，在本发明实施例第一方面的第二种实施方式中，在将所述可信应用的标识通过所述调制解调器发送至所述智能卡的同时，还将所述可信应用响应于所述目标服务器发送的认证请求的认证数据通过所述调制解调器发送至所述智能卡，所述认证数据中包含所述目标服务器的标识；With reference to the first implementation manner of the first aspect of the embodiments of the present invention, in the second implementation manner of the first aspect of the embodiments of the present invention, when the identifier of the trusted application is sent to the smart card through the modem At the same time, the authentication data of the trusted application in response to the authentication request sent by the target server is sent to the smart card through the modem, and the authentication data includes the identification of the target server;
在请求所述智能卡对所述可信应用进行认证之后，所述方法还包括：After requesting the smart card to authenticate the trusted application, the method further includes:
判断所述智能卡对所述可信应用的认证结果是否为成功；Judging whether the authentication result of the smart card to the trusted application is successful;
在所述智能卡对所述可信应用的认证结果为成功时，通过所述调制解调器从所述智能卡获取对所述可信应用与所述目标服务器之间传输的数据进行加密、解密、签名或校验所使用的临时通信密钥，所述临时通信密钥由所述智能卡根据所述可信应用的标识、所述目标服务器的标识及预设的算法生成。When the authentication result of the smart card on the trusted application is successful, obtain from the smart card through the modem to encrypt, decrypt, sign or verify the data transmitted between the trusted application and the target server. verifying the temporary communication key used, the temporary communication key is generated by the smart card according to the identifier of the trusted application, the identifier of the target server and a preset algorithm.
结合本发明实施例第一方面的第二种实施方式，在本发明实施例第一方面的第三种实施方式中，所述智能卡中的服务器列表、认证算法及临时通信密钥由智能卡发行商负责管理。In combination with the second implementation manner of the first aspect of the embodiment of the present invention, in the third implementation manner of the first aspect of the embodiment of the present invention, the server list, authentication algorithm and temporary communication key in the smart card are provided by the smart card issuer Responsible for management.
结合本发明实施例的第一方面，或第一方面的第一种实施方式，或第一方面的第二种实施方式，或第一方面的第三种实施方式，在本发明实施例第一方面的第四种实施方式中，所述智能卡包括：用户身份识别SIM卡，通用集成电路卡UICC及嵌入式通用集成电路卡eUICC。In combination with the first aspect of the embodiments of the present invention, or the first implementation manner of the first aspect, or the second implementation manner of the first aspect, or the third implementation manner of the first aspect, in the first embodiment of the present invention In the fourth implementation manner of the aspect, the smart card includes: a SIM card, a universal integrated circuit card (UICC), and an embedded universal integrated circuit card (eUICC).
结合本发明实施例的第一方面，或第一方面的第一种实施方式，或第一方面的第二种实施方式，或第一方面的第三种实施方式，在本发明实施例第一方面的第五种实施方式中，所述可信应用与所述目标服务器之间通过所述调制解调器拨号建立连接，或者所述可信应用与所述目标服务器之间通过WIFI建立连接。In combination with the first aspect of the embodiments of the present invention, or the first implementation manner of the first aspect, or the second implementation manner of the first aspect, or the third implementation manner of the first aspect, in the first embodiment of the present invention In a fifth implementation manner of the aspect, a connection is established between the trusted application and the target server through the modem dial-up, or a connection is established between the trusted application and the target server through WIFI.
结合本发明实施例的第一方面，或第一方面的第一种实施方式，或第一方面的第二种实施方式，或第一方面的第三种实施方式，在本发明实施例第一方面的第六种实施方式中，所述服务器列表中包括所述可信应用进行数值处理时所需要连接的服务器及对所述可信应用进行维护时所需连接的服务器。In combination with the first aspect of the embodiments of the present invention, or the first implementation manner of the first aspect, or the second implementation manner of the first aspect, or the third implementation manner of the first aspect, in the first embodiment of the present invention In a sixth implementation manner of the aspect, the server list includes servers that the trusted application needs to connect to when performing numerical processing and servers that need to connect to maintain the trusted application.
本发明实施例第二方面提供了一种终端，所述终端支持可信执行环境TEE，包括：The second aspect of the embodiment of the present invention provides a terminal, the terminal supports a trusted execution environment TEE, including:
第一获取单元，用于获取可信应用向目标服务器发起的连接请求，所述连接请求中包含所述目标服务器的标识；A first acquiring unit, configured to acquire a connection request initiated by a trusted application to a target server, where the connection request includes an identifier of the target server;
第二获取单元，用于通过调制解调器获取智能卡中存储的服务器列表；The second obtaining unit is used to obtain the server list stored in the smart card through a modem;
判断单元，用于根据所述目标服务器的标识判断所述目标服务器是否包含在所述服务器列表中；a judging unit, configured to judge whether the target server is included in the server list according to the identifier of the target server;
处理单元，用于当所述目标服务器包含在所述服务器列表中时，允许所述可信应用与所述目标服务器建立连接，当所述目标服务器不包含在所述服务器列表中时，拒绝所述可信应用与所述目标服务器建立连接。A processing unit, configured to allow the trusted application to establish a connection with the target server when the target server is included in the server list, and reject the target server when the target server is not included in the server list The trusted application establishes a connection with the target server.
结合本发明实施例的第二方面，在本发明实施例第二方面的第一种实施方式中，所述终端还包括：With reference to the second aspect of the embodiments of the present invention, in the first implementation manner of the second aspect of the embodiments of the present invention, the terminal further includes:
发送单元，用于在所述可信应用与所述目标服务器建立连接之后，将所述可信应用的标识通过所述调制解调器发送至所述智能卡，以请求所述智能卡根据所述智能卡中存储的与所述可信应用的标识对应的认证算法对所述可信应用进行认证。a sending unit, configured to send the identifier of the trusted application to the smart card through the modem after the trusted application establishes a connection with the target server, so as to request the smart card to An authentication algorithm corresponding to the identifier of the trusted application authenticates the trusted application.
结合本发明实施例第二方面的第一种实施方式，在本发明实施例第二方面的第二种实施方式中，所述发送单元还用于，在将所述可信应用的标识通过所述调制解调器发送至所述智能卡的同时，还将所述可信应用响应于所述目标服务器发送的认证请求的认证数据通过所述调制解调器发送至所述智能卡，所述认证数据中包含所述目标服务器的标识；With reference to the first implementation manner of the second aspect of the embodiments of the present invention, in the second implementation manner of the second aspect of the embodiments of the present invention, the sending unit is further configured to pass the identifier of the trusted application through the At the same time that the modem sends to the smart card, the authentication data of the trusted application in response to the authentication request sent by the target server is sent to the smart card through the modem, and the authentication data includes the target server logo;
所述判断单元还用于，判断所述智能卡对所述可信应用的认证结果是否为成功；The judging unit is further configured to judge whether the authentication result of the smart card to the trusted application is successful;
所述终端还包括：The terminal also includes:
第三获取单元，用于在所述智能卡对所述可信应用的认证结果为成功时，通过所述调制解调器从所述智能卡获取对所述可信应用与所述目标服务器之间传输的数据进行加密、解密、签名或校验所使用的临时通信密钥，所述临时通信密钥由所述智能卡根据所述可信应用的标识、所述目标服务器的标识及预设的算法生成。A third acquiring unit, configured to acquire, through the modem, from the smart card the data transmitted between the trusted application and the target server when the authentication result of the smart card to the trusted application is successful. A temporary communication key used for encryption, decryption, signature or verification, the temporary communication key is generated by the smart card according to the identifier of the trusted application, the identifier of the target server and a preset algorithm.
结合本发明实施例第二方面的第二种实施方式，在本发明实施例第二方面的第三种实施方式中，所述智能卡中的服务器列表、认证算法及临时通信密钥由智能卡发行商负责管理。In combination with the second implementation of the second aspect of the embodiment of the present invention, in the third implementation of the second aspect of the embodiment of the present invention, the server list, authentication algorithm and temporary communication key in the smart card are provided by the smart card issuer Responsible for management.
结合本发明实施例的第二方面，或第二方面的第一种实施方式，或第二方面的第二种实施方式，或第二方面的第三种实施方式，在本发明实施例第二方面的第四种实施方式中，所述智能卡包括：用户身份识别SIM卡，通用集成电路卡UICC及嵌入式通用集成电路卡eUICC。In combination with the second aspect of the embodiment of the present invention, or the first implementation manner of the second aspect, or the second implementation manner of the second aspect, or the third implementation manner of the second aspect, in the second aspect of the embodiment of the present invention In the fourth implementation manner of the aspect, the smart card includes: a SIM card, a universal integrated circuit card (UICC), and an embedded universal integrated circuit card (eUICC).
结合本发明实施例的第二方面，或第二方面的第一种实施方式，或第二方面的第二种实施方式，或第二方面的第三种实施方式，在本发明实施例第二方面的第五种实施方式中，所述终端还包括：In combination with the second aspect of the embodiment of the present invention, or the first implementation manner of the second aspect, or the second implementation manner of the second aspect, or the third implementation manner of the second aspect, in the second aspect of the embodiment of the present invention In a fifth implementation manner of the aspect, the terminal further includes:
连接建立单元，用于将所述可信应用与所述目标服务器之间通过所述调制解调器拨号建立连接，或者将所述可信应用与所述目标服务器之间通过WIFI建立连接。A connection establishing unit, configured to establish a connection between the trusted application and the target server through dial-up through the modem, or establish a connection between the trusted application and the target server through WIFI.
