WO2017047904A1

WO2017047904A1 - Method and apparatus for installation of trusted application in electronic device

Info

Publication number: WO2017047904A1
Application number: PCT/KR2016/005388
Authority: WO
Inventors: 야우아놀드; 한찬규; 선크술라사다
Original assignee: 삼성전자 주식회사
Priority date: 2015-09-15
Filing date: 2016-05-20
Publication date: 2017-03-23

Abstract

Disclosed is a method for the installation of an application in an electronic device, comprising the steps of: obtaining an application package for the installation of an application; determining whether the application package comprises a trusted application which can be installed in an electronic device; and installing, when the application package comprises a trusted application, the trusted application in the electronic device.

Description

Method and apparatus for installing a trusted application on an electronic device

The present disclosure is directed to a method and apparatus for installing a trusted application (TA) on an electronic device.

Conventional mobile applications or apps are executed based on a mobile operating system (OS). Running applications can be isolated from each other by the kernel of the operating system, so that the security of the application can be guaranteed to some extent. However, the security of the application depends on the operating system, which can be contaminated by malware. Therefore, applications that handle sensitive and private data require higher security levels.

A trusted application is an application that provides security services to applications running on a normal OS, such as mobile banking applications. An application can increase its security level by using a trusted application.

Trusted applications can be distributed and managed to client devices through a server-based system called a Trusted Services Manager (TSM). However, server-based systems such as TSM can take a long time to deploy, can be expensive to set up, and can incur overhead in management. Thus, there is a need for a more convenient mechanism for distributing and managing trusted applications.

The present disclosure relates to a method of installing a trusted application in an electronic device, and more particularly, to a method of installing a trusted application in an electronic device by using a method of distributing and installing an existing application.

According to an embodiment, a trusted application may be distributed to one or more electronic devices using an application package without necessarily having a server-based system for distributing trusted applications to one or more electronic devices.

1 is a block diagram illustrating a system for distributing trusted applications, according to one embodiment.

2 is a block diagram illustrating an internal structure of a processor in which a trusted application is installed, according to an embodiment.

3 and 4 are flowcharts illustrating a method of installing a trusted application according to an exemplary embodiment.

5 is a block diagram illustrating an apparatus for distributing a trusted application to an electronic device, according to an embodiment.

6 is a block diagram illustrating an application package including a plurality of trusted applications of different types according to an embodiment.

7 is a block diagram illustrating a system including paired electronic devices according to an embodiment.

8 is a flowchart illustrating a method of transmitting a trusted application to another electronic device paired with an electronic device according to an embodiment.

9 is a flowchart illustrating a method of distributing an application package including a trusted application according to an embodiment.

10 is a block diagram illustrating an electronic device in which an application is installed, according to an exemplary embodiment.

According to an embodiment, a method of installing an application in an electronic device includes: obtaining an application package for installing the application; Determining whether the application package includes a trusted application that can be installed on the electronic device; And if the application package includes the trusted application, installing the trusted application on the electronic device.

The installing may include installing in the security area of the electronic device based on a type of the security area of the electronic device when the application package includes a plurality of trusted applications respectively corresponding to different types of security areas. Selecting a trusted application that can be trusted; Installing the selected trusted application in a secure area of the electronic device.

Determining whether the application package includes a trusted application that can be installed on another electronic device; And if the application package includes a trusted application that can be installed on the other electronic device, sending the trusted application to the other electronic device.

Extracting, from the application package, a second application package that can be installed in the other electronic device; And transmitting the extracted second application package to the other electronic device.

The other electronic device includes a wearable electronic device paired with the electronic device.

The determining may include obtaining a flag value indicating whether to include the trusted application in the application package; And determining whether the application package includes a trusted application that can be installed in a security area of the electronic device based on the obtained flag value.

According to an embodiment, an electronic device in which an application is installed may include a network interface