结合本发明实施例的第二方面，或第二方面的第一种实施方式，或第二方面的第二种实施方式，或第二方面的第三种实施方式，在本发明实施例第二方面的第六种实施方式中，所述服务器列表中包括所述可信应用进行数值处理时所需要连接的服务器及对所述可信应用进行维护时所需连接的服务器。In combination with the second aspect of the embodiment of the present invention, or the first implementation manner of the second aspect, or the second implementation manner of the second aspect, or the third implementation manner of the second aspect, in the second aspect of the embodiment of the present invention In a sixth implementation manner of the aspect, the server list includes servers that the trusted application needs to connect to when performing numerical processing and servers that need to connect to maintain the trusted application.
本发明实施例第三方面提供了一种提升可信执行环境TEE安全性的系统，包括如前述第二方面或第二方面的任意一种实施方式所提供的终端、服务器及智能卡。The third aspect of the embodiment of the present invention provides a system for improving the security of the trusted execution environment TEE, including the terminal, server and smart card provided by the second aspect or any implementation manner of the second aspect.
从以上技术方案可以看出，本发明实施例具有以下优点：It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:
本发明实施例中，获取可信应用向目标服务器发起的连接请求，所述连接请求中包含所述目标服务器的标识；通过调制解调器获取智能卡中存储的服务器列表；根据所述目标服务器的标识判断所述目标服务器是否包含在所述服务器列表中；若是，则允许所述可信应用与所述目标服务器建立连接，若否，则拒绝所述可信应用与所述目标服务器建立连接。即本发明实施例中，可信应用通过智能卡实现与目标服务器的交互，代替了现有技术中的可信应用通过REE实现与目标服务器交互的过程，本发明实施例中将可信的服务器列表存储在智能卡中，由于智能卡具有芯片较小，对外端口单一等特点，对物理攻击和软件攻击的防范优于REE环境，因此将可信的服务器列表存储在智能卡中，能够有效防止用户信息被篡改和攻击，保证可信应用连接到合法服务器，提升了TEE环境的安全性。In the embodiment of the present invention, the connection request initiated by the trusted application to the target server is obtained, and the connection request includes the identification of the target server; the server list stored in the smart card is obtained through a modem; Whether the target server is included in the server list; if yes, allow the trusted application to establish a connection with the target server; if not, deny the trusted application to establish a connection with the target server. That is, in the embodiment of the present invention, the trusted application realizes the interaction with the target server through the smart card, instead of the trusted application in the prior art realizes the interaction with the target server through the REE. In the embodiment of the present invention, the trusted server list Stored in the smart card, because the smart card has the characteristics of small chip and single external port, the prevention of physical attacks and software attacks is better than REE environment, so storing the trusted server list in the smart card can effectively prevent user information from being tampered with and attacks, ensuring that trusted applications are connected to legitimate servers, improving the security of the TEE environment.
附图说明Description of drawings
为了更清楚地说明本发明实施例的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.
图1为本发明提升可信执行环境安全性的方法一个实施例示意图；FIG. 1 is a schematic diagram of an embodiment of a method for enhancing the security of a trusted execution environment according to the present invention;
图2为本发明提升可信执行环境安全性的方法另一实施例示意图；FIG. 2 is a schematic diagram of another embodiment of the method for enhancing the security of a trusted execution environment according to the present invention;
图3为本发明终端一个实施例示意图；Fig. 3 is a schematic diagram of an embodiment of the terminal of the present invention;
图4为本发明终端另一实施例示意图；FIG. 4 is a schematic diagram of another embodiment of the terminal of the present invention;
图5为本发明终端另一实施例示意图；FIG. 5 is a schematic diagram of another embodiment of the terminal of the present invention;
图6为本发明提升可信执行环境安全性的系统一个实施例示意图。FIG. 6 is a schematic diagram of an embodiment of a system for enhancing the security of a trusted execution environment according to the present invention.
具体实施方式Detailed ways
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.
本发明实施例提供了一种提升可信执行环境安全性的方法、系统及终端，能够通过智能卡提升TEE的安全性。Embodiments of the present invention provide a method, system and terminal for improving the security of a trusted execution environment, which can improve the security of a TEE through a smart card.
请参阅图1，本发明提升可信执行环境安全性的方法一个实施例包括：Please refer to Fig. 1, an embodiment of the method for improving the security of the trusted execution environment of the present invention includes:
101、终端获取可信应用向目标服务器发起的连接请求；101. The terminal obtains the connection request initiated by the trusted application to the target server;
本实施例中，终端中可支持两种运行环境：可信执行环境TEE及普通执行环境REE，其中，可信应用(Trusted Application，TA)运行在可信执行环境中。可信应用向目标服务器发起的连接请求中包含目标服务器的标识，该标识可以包括目标服务器的地址、端口号等。In this embodiment, the terminal can support two types of execution environments: a trusted execution environment TEE and a common execution environment REE, wherein a trusted application (Trusted Application, TA) runs in the trusted execution environment. The connection request initiated by the trusted application to the target server includes the identification of the target server, and the identification may include the address, port number, etc. of the target server.
102、终端通过调制解调器获取智能卡中存储的服务器列表；102. The terminal acquires the server list stored in the smart card through a modem;
具体实现中，调制解调器可为终端组成的一部分，包含于终端中。智能卡可为独立于终端的另一设备，智能卡用于存储服务器列表。智能卡具有芯片较小，对外端口单一等物理特性。In a specific implementation, the modem may be a part of the terminal and included in the terminal. The smart card can be another device independent of the terminal, and the smart card is used to store the server list. A smart card has physical characteristics such as a small chip and a single external port.
103、终端判断目标服务器是否包含在服务器列表中，若是，则执行步骤104，若否，则执行步骤105；103. The terminal judges whether the target server is included in the server list, if yes, execute step 104, if not, execute step 105;
若目标服务器的标识与服务器列表中包含的服务器的标识一致，则认为目标服务器包含在服务器列表中，否则，认为目标服务器不包含于服务器列表中，这个判断的过程是为了确保可信应用连接的目标服务器为可信的服务器。If the identity of the target server is consistent with the identity of the server contained in the server list, the target server is considered to be included in the server list; otherwise, the target server is considered not to be included in the server list. This judgment process is to ensure that trusted applications can connect The target server is a trusted server.
104、允许可信应用与目标服务器建立连接；104. Allow the trusted application to establish a connection with the target server;
105、拒绝可信应用与目标服务器建立连接。105. Refuse the trusted application to establish a connection with the target server.
本实施例中，可信应用通过智能卡实现与目标服务器的交互，代替了现有技术中的可信应用通过REE实现与目标服务器交互的过程，本实施例中将可信的服务器列表存储在智能卡中，由于智能卡具有芯片较小，对外端口单一等特点，对物理攻击和软件攻击的防范优于REE环境，因此将可信的服务器列表存储在智能卡中，能够有效防止用户信息被篡改和攻击，保证可信应用连接到合法服务器，提升了TEE环境的安全性。In this embodiment, the trusted application realizes the interaction with the target server through the smart card, instead of the trusted application in the prior art through the REE to realize the interaction process with the target server. In this embodiment, the trusted server list is stored in the smart card Among them, since the smart card has the characteristics of a small chip and a single external port, the prevention of physical and software attacks is better than that of the REE environment. Therefore, storing the trusted server list in the smart card can effectively prevent user information from being tampered with and attacked. Ensure that trusted applications are connected to legitimate servers, improving the security of the TEE environment.
为便于理解，下面以一个具体实施例描述本发明提升可信执行环境TEE安全性的方法，请参阅图2，本实施例的方法包括：For ease of understanding, a specific embodiment is used below to describe the method for enhancing the security of the trusted execution environment TEE according to the present invention. Please refer to FIG. 2. The method of this embodiment includes:
201、终端获取可信应用向目标服务器发起的连接请求；201. The terminal obtains the connection request initiated by the trusted application to the target server;
本实施例中，终端中可支持两种运行环境：可信执行环境TEE及普通执行环境REE，其中，可信应用(Trusted Application，TA)运行在可信执行环境中。可信应用向目标服务器发起的连接请求中包含目标服务器的标识，该标识可以包括目标服务器的地址、端口号等。In this embodiment, the terminal can support two types of execution environments: a trusted execution environment TEE and a common execution environment REE, wherein a trusted application (Trusted Application, TA) runs in the trusted execution environment. The connection request initiated by the trusted application to the target server includes the identification of the target server, and the identification may include the address, port number, etc. of the target server.
202、终端通过调制解调器获取智能卡中存储的服务器列表；202. The terminal obtains the server list stored in the smart card through the modem;
具体实现中，智能卡可为独立于终端存在的一种设备，智能卡包括用户身份识别(Subscriber Identity Module，SIM)卡，通用集成电路卡(UniversalIntegrated Circuit Card，UICC)及嵌入式(embed)通用集成电路卡eUICC。In a specific implementation, a smart card can be a device that exists independently of a terminal, and a smart card includes a Subscriber Identity Module (SIM) card, a Universal Integrated Circuit Card (UICC) and an embedded universal integrated circuit Card eUICC.
服务器列表中包括可信应用进行数值处理时需要连接的服务器及对可信应用进行维护时所需连接的服务器。其中，数值处理可以包括支付、验证、查询及对账等；对可信应用进行的维护可以包括：对可信应用进行程序更新、修补软件漏洞及升级安全算法等。The server list includes servers that need to be connected when the trusted application performs numerical processing and servers that need to be connected when maintaining the trusted application. Among them, numerical processing can include payment, verification, query, and account reconciliation, etc.; maintenance of trusted applications can include: updating programs for trusted applications, patching software vulnerabilities, and upgrading security algorithms.
203、终端判断目标服务器是否包含在服务器列表中，若否，则执行步骤204，若是，则执行步骤205；203. The terminal judges whether the target server is included in the server list, if not, execute step 204, and if yes, execute step 205;
204、终端拒绝可信应用与目标服务器建立连接；204. The terminal refuses to establish a connection between the trusted application and the target server;
205、终端允许可信应用与目标服务器建立连接；205. The terminal allows the trusted application to establish a connection with the target server;
可信应用与目标服务器之间通过调制解调器拨号建立连接，或者可信应用与目标服务器之间通过WIFI建立连接。A connection is established between the trusted application and the target server through modem dial-up, or a connection is established between the trusted application and the target server through WIFI.
206、终端将认证数据及可信应用的标识通过调制解调器发送至智能卡，以请求智能卡对可信应用进行认证，所述认证数据中包含目标服务器的标识；206. The terminal sends the authentication data and the identifier of the trusted application to the smart card through the modem, so as to request the smart card to authenticate the trusted application, and the authentication data includes the identifier of the target server;
智能卡中存储有不同的认证算法，每种认证算法对应一种可信应用的标识(Application，AID)，用于对对应的可信应用进行认证。Different authentication algorithms are stored in the smart card, each authentication algorithm corresponds to a trusted application identifier (Application, AID), and is used to authenticate the corresponding trusted application.
在可信应用与目标服务器建立连接后，目标服务器需要对可信应用进行认证，目标服务器可通过已有的无线链路向可信应用发起认证请求，可信应用响应目标服务器发起的认证请求，返回认证数据。After the trusted application establishes a connection with the target server, the target server needs to authenticate the trusted application. The target server can initiate an authentication request to the trusted application through the existing wireless link, and the trusted application responds to the authentication request initiated by the target server. Return authentication data.
终端获取认证数据，将认证数据及可信应用的标识AID通过调制解调器发送至智能卡，以由智能卡根据自身存储的与可信应用的AID对应的认证算法对可信应用进行认证，并将认证结果返回给终端。The terminal obtains the authentication data, and sends the authentication data and the AID of the trusted application to the smart card through the modem, so that the smart card can authenticate the trusted application according to the authentication algorithm stored in itself and corresponding to the AID of the trusted application, and return the authentication result to the terminal.
207、终端判断认证结果是否为成功，若是，则执行步骤208，若否，则执行步骤209，结束处理；207. The terminal judges whether the authentication result is successful, if so, execute step 208, if not, execute step 209, and end the process;
208、终端通过调制解调器从智能卡获取临时通信密钥。208. The terminal obtains the temporary communication key from the smart card through the modem.
当智能卡返回的认证结果为成功时，终端通过调制解调器从智能卡获取临时通信密钥，临时通信密钥由智能卡根据可信应用的标识、目标服务器的标识及预设的算法生成，终端使用临时通信密钥对可信应用与目标服务器之间传输的数据进行加密、解密、签名或校验等，以保护数据的安全性与完整性。When the authentication result returned by the smart card is successful, the terminal obtains a temporary communication key from the smart card through the modem. The temporary communication key is generated by the smart card according to the identity of the trusted application, the identity of the target server, and a preset algorithm. The terminal uses the temporary communication key. The key encrypts, decrypts, signs or verifies the data transmitted between the trusted application and the target server to protect the security and integrity of the data.
一旦可信应用与目标服务器的连接断开，临时通信密钥即失效，即可信应用与目标服务器每次通信都会使用不同的临时通信密钥，保证了即使某一次通信过程被破解，也不会造成更大的损失。Once the connection between the trusted application and the target server is disconnected, the temporary communication key will become invalid, that is, the trusted application and the target server will use different temporary communication keys for each communication, ensuring that even if a certain communication process is cracked, no would cause greater losses.
另外，本实施例中，智能卡中的服务器列表、认证算法及临时通信密钥由智能卡发行商负责管理，即智能卡发行商持有根密钥和根证书，负责维护智能卡中存储的数据，这些维护包括智能卡中数据的写入、更新及删除。终端中不具有根密钥和根证书，保证了智能卡中数据存储的唯一性，提高了智能卡中数据存储的安全性。用户通过智能卡发行商可以注销智能卡，这样就能避免终端丢失造成用户资金的损失，智能卡发行商可以通过简单的短信关闭智能卡的认证功能，并删除服务器列表。In addition, in this embodiment, the server list, authentication algorithm and temporary communication key in the smart card are managed by the smart card issuer, that is, the smart card issuer holds the root key and root certificate, and is responsible for maintaining the data stored in the smart card. Including writing, updating and deleting data in the smart card. There is no root key and root certificate in the terminal, which ensures the uniqueness of data storage in the smart card and improves the security of data storage in the smart card. The user can cancel the smart card through the smart card issuer, so as to avoid the loss of the user's funds caused by the loss of the terminal. The smart card issuer can close the authentication function of the smart card and delete the server list through a simple SMS.
本实施例中，可信应用通过智能卡实现与目标服务器的交互，代替了现有技术中的可信应用通过REE实现与目标服务器交互的过程，将可信的服务器列表，认证算法存储在智能卡中，且可信应用与目标服务器之间通信过程中所使用的临时通信密钥也由智能卡负责生成，智能卡与终端独立存在，且智能卡的维护由智能卡发行商负责，能够有效防止卡内信息被篡改，另外由于智能卡本身具有较强的防范物理攻击及软件攻击的能力，可信应用与目标服务器的通信过程涉及的机要数据都通过智能卡获取，且可信应用的认证过程也放在智能卡中实现，因此，本实施例能够避免可信执行环境被恶意攻击或者植入恶意程序，从而提高了可信执行环境的安全性。In this embodiment, the trusted application realizes the interaction with the target server through the smart card, which replaces the trusted application in the prior art through REE to realize the interaction with the target server, and stores the trusted server list and authentication algorithm in the smart card , and the temporary communication key used in the communication process between the trusted application and the target server is also generated by the smart card. The smart card and the terminal exist independently, and the maintenance of the smart card is the responsibility of the smart card issuer, which can effectively prevent the information in the card from being tampered with. In addition, because the smart card itself has a strong ability to prevent physical attacks and software attacks, the confidential data involved in the communication process between the trusted application and the target server is obtained through the smart card, and the authentication process of the trusted application is also implemented in the smart card Therefore, this embodiment can prevent the trusted execution environment from being maliciously attacked or implanted with malicious programs, thereby improving the security of the trusted execution environment.
下面对本发明实施例提供的终端进行描述，本实施例的终端支持可信执行环境TEE，请参阅图3，本实施例的终端300包括：The terminal provided by the embodiment of the present invention is described below. The terminal in this embodiment supports the Trusted Execution Environment TEE. Please refer to FIG. 3 . The terminal 300 in this embodiment includes:
第一获取单元301，用于获取可信应用向目标服务器发起的连接请求，所述连接请求中包含目标服务器的标识；The first acquiring unit 301 is configured to acquire a connection request initiated by the trusted application to the target server, where the connection request includes an identifier of the target server;
第二获取单元302，用于通过调制解调器获取智能卡中存储的服务器列表；The second acquiring unit 302 is configured to acquire the server list stored in the smart card through a modem;
判断单元303，用于根据目标服务器的标识判断目标服务器是否包含在服务器列表中；A judging unit 303, configured to judge whether the target server is included in the server list according to the identifier of the target server;
处理单元304，用于当目标服务器包含在服务器列表中时，允许可信应用与目标服务器建立连接，当目标服务器不包含在服务器列表中时，拒绝可信应用与目标服务器建立连接。The processing unit 304 is configured to allow the trusted application to establish a connection with the target server when the target server is included in the server list, and refuse the trusted application to establish a connection with the target server when the target server is not included in the server list.
本实施例中，判断单元通过从智能卡中获取的服务器列表判断可信应用请求连接的目标服务器是否合法，处理单元在目标服务器包含在服务器列表中时，允许可信应用与目标服务器建立连接，在目标服务器没有包含在服务器列表中时，拒绝可信应用与目标服务器建立连接，即本实施例中，可信应用通过智能卡实现与目标服务器的交互，代替了现有技术中的可信应用通过REE实现与目标服务器交互的过程，将可信的服务器列表存储在智能卡中，由于智能卡具有芯片较小，对外端口单一等特点，对物理攻击和软件攻击的防范优于REE环境，因此将可信的服务器列表存储在智能卡中，能够有效防止用户信息被篡改和攻击，保证可信应用连接到合法服务器，提升了TEE环境的安全性。In this embodiment, the judging unit judges whether the target server requested by the trusted application to connect is legitimate through the server list obtained from the smart card, and the processing unit allows the trusted application to establish a connection with the target server when the target server is included in the server list. When the target server is not included in the server list, the trusted application is refused to establish a connection with the target server, that is, in this embodiment, the trusted application realizes the interaction with the target server through the smart card, replacing the trusted application in the prior art through Realize the process of interacting with the target server, and store the trusted server list in the smart card. Since the smart card has the characteristics of small chip and single external port, the prevention of physical attacks and software attacks is better than REE environment, so the trusted server list The server list is stored in the smart card, which can effectively prevent user information from being tampered with and attacked, ensure that trusted applications are connected to legitimate servers, and improve the security of the TEE environment.
下面进一步描述本发明实施例的终端，请参阅图4，本实施例的终端400包括：The terminal of the embodiment of the present invention is further described below, please refer to FIG. 4, the terminal 400 of this embodiment includes:
第一获取单元401，用于获取可信应用向目标服务器发起的连接请求，所述连接请求中包含目标服务器的标识；The first acquiring unit 401 is configured to acquire a connection request initiated by the trusted application to the target server, where the connection request includes an identifier of the target server;
第二获取单元402，用于通过调制解调器获取智能卡中存储的服务器列表；The second acquiring unit 402 is configured to acquire the server list stored in the smart card through a modem;
判断单元403，用于根据目标服务器的标识判断目标服务器是否包含在服务器列表中；A judging unit 403, configured to judge whether the target server is included in the server list according to the identifier of the target server;
处理单元404，用于当目标服务器包含在服务器列表中时，允许可信应用与目标服务器建立连接，当目标服务器不包含在服务器列表中时，拒绝可信应用与目标服务器建立连接；The processing unit 404 is configured to allow the trusted application to establish a connection with the target server when the target server is included in the server list, and refuse the trusted application to establish a connection with the target server when the target server is not included in the server list;
连接建立单元405，用于将可信应用与目标服务器之间通过调制解调器拨号建立连接，或者将可信应用与目标服务器之间通过WIFI建立连接；A connection establishment unit 405, configured to establish a connection between the trusted application and the target server through modem dial-up, or establish a connection between the trusted application and the target server through WIFI;
发送单元406，用于在可信应用与目标服务器建立连接之后，将可信应用响应于目标服务器发送的认证请求的认证数据及可信应用的标识通过调制解调器发送至智能卡，以请求智能卡根据智能卡中存储的与可信应用的标识对应的认证算法对可信应用进行认证，所述认证数据中包含目标服务器的标识；The sending unit 406 is configured to, after the trusted application establishes a connection with the target server, send the authentication data of the trusted application in response to the authentication request sent by the target server and the identification of the trusted application to the smart card through the modem, so as to request the smart card according to the The stored authentication algorithm corresponding to the identifier of the trusted application authenticates the trusted application, and the authentication data includes the identifier of the target server;
其中，判断单元403还用于，判断智能卡对可信应用的认证结果是否为成功；Wherein, the judging unit 403 is also used to judge whether the authentication result of the smart card to the trusted application is successful;
终端400还包括第三获取单元407，用于在智能卡对可信应用的认证结果为成功时，通过调制解调器从智能卡获取对可信应用与目标服务器之间传输的数据进行加密、解密、签名及校验所使用的临时通信密钥，所述临时通信密钥由智能卡根据可信应用的标识、目标服务器的标识及预设的算法生成。The terminal 400 also includes a third obtaining unit 407, configured to obtain from the smart card through the modem to encrypt, decrypt, sign and verify the data transmitted between the trusted application and the target server when the smart card authenticates the trusted application successfully. verify the temporary communication key used, the temporary communication key is generated by the smart card according to the identifier of the trusted application, the identifier of the target server and a preset algorithm.
为便于理解，下面以一个实际应用场景对本实施例提供的终端400内的各单元之间的交互方式进行描述，具体如下：For ease of understanding, the interaction mode between the units in the terminal 400 provided by this embodiment is described below in a practical application scenario, specifically as follows:
首先，本实施例的终端中可支持两种运行环境：可信执行环境TEE及普通执行环境REE，其中，可信应用(Trusted Application，TA)运行在可信执行环境中。可信应用向目标服务器发起连接请求，第一获取单元401获取连接请求，连接请求中包含目标服务器的标识，该标识可以包括目标服务器的地址、端口号等。First of all, the terminal in this embodiment can support two types of execution environments: a trusted execution environment TEE and a common execution environment REE, wherein a trusted application (Trusted Application, TA) runs in the trusted execution environment. The trusted application initiates a connection request to the target server, and the first obtaining unit 401 obtains the connection request. The connection request includes the target server's identifier, and the identifier may include the target server's address, port number, and the like.
接下来第二获取单元402通过调制解调器获取智能卡中存储的服务器列表。其中，智能卡可为独立于终端存在的一种设备，智能卡包括用户身份识别SIM卡，通用集成电路卡UICC及嵌入式通用集成电路卡eUICC。服务器列表中包括可信应用进行数值处理时所需要连接的服务器及对可信应用进行维护时所需连接的服务器。其中，数值处理可以包括支付、验证、查询及对账等；对可信应用进行的维护可以包括：对可信应用进行程序更新、修补软件漏洞及升级安全算法等。Next, the second obtaining unit 402 obtains the server list stored in the smart card through a modem. Wherein, the smart card may be a device independent of the terminal, and the smart card includes a SIM card for user identification, a universal integrated circuit card (UICC) and an embedded universal integrated circuit card (eUICC). The server list includes servers that need to be connected when the trusted application performs numerical processing and servers that need to be connected when maintaining the trusted application. Among them, numerical processing can include payment, verification, query, and account reconciliation, etc.; maintenance of trusted applications can include: updating programs for trusted applications, patching software vulnerabilities, and upgrading security algorithms.
判断单元403判断目标服务器是否包含在服务器列表中。具体地，判断单元403判断目标服务器的标识与服务器列表中包含的服务器的标识一致，，若是，则认为目标服务器包含在服务器列表中，否则，认为目标服务器不包含于服务器列表中，这个判断的过程是为了确保可信应用连接的目标服务器为可信的服务器。处理单元404在判断单元403的判断结果为否时，拒绝可信应用与目标服务器建立连接，在判断单元403的判断结果为是时，允许可信应用与目标服务器建立连接。The judging unit 403 judges whether the target server is included in the server list. Specifically, the judging unit 403 judges that the identifier of the target server is consistent with the identifiers of the servers contained in the server list, and if so, considers that the target server is included in the server list; The process is to ensure that the target server that the trusted application connects to is a trusted server. The processing unit 404 refuses the trusted application to establish a connection with the target server when the determination result of the determination unit 403 is No, and allows the trusted application to establish a connection with the target server when the determination result of the determination unit 403 is Yes.
在处理单元404允许可信应用与目标服务器建立连接时，连接建立单元405将可信应用与目标服务器之间通过调制解调器拨号建立连接，或者将可信应用与目标服务器之间通过WIFI建立连接。When the processing unit 404 allows the trusted application to establish a connection with the target server, the connection establishing unit 405 establishes a connection between the trusted application and the target server through modem dial-up, or establishes a connection between the trusted application and the target server through WIFI.
在可信应用与目标服务器建立连接后，目标服务器需要对可信应用进行认证，目标服务器可通过已有的无线链路向可信应用发起认证请求，可信应用响应目标服务器发起的认证请求，返回认证数据。第一获取单元401获取认证数据，由发送单元406将认证数据及可信应用的标识通过调制解调器发送至智能卡，以请求智能卡对可信应用进行认证，所述认证数据中包含目标服务器的标识。After the trusted application establishes a connection with the target server, the target server needs to authenticate the trusted application. The target server can initiate an authentication request to the trusted application through the existing wireless link, and the trusted application responds to the authentication request initiated by the target server. Return authentication data. The first obtaining unit 401 obtains the authentication data, and the sending unit 406 sends the authentication data and the identifier of the trusted application to the smart card through the modem to request the smart card to authenticate the trusted application, and the authentication data includes the identifier of the target server.
智能卡中存储有不同的认证算法，每种认证算法对应一种可信应用的标识(Application，AID)，用于对对应的可信应用进行认证。智能卡根据自身存储的与可信应用的AID对应的认证算法对可信应用进行认证，并将认证结果返回给终端。Different authentication algorithms are stored in the smart card, each authentication algorithm corresponds to a trusted application identifier (Application, AID), and is used to authenticate the corresponding trusted application. The smart card authenticates the trusted application according to the authentication algorithm stored in itself corresponding to the AID of the trusted application, and returns the authentication result to the terminal.
判断单元403判断智能卡返回的认证结果是否为成功，若为成功，则由第三获取单元407通过调制解调器从智能卡获取临时通信密钥，临时通信密钥由智能卡根据可信应用的标识、目标服务器的标识及预设的算法生成，终端使用临时通信密钥对可信应用与目标服务器之间传输的数据进行加密、解密、签名或校验等，以保护数据的安全性与完整性；若未失败，则结束处理。The judging unit 403 judges whether the authentication result returned by the smart card is successful. If it is successful, the third obtaining unit 407 obtains the temporary communication key from the smart card through the modem. The identification and the preset algorithm are generated, and the terminal uses the temporary communication key to encrypt, decrypt, sign or verify the data transmitted between the trusted application and the target server to protect the security and integrity of the data; if it does not fail , the processing ends.
一旦可信应用与目标服务器的连接断开，临时通信密钥即失效，即可信应用与目标服务器每次通信都会使用不同的临时通信密钥，保证了即使某一次通信过程被破解，也不会造成更大的损失。Once the connection between the trusted application and the target server is disconnected, the temporary communication key will become invalid, that is, the trusted application and the target server will use different temporary communication keys for each communication, ensuring that even if a certain communication process is cracked, no would cause greater losses.
另外，本实施例中，智能卡中的服务器列表、认证算法及临时通信密钥由智能卡发行商负责管理，即智能卡发行商持有根密钥和根证书，负责维护智能卡中存储的数据，这些维护包括智能卡中数据的写入、更新及删除。终端中不具有根密钥和根证书，保证了智能卡中数据存储的唯一性，提高了智能卡中数据存储的安全性。用户通过智能卡发行商可以注销智能卡，这样就能避免终端丢失造成用户资金的损失，智能卡发行商可以通过简单的短信关闭智能卡的认证功能，并删除服务器列表。In addition, in this embodiment, the server list, authentication algorithm and temporary communication key in the smart card are managed by the smart card issuer, that is, the smart card issuer holds the root key and root certificate, and is responsible for maintaining the data stored in the smart card. Including writing, updating and deleting data in the smart card. There is no root key and root certificate in the terminal, which ensures the uniqueness of data storage in the smart card and improves the security of data storage in the smart card. The user can cancel the smart card through the smart card issuer, so as to avoid the loss of the user's funds caused by the loss of the terminal. The smart card issuer can close the authentication function of the smart card and delete the server list through a simple SMS.
本实施例中，判断单元根据智能卡中存储的服务器列表判断目标服务器是否合法，发送单元将认证数据发送至智能卡，以由智能卡对可信应用进行认证，且通过过程中使用的临时通信密钥由第三获取单元从智能卡获取，即本实施例中，可信应用通过智能卡实现与目标服务器的交互，代替了现有技术中的可信应用通过REE实现与目标服务器交互的过程，由于智能卡本身具有较强的防范物理攻击及软件攻击的能力，可信应用与目标服务器的通信过程涉及的机要数据都通过智能卡获取，且可信应用的认证过程也放在智能卡中实现，因此，本实施例能够避免可信执行环境被恶意攻击或者植入恶意程序，从而提高了可信执行环境的安全性。In this embodiment, the judging unit judges whether the target server is legal according to the server list stored in the smart card, and the sending unit sends the authentication data to the smart card, so that the smart card authenticates the trusted application, and the temporary communication key used in the passing process is determined by The third acquisition unit acquires from the smart card, that is, in this embodiment, the trusted application realizes the interaction with the target server through the smart card, instead of the trusted application in the prior art through REE to realize the interaction process with the target server, because the smart card itself has Strong ability to prevent physical attacks and software attacks. The confidential data involved in the communication process between the trusted application and the target server is obtained through the smart card, and the authentication process of the trusted application is also implemented in the smart card. Therefore, this embodiment The trusted execution environment can be prevented from being maliciously attacked or implanted with malicious programs, thereby improving the security of the trusted execution environment.
下面请参阅图5，图5示出了本发明实施例提供的终端的结构，本发明实施例提供的终端可以用于实施上述实施例提供的提升可信执行环境TEE安全性的方法。为了便于说明，仅示出了与本发明实施例相关的部分，具体技术细节未揭露的，请参照本发明方法实施例部分进行理解。在实际应用中，终端500可以为手机，平板电脑，个数数字助理(Personal Digital Assistant，PDA)等设备。具体来讲：Please refer to FIG. 5 below. FIG. 5 shows the structure of the terminal provided by the embodiment of the present invention. The terminal provided by the embodiment of the present invention can be used to implement the method for improving the security of the trusted execution environment TEE provided by the above embodiment. For ease of description, only the parts related to the embodiments of the present invention are shown, and for specific technical details not disclosed, please refer to the method embodiments of the present invention for understanding. In practical applications, the terminal 500 may be a mobile phone, a tablet computer, a personal digital assistant (Personal Digital Assistant, PDA) and other devices. Specifically:
终端500可以包括RF(Radio Frequency，射频)电路510、包括有一个或一个以上计算机可读存储介质的存储器520、输入单元530、显示单元540、传感器550、音频电路560、WiFi(wireless fidelity，无线保真)模块570、包括有一个或者一个以上处理核心的处理器580、以及电源590等部件。本领域技术人员可以理解，图5中示出的结构并不构成对预测用户离网的终端500的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。其中：The terminal 500 may include an RF (Radio Frequency, radio frequency) circuit 510, a memory 520 including one or more computer-readable storage media, an input unit 530, a display unit 540, a sensor 550, an audio circuit 560, and a WiFi (wireless fidelity, wireless Fidelity) module 570, including a processor 580 with one or more processing cores, and a power supply 590 and other components. Those skilled in the art can understand that the structure shown in FIG. 5 does not constitute a limitation on the terminal 500 for predicting users leaving the network, and may include more or less components than those shown in the figure, or combine certain components, or have different Part placement. in:
RF电路510可用于收发消息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，交由一个或者一个以上处理器580处理；另外，将涉及上行的数据发送给基站。通常，RF电路510包括但不限于天线、至少一个放大器、调谐器、一个或多个振荡器、用户身份模块(SIM)卡、收发信机、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等。此外，RF电路510还可以通过无线通信与网络和其他设备通信。所述无线通信可以使用任一通信标准或协议，包括但不限于GSM(Global System of Mobilecommunication，全球移动通讯系统)、GPRS(General Packet Radio Service，通用分组无线服务)、CDMA(Code Division Multiple Access，码分多址)、WCDMA(Wideband Code Division Multiple Access,宽带码分多址)、LTE(LongTerm Evolution,长期演进)、电子邮件、SMS(Short Messaging Service，短消息服务)等。The RF circuit 510 can be used for receiving and sending signals during message sending or talking, especially, after receiving the downlink information of the base station, it is handed over to one or more processors 580 for processing; in addition, the uplink data is sent to the base station . Generally, the RF circuit 510 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier, low noise amplifier) , duplexer, etc. In addition, RF circuitry 510 may also communicate with networks and other devices via wireless communications. The wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication, Global System for Mobile Communication), GPRS (General Packet Radio Service, general packet radio service), CDMA (Code Division Multiple Access, Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access, Wideband Code Division Multiple Access), LTE (LongTerm Evolution, Long Term Evolution), email, SMS (Short Messaging Service, Short Message Service), etc.
存储器520可用于存储软件程序以及模块，处理器580通过运行存储在存储器520的软件程序以及模块，从而执行各种功能应用以及数据处理。存储器520可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据存储设备的使用创建数据(比如音频数据、电话本等)。此外，存储器520可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。相应地，存储器520还可以包括存储器控制器，以提供处理器580和输入单元530对存储器520的访问。The memory 520 can be used to store software programs and modules, and the processor 580 executes various functional applications and data processing by running the software programs and modules stored in the memory 520 . The memory 520 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playback function, an image playback function, etc.); The use of storage devices creates data (such as audio data, phonebook, etc.). In addition, the memory 520 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage devices. Correspondingly, the memory 520 may further include a memory controller to provide access to the memory 520 by the processor 580 and the input unit 530 .
输入单元530可用于接收输入的数字或字符信息，以及产生与用户设置以及功能控制有关的键盘、鼠标、操作杆、光学或者轨迹球信号输入。具体地，输入单元530可包括触敏表面531以及其他输入设备532。触敏表面531，也称为触摸显示屏或者触控板，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触敏表面531上或在触敏表面531附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触敏表面531可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器580，并能接收处理器580发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触敏表面531。除了触敏表面531，输入单元530还可以包括其他输入设备532。具体地，其他输入设备532可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。The input unit 530 can be used to receive input numbers or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, the input unit 530 may include a touch-sensitive surface 531 and other input devices 532 . The touch-sensitive surface 531, also referred to as a touch screen or a touchpad, can collect user touch operations on or near it (for example, the user uses any suitable object or accessory such as a finger, a stylus, etc. on the touch-sensitive surface 531 or on The operation near the touch-sensitive surface 531), and drive the corresponding connection device according to the preset program. Optionally, the touch-sensitive surface 531 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, and detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and sends it to the to the processor 580, and can receive and execute commands sent by the processor 580. In addition, the touch-sensitive surface 531 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 531 , the input unit 530 may also include other input devices 532 . Specifically, other input devices 532 may include but not limited to one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), trackball, mouse, joystick, and the like.
显示单元540可用于显示由用户输入的信息或提供给用户的信息以及终端500的各种图形用户接口，这些图形用户接口可以由图形、文本、图标、视频和其任意组合来构成。显示单元540可包括显示面板541，可选的，可以采用LCD(Liquid Crystal Display，液晶显示器)、OLED(Organic Light-EmittingDiode,有机发光二极管)等形式来配置显示面板541。进一步的，触敏表面531可覆盖显示面板541，当触敏表面531检测到在其上或附近的触摸操作后，传送给处理器580以确定触摸事件的类型，随后处理器580根据触摸事件的类型在显示面板541上提供相应的视觉输出。虽然在图5中，触敏表面531与显示面板541是作为两个独立的部件来实现输入和输入功能，但是在某些实施例中，可以将触敏表面531与显示面板541集成而实现输入和输出功能。The display unit 540 can be used to display information input by or provided to the user and various graphical user interfaces of the terminal 500. These graphical user interfaces can be composed of graphics, text, icons, videos and any combination thereof. The display unit 540 may include a display panel 541. Optionally, the display panel 541 may be configured in the form of LCD (Liquid Crystal Display, liquid crystal display), OLED (Organic Light-Emitting Diode, organic light-emitting diode). Further, the touch-sensitive surface 531 may cover the display panel 541, and when the touch-sensitive surface 531 detects a touch operation on or near it, it is sent to the processor 580 to determine the type of the touch event, and then the processor 580 determines the type of the touch event according to the touch event. The type provides a corresponding visual output on the display panel 541 . Although in FIG. 5, the touch-sensitive surface 531 and the display panel 541 are used as two independent components to realize input and input functions, in some embodiments, the touch-sensitive surface 531 and the display panel 541 can be integrated to realize input. and output functions.
终端500还可包括至少一种传感器550，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板541的亮度，接近传感器可在终端500移动到耳边时，关闭显示面板541和/或背光。作为运动传感器的一种，重力加速度传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别终端500姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于终端500还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。The terminal 500 may also include at least one sensor 550, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 541 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 541 and the display panel 541 when the terminal 500 moves to the ear. / or backlighting. As a kind of motion sensor, the gravitational acceleration sensor can detect the magnitude of acceleration in various directions (generally three axes), and can detect the magnitude and direction of gravity when it is stationary, and can be used to identify the application of terminal 500 attitude (such as horizontal and vertical screen switching, Related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tap), etc.; as for the gyroscope, barometer, hygrometer, thermometer, infrared sensor and other sensors that can be configured on the terminal 500, here No longer.
音频电路560、扬声器561，传声器562可提供用户与终端500之间的音频接口。音频电路560可将接收到的音频数据转换后的电信号，传输到扬声器561，由扬声器561转换为声音信号输出；另一方面，传声器562将收集的声音信号转换为电信号，由音频电路560接收后转换为音频数据，再将音频数据输出处理器580处理后，经RF电路510以发送给比如另一终端，或者将音频数据输出至存储器520以便进一步处理。音频电路560还可能包括耳塞插孔，以提供外设耳机与终端500的通信。The audio circuit 560 , the speaker 561 and the microphone 562 can provide an audio interface between the user and the terminal 500 . The audio circuit 560 can transmit the electrical signal converted from the received audio data to the loudspeaker 561, and the loudspeaker 561 converts it into an audio signal output; After being received, it is converted into audio data, and then the audio data is processed by the output processor 580, and then sent to another terminal through the RF circuit 510, or the audio data is output to the memory 520 for further processing. The audio circuit 560 may also include an earplug jack to provide communication between an external earphone and the terminal 500 .
WiFi属于短距离无线传输技术，终端500通过WiFi模块570可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图5示出了WiFi模块570，但是可以理解的是，其并不属于终端500的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。WiFi is a short-distance wireless transmission technology. The terminal 500 can help users send and receive e-mails, browse web pages, and access streaming media through the WiFi module 570. It provides users with wireless broadband Internet access. Although FIG. 5 shows a WiFi module 570, it can be understood that it is not an essential component of the terminal 500, and can be completely omitted as required without changing the essence of the invention.
处理器580是终端500的控制中心，利用各种接口和线路连接整个终端的各个部分，通过运行或执行存储在存储器520内的软件程序和/或模块，以及调用存储在存储器520内的数据，执行存储设备的各种功能和处理数据，从而对存储设备进行整体监控。可选的，处理器580可包括一个或多个处理核心；优选的，处理器580可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器580中。The processor 580 is the control center of the terminal 500, using various interfaces and lines to connect various parts of the entire terminal, by running or executing software programs and/or modules stored in the memory 520, and calling data stored in the memory 520, Execute various functions of the storage device and process data, so as to monitor the storage device as a whole. Optionally, the processor 580 may include one or more processing cores; preferably, the processor 580 may integrate an application processor and a modem processor, wherein the application processor mainly processes operating systems, user interfaces, and application programs, etc. , the modem processor mainly handles wireless communications. It can be understood that the foregoing modem processor may not be integrated into the processor 580 .
终端500还包括给各个部件供电的电源590(比如电池)，优选的，电源可以通过电源管理系统与处理器580逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。电源590还可以包括一个或一个以上的直流或交流电源、再充电系统、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。The terminal 500 also includes a power supply 590 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 580 through the power management system, so that functions such as charging, discharging, and power consumption management can be implemented through the power management system. The power supply 590 may also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators, and other arbitrary components.
尽管未示出，终端500还可以包括摄像头、蓝牙模块等，在此不再赘述。具体在本实施例中，终端500包括有存储器520，以及一个或者一个以上的程序，其中一个或者一个以上程序存储于存储器520中，且经配置以由一个或者一个以上处理器580执行上述一个或者一个以上程序包含用于进行以下操作的指令：Although not shown, the terminal 500 may also include a camera, a Bluetooth module, etc., which will not be repeated here. Specifically, in this embodiment, the terminal 500 includes a memory 520, and one or more programs, wherein one or more programs are stored in the memory 520, and are configured to be executed by one or more processors 580. More than one program contains instructions for:
获取可信应用向目标服务器发起的连接请求，所述连接请求中包含目标服务器的标识；Acquiring a connection request initiated by the trusted application to the target server, where the connection request includes the identity of the target server;
通过调制解调器获取智能卡中存储的服务器列表；Obtain the list of servers stored in the smart card via a modem;
根据目标服务器的标识判断目标服务器是否包含在服务器列表中；Judging whether the target server is included in the server list according to the identification of the target server;
若是，则允许可信应用与目标服务器建立连接，若否，则拒绝可信应用与目标服务器建立连接。If yes, allow the trusted application to establish a connection with the target server; if not, deny the trusted application to establish a connection with the target server.
需要说明的是，本发明实施例提供的终端500，还可以用于实现上述装置实施例中的其它功能，在此不再赘述。It should be noted that the terminal 500 provided in the embodiment of the present invention can also be used to implement other functions in the above device embodiments, which will not be repeated here.
本发明实施例还提供了一种提升可信执行环境TEE安全性的系统，请参阅图6，所述系统包括终端601，智能卡602及服务器603。其中：The embodiment of the present invention also provides a system for improving the security of the trusted execution environment TEE, please refer to FIG. 6 , the system includes a terminal 601 , a smart card 602 and a server 603 . in:
终端601用于，获取可信应用向目标服务器发起的连接请求，连接请求中包含目标服务器的标识；通过调制解调器获取智能卡中存储的服务器列表；根据目标服务器的标识判断目标服务器是否包含在服务器列表中；若是，则允许可信应用与目标服务器建立连接，若否，则拒绝可信应用与目标服务器建立连接；终端601支持可信执行环境TEE，可信应用执行在可信执行环境中；The terminal 601 is used to obtain the connection request initiated by the trusted application to the target server, and the connection request includes the identification of the target server; obtain the server list stored in the smart card through the modem; judge whether the target server is included in the server list according to the identification of the target server ; If yes, allow the trusted application to establish a connection with the target server, if not, deny the trusted application to establish a connection with the target server; the terminal 601 supports the trusted execution environment TEE, and the trusted application is executed in the trusted execution environment;
智能卡602用于，存储服务器列表；The smart card 602 is used to store the server list;
服务器603用于，在目标服务器包含在服务器列表中时，与可信应用建立连接。The server 603 is used to establish a connection with the trusted application when the target server is included in the server list.
另外，本实施例中的终端601，还可以用于实现上述装置实施例中的其它功能，在此不再赘述。In addition, the terminal 601 in this embodiment can also be used to implement other functions in the above device embodiments, which will not be repeated here.
以上实施例中，都是以智能卡与终端独立存在为例进行说明的，在实际应用中，智能卡也可包含在终端中，例如，智能卡为SIM卡，终端为手机，SIM插在手机的卡槽中，此处不做具体限定。In the above embodiments, the smart card and the terminal are taken as an example for illustration. In practical applications, the smart card can also be included in the terminal. For example, the smart card is a SIM card, the terminal is a mobile phone, and the SIM is inserted into the card slot of the mobile phone. , without specific limitations here.
需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本发明提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。It should be noted that the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physically separated. A unit can be located in one place, or it can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that they have a communication connection, which can be specifically implemented as one or more communication buses or signal lines. It can be understood and implemented by those skilled in the art without creative effort.
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本发明而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘，U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be realized by means of software plus necessary general-purpose hardware. Special components, etc. to achieve. In general, all functions completed by computer programs can be easily realized by corresponding hardware, and the specific hardware structure used to realize the same function can also be varied, such as analog circuits, digital circuits or special-purpose circuit etc. However, software program implementation is a better implementation mode for the present invention in most cases. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a floppy disk of a computer , U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, etc., including several instructions to make a computer device (which can be A personal computer, a server, or a network device, etc.) executes the methods described in various embodiments of the present invention.
以上对本发明实施例所提供的一种提升可信执行环境TEE安全性及系统、终端进行了详细介绍，对于本领域的一般技术人员，依据本发明实施例的思想，在具体实施方式及应用范围上均会有改变之处，因此，本说明书内容不应理解为对本发明的限制。The above is a detailed introduction to the TEE security enhancement system and terminal provided by the embodiment of the present invention. For those of ordinary skill in the art, based on the idea of the embodiment of the present invention, in the specific implementation and application scope There will be changes in all the above, therefore, the content of this specification should not be construed as limiting the present invention.
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410308622.0ACN104125216B (en) | 2014-06-30 | 2014-06-30 | A kind of method, system and terminal for lifting credible performing environment security |
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410308622.0ACN104125216B (en) | 2014-06-30 | 2014-06-30 | A kind of method, system and terminal for lifting credible performing environment security |
| Publication Number | Publication Date |
|---|---|
| CN104125216Atrue CN104125216A (en) | 2014-10-29 |
| CN104125216B CN104125216B (en) | 2017-12-15 |
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410308622.0AActiveCN104125216B (en) | 2014-06-30 | 2014-06-30 | A kind of method, system and terminal for lifting credible performing environment security |
| Country | Link |
|---|---|
| CN (1) | CN104125216B (en) |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105447387A (en)* | 2015-11-05 | 2016-03-30 | 工业和信息化部电信研究院 | Trusted application detection method and apparatus based on hardware isolation environment |
| CN105631364A (en)* | 2015-05-20 | 2016-06-01 | 宇龙计算机通信科技(深圳)有限公司 | Security property switching method, security property switching apparatus and terminal |
| CN105656890A (en)* | 2015-12-30 | 2016-06-08 | 深圳数字电视国家工程实验室股份有限公司 | FIDO (Fast Identity Online) authenticator, system and method based on TEE (Trusted Execution Environment) and wireless confirmation |
| CN105678183A (en)* | 2015-12-30 | 2016-06-15 | 青岛海信移动通信技术股份有限公司 | User data management method and device for intelligent terminal |
| CN105809036A (en)* | 2016-04-01 | 2016-07-27 | 中国银联股份有限公司 | TEE access control method and mobile terminal for achieving same |
| CN105978917A (en)* | 2016-07-19 | 2016-09-28 | 恒宝股份有限公司 | System and method for trusted application security authentication |
| CN106102054A (en)* | 2016-05-27 | 2016-11-09 | 深圳市雪球科技有限公司 | A kind of method and communication system that safe unit is carried out safety management |
| CN106200891A (en)* | 2015-05-08 | 2016-12-07 | 阿里巴巴集团控股有限公司 | The display method of user interface, Apparatus and system |
| CN106453196A (en)* | 2015-08-04 | 2017-02-22 | 中国移动通信集团公司 | Secret key writing device, system and method for trusted execution environment |
| CN106936774A (en)* | 2015-12-29 | 2017-07-07 | 中国电信股份有限公司 | Authentication method and system in credible performing environment |
| CN107077565A (en)* | 2015-11-25 | 2017-08-18 | 华为技术有限公司 | Method and device for configuring safety indication information |
| CN107111715A (en)* | 2014-12-16 | 2017-08-29 | 英特尔公司 | Credible performing environment is used for the security of code and data |
| CN107211026A (en)* | 2015-03-22 | 2017-09-26 | 苹果公司 | It is intended to the method and apparatus of checking for the user authentication in mobile device and the mankind |
| CN107592964A (en)* | 2015-06-09 | 2018-01-16 | 英特尔公司 | Systems, devices and methods for the multiple-owner transfer of the ownership of equipment |
| CN107924449A (en)* | 2016-03-18 | 2018-04-17 | 华为技术有限公司 | A kind of notification message processing method, device and terminal |
| CN108235767A (en)* | 2016-11-03 | 2018-06-29 | 华为技术有限公司 | A kind of partition method, device and terminal for paying application |
| CN108614711A (en)* | 2018-04-20 | 2018-10-02 | 北京握奇智能科技有限公司 | TA mirrored storages method, apparatus and terminal |
| CN109005029A (en)* | 2018-06-25 | 2018-12-14 | 北京迪曼森科技有限公司 | Trusted application mark generation method and system, application method and apply end equipment |
| CN109150900A (en)* | 2018-09-18 | 2019-01-04 | 温州职业技术学院 | A kind of information security of computer network system |
| WO2019051935A1 (en)* | 2017-09-18 | 2019-03-21 | Huawei Technologies Co., Ltd. | Securing delegated credentials in third-party networks |
| CN109831775A (en)* | 2019-02-02 | 2019-05-31 | 华为技术有限公司 | A kind of processor, baseband chip and SIM card information transmission method |
| CN110176987A (en)* | 2016-02-02 | 2019-08-27 | 阿里巴巴集团控股有限公司 | A kind of method, apparatus, equipment and the computer storage medium of equipment certification |
| US10432611B2 (en) | 2015-08-07 | 2019-10-01 | Alibaba Group Holding Limited | Transaction processing method and client based on trusted execution environment |
| CN110941825A (en)* | 2019-12-13 | 2020-03-31 | 支付宝(杭州)信息技术有限公司 | Application monitoring method and device |
| CN110971591A (en)* | 2015-03-16 | 2020-04-07 | 阿里巴巴集团控股有限公司 | Method and system for multi-process access to trusted application |
| CN111712815A (en)* | 2018-08-14 | 2020-09-25 | 华为技术有限公司 | Artificial intelligence AI processing method and AI processing device |
| CN112329071A (en)* | 2020-12-16 | 2021-02-05 | 支付宝(杭州)信息技术有限公司 | Privacy data processing method, system, device and equipment |
| CN112784249A (en)* | 2021-01-25 | 2021-05-11 | 公安部第三研究所 | Method, system, processor and computer readable storage medium for implementing mobile terminal authentication processing under non-identification condition |
| CN112926046A (en)* | 2021-03-26 | 2021-06-08 | 公安部第三研究所 | Method and system for authenticating anonymous identification information of mobile terminal equipment for protecting equipment identification information |
| WO2021164166A1 (en)* | 2020-02-20 | 2021-08-26 | 苏州浪潮智能科技有限公司 | Service data protection method, apparatus and device, and readable storage medium |
| CN113572789A (en)* | 2021-08-17 | 2021-10-29 | 四川启睿克科技有限公司 | Secret-free login system and method for Internet of things intelligent equipment application |
| CN115048642A (en)* | 2021-11-29 | 2022-09-13 | 荣耀终端有限公司 | Communication method between trusted applications in multiple trusted execution environments and electronic equipment |
| WO2023174393A1 (en)* | 2022-03-18 | 2023-09-21 | 维沃移动通信有限公司 | Security evaluation method and apparatus, electronic device, and readable storage medium |
| CN118611989A (en)* | 2024-08-07 | 2024-09-06 | 南京南自华盾数字技术有限公司 | A communication method, device, equipment and storage medium for power generation control system |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101867966A (en)* | 2009-04-16 | 2010-10-20 | 中兴通讯股份有限公司 | Method for reporting measurement report of closed user group cell |
| CN102111477A (en)* | 2011-02-25 | 2011-06-29 | 宇龙计算机通信科技(深圳)有限公司 | Method, terminal and smart card for terminal security verification |
| CN102542698A (en)* | 2011-12-27 | 2012-07-04 | 浙江省电力公司 | Safety protective method of electric power mobile payment terminal |
| CN102573015A (en)* | 2008-05-31 | 2012-07-11 | 华为技术有限公司 | Network selection method, system and device |
| US20130109352A1 (en)* | 2011-10-27 | 2013-05-02 | T-Mobile USA, Inc | Mobile Device-Type Locking |
| WO2014040724A1 (en)* | 2012-09-11 | 2014-03-20 | Giesecke & Devrient Gmbh | Content management for mobile station with runtime environment |
| CN103745155A (en)* | 2014-01-03 | 2014-04-23 | 东信和平科技股份有限公司 | Credible Key and safe operation method thereof |
| CN103793815A (en)* | 2014-01-23 | 2014-05-14 | 武汉天喻信息产业股份有限公司 | Mobile intelligent terminal acquirer system and method suitable for bank cards and business cards |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102573015A (en)* | 2008-05-31 | 2012-07-11 | 华为技术有限公司 | Network selection method, system and device |
| CN101867966A (en)* | 2009-04-16 | 2010-10-20 | 中兴通讯股份有限公司 | Method for reporting measurement report of closed user group cell |
| CN102111477A (en)* | 2011-02-25 | 2011-06-29 | 宇龙计算机通信科技(深圳)有限公司 | Method, terminal and smart card for terminal security verification |
| US20130109352A1 (en)* | 2011-10-27 | 2013-05-02 | T-Mobile USA, Inc | Mobile Device-Type Locking |
| CN102542698A (en)* | 2011-12-27 | 2012-07-04 | 浙江省电力公司 | Safety protective method of electric power mobile payment terminal |
| WO2014040724A1 (en)* | 2012-09-11 | 2014-03-20 | Giesecke & Devrient Gmbh | Content management for mobile station with runtime environment |
| CN103745155A (en)* | 2014-01-03 | 2014-04-23 | 东信和平科技股份有限公司 | Credible Key and safe operation method thereof |
| CN103793815A (en)* | 2014-01-23 | 2014-05-14 | 武汉天喻信息产业股份有限公司 | Mobile intelligent terminal acquirer system and method suitable for bank cards and business cards |
| Title |
|---|
| ZAHEER AHMAD ET AL: "Enhancing the Security of Mobile Applications by Using TEE and (U)SIM", 《2013 IEEE 10TH INTERNATION CONFERENCE ON AND 10TH INTERNATIONAL CONFERENCE ON AUTONOMIC AND TRUSTED COMPUTING (UIC/ATC)》* |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107111715A (en)* | 2014-12-16 | 2017-08-29 | 英特尔公司 | Credible performing environment is used for the security of code and data |
| CN107111715B (en)* | 2014-12-16 | 2020-11-10 | 英特尔公司 | Using a trusted execution environment for security of code and data |
| CN110971591A (en)* | 2015-03-16 | 2020-04-07 | 阿里巴巴集团控股有限公司 | Method and system for multi-process access to trusted application |
| CN110971591B (en)* | 2015-03-16 | 2022-04-05 | 创新先进技术有限公司 | Method and system for multi-process access to trusted application |
| US10856148B2 (en) | 2015-03-22 | 2020-12-01 | Apple Inc. | Methods and apparatus for user authentication and human intent verification in mobile devices |
| CN107211026B (en)* | 2015-03-22 | 2021-01-08 | 苹果公司 | Method and apparatus for user authentication and human intent verification in mobile devices |
| CN107211026A (en)* | 2015-03-22 | 2017-09-26 | 苹果公司 | It is intended to the method and apparatus of checking for the user authentication in mobile device and the mankind |
| US10788984B2 (en) | 2015-05-08 | 2020-09-29 | Alibaba Group Holding Limited | Method, device, and system for displaying user interface |
| CN106200891B (en)* | 2015-05-08 | 2019-09-06 | 阿里巴巴集团控股有限公司 | Show the method, apparatus and system of user interface |
| CN106200891A (en)* | 2015-05-08 | 2016-12-07 | 阿里巴巴集团控股有限公司 | The display method of user interface, Apparatus and system |
| CN105631364A (en)* | 2015-05-20 | 2016-06-01 | 宇龙计算机通信科技(深圳)有限公司 | Security property switching method, security property switching apparatus and terminal |
| CN107592964B (en)* | 2015-06-09 | 2021-05-28 | 英特尔公司 | System, apparatus and method for multi-owner transfer of ownership of a device |
| CN107592964A (en)* | 2015-06-09 | 2018-01-16 | 英特尔公司 | Systems, devices and methods for the multiple-owner transfer of the ownership of equipment |
| CN106453196B (en)* | 2015-08-04 | 2020-01-07 | 中国移动通信集团公司 | A key writing device, system and method for trusted execution environment |
| CN106453196A (en)* | 2015-08-04 | 2017-02-22 | 中国移动通信集团公司 | Secret key writing device, system and method for trusted execution environment |
| US10432611B2 (en) | 2015-08-07 | 2019-10-01 | Alibaba Group Holding Limited | Transaction processing method and client based on trusted execution environment |
| CN105447387A (en)* | 2015-11-05 | 2016-03-30 | 工业和信息化部电信研究院 | Trusted application detection method and apparatus based on hardware isolation environment |
| CN105447387B (en)* | 2015-11-05 | 2018-06-19 | 工业和信息化部电信研究院 | The method and device of trusted application detection based on hardware isolated environment |
| CN107077565B (en)* | 2015-11-25 | 2019-11-26 | 华为技术有限公司 | A kind of configuration method and equipment of safety instruction information |
| US11100227B2 (en) | 2015-11-25 | 2021-08-24 | Huawei Technologies Co., Ltd. | Security indication information configuration method and device |
| CN107077565A (en)* | 2015-11-25 | 2017-08-18 | 华为技术有限公司 | Method and device for configuring safety indication information |
| CN106936774B (en)* | 2015-12-29 | 2020-02-18 | 中国电信股份有限公司 | Authentication method and system in trusted execution environment |
| CN106936774A (en)* | 2015-12-29 | 2017-07-07 | 中国电信股份有限公司 | Authentication method and system in credible performing environment |
| CN105656890A (en)* | 2015-12-30 | 2016-06-08 | 深圳数字电视国家工程实验室股份有限公司 | FIDO (Fast Identity Online) authenticator, system and method based on TEE (Trusted Execution Environment) and wireless confirmation |
| CN105656890B (en)* | 2015-12-30 | 2018-11-06 | 深圳数字电视国家工程实验室股份有限公司 | A kind of FIDO authenticators and system and method based on TEE and without line justification |
| CN105678183A (en)* | 2015-12-30 | 2016-06-15 | 青岛海信移动通信技术股份有限公司 | User data management method and device for intelligent terminal |
| CN105678183B (en)* | 2015-12-30 | 2018-09-18 | 青岛海信移动通信技术股份有限公司 | A kind of user data management and device of intelligent terminal |
| CN110176987A (en)* | 2016-02-02 | 2019-08-27 | 阿里巴巴集团控股有限公司 | A kind of method, apparatus, equipment and the computer storage medium of equipment certification |
| CN107924449A (en)* | 2016-03-18 | 2018-04-17 | 华为技术有限公司 | A kind of notification message processing method, device and terminal |
| CN107924449B (en)* | 2016-03-18 | 2020-03-10 | 华为技术有限公司 | Notification message processing method and device and terminal |
| CN105809036B (en)* | 2016-04-01 | 2019-05-10 | 中国银联股份有限公司 | A TEE access control method and mobile terminal implementing the method |
| CN105809036A (en)* | 2016-04-01 | 2016-07-27 | 中国银联股份有限公司 | TEE access control method and mobile terminal for achieving same |
| CN106102054A (en)* | 2016-05-27 | 2016-11-09 | 深圳市雪球科技有限公司 | A kind of method and communication system that safe unit is carried out safety management |
| CN105978917A (en)* | 2016-07-19 | 2016-09-28 | 恒宝股份有限公司 | System and method for trusted application security authentication |
| US11762983B2 (en) | 2016-11-03 | 2023-09-19 | Huawei Technologies Co., Ltd. | Payment application isolation method and apparatus, and terminal |
| CN108235767A (en)* | 2016-11-03 | 2018-06-29 | 华为技术有限公司 | A kind of partition method, device and terminal for paying application |
| US10511575B2 (en) | 2017-09-18 | 2019-12-17 | Huawei Technologies Co., Ltd. | Securing delegated credentials in third-party networks |
| WO2019051935A1 (en)* | 2017-09-18 | 2019-03-21 | Huawei Technologies Co., Ltd. | Securing delegated credentials in third-party networks |
| CN108614711A (en)* | 2018-04-20 | 2018-10-02 | 北京握奇智能科技有限公司 | TA mirrored storages method, apparatus and terminal |
| CN109005029B (en)* | 2018-06-25 | 2019-08-16 | 北京迪曼森科技有限公司 | Trusted application mark generation method and system, application method and apply end equipment |
| CN109005029A (en)* | 2018-06-25 | 2018-12-14 | 北京迪曼森科技有限公司 | Trusted application mark generation method and system, application method and apply end equipment |
| CN111712815A (en)* | 2018-08-14 | 2020-09-25 | 华为技术有限公司 | Artificial intelligence AI processing method and AI processing device |
| US11954204B2 (en) | 2018-08-14 | 2024-04-09 | Huawei Technologies Co., Ltd. | Artificial intelligence AI processing method and AI processing apparatus |
| CN109150900A (en)* | 2018-09-18 | 2019-01-04 | 温州职业技术学院 | A kind of information security of computer network system |
| CN109831775B (en)* | 2019-02-02 | 2021-12-03 | 华为数字技术（苏州）有限公司 | Processor, baseband chip and SIM card information transmission method |
| CN109831775A (en)* | 2019-02-02 | 2019-05-31 | 华为技术有限公司 | A kind of processor, baseband chip and SIM card information transmission method |
| CN110941825B (en)* | 2019-12-13 | 2022-05-27 | 支付宝(杭州)信息技术有限公司 | Application monitoring method and device |
| CN110941825A (en)* | 2019-12-13 | 2020-03-31 | 支付宝(杭州)信息技术有限公司 | Application monitoring method and device |
| WO2021164166A1 (en)* | 2020-02-20 | 2021-08-26 | 苏州浪潮智能科技有限公司 | Service data protection method, apparatus and device, and readable storage medium |
| CN112329071A (en)* | 2020-12-16 | 2021-02-05 | 支付宝(杭州)信息技术有限公司 | Privacy data processing method, system, device and equipment |
| CN112329071B (en)* | 2020-12-16 | 2024-06-04 | 支付宝(杭州)信息技术有限公司 | Privacy data processing method, system, device and equipment |
| CN112784249A (en)* | 2021-01-25 | 2021-05-11 | 公安部第三研究所 | Method, system, processor and computer readable storage medium for implementing mobile terminal authentication processing under non-identification condition |
| CN112784249B (en)* | 2021-01-25 | 2024-03-22 | 公安部第三研究所 | Method, system, processor and computer readable storage medium for implementing mobile terminal authentication processing under no-identification condition |
| CN112926046A (en)* | 2021-03-26 | 2021-06-08 | 公安部第三研究所 | Method and system for authenticating anonymous identification information of mobile terminal equipment for protecting equipment identification information |
| CN112926046B (en)* | 2021-03-26 | 2024-04-19 | 公安部第三研究所 | Mobile terminal equipment anonymous identification information authentication method for protecting equipment identification information |
| CN113572789A (en)* | 2021-08-17 | 2021-10-29 | 四川启睿克科技有限公司 | Secret-free login system and method for Internet of things intelligent equipment application |
| CN115048642A (en)* | 2021-11-29 | 2022-09-13 | 荣耀终端有限公司 | Communication method between trusted applications in multiple trusted execution environments and electronic equipment |
| CN115048642B (en)* | 2021-11-29 | 2023-04-25 | 荣耀终端有限公司 | Communication method between trusted applications in multi-trusted execution environment and electronic equipment |
| WO2023174393A1 (en)* | 2022-03-18 | 2023-09-21 | 维沃移动通信有限公司 | Security evaluation method and apparatus, electronic device, and readable storage medium |
| CN118611989A (en)* | 2024-08-07 | 2024-09-06 | 南京南自华盾数字技术有限公司 | A communication method, device, equipment and storage medium for power generation control system |
| Publication number | Publication date |
|---|---|
| CN104125216B (en) | 2017-12-15 |
| Publication | Publication Date | Title |
|---|---|---|
| CN104125216B (en) | A kind of method, system and terminal for lifting credible performing environment security | |
| US12041165B2 (en) | Key updating method, apparatus, and system | |
| US9635018B2 (en) | User identity verification method and system, password protection apparatus and storage medium | |
| EP3200487B1 (en) | Message processing method and apparatus | |
| WO2017185711A1 (en) | Method, apparatus and system for controlling smart device, and storage medium | |
| WO2014108005A1 (en) | Co-verification method, two-dimensional code generation method, and device and system therefor | |
| CN109416800B (en) | A kind of authentication method of mobile terminal and mobile terminal | |
| US10454905B2 (en) | Method and apparatus for encrypting and decrypting picture, and device | |
| CN108475304B (en) | A method, device and mobile terminal for associating application program and biometric feature | |
| WO2015078274A1 (en) | Devices and methods for password storage | |
| CN106791168A (en) | Information of mobile terminal guard method, device and mobile terminal | |
| CN106255102B (en) | Terminal equipment identification method and related equipment | |
| CN107480518A (en) | A kind of white list updating method and device | |
| CN106845177A (en) | Cipher management method and system | |
| CN106528334A (en) | Data backup method and device | |
| CN106096393A (en) | Application program control method and device | |
| CN106534324A (en) | Data sharing method and cloud server | |
| CN107423099B (en) | Key code programming method, server, terminal, key code programming system and storage medium | |
| CN107153792A (en) | A kind of data safety processing method, device and mobile terminal | |
| US10764038B2 (en) | Method and apparatus for generating terminal key | |
| CN107925565B (en) | Algorithm updating method, equipment to be updated and server | |
| CN108737341B (en) | Service processing method, terminal and server | |
| CN106657214A (en) | Data migration method and terminal | |
| CN107092819A (en) | A kind of fingerprint typing method of inspection and device | |
| CN104683555B (en) | Message management method and device |
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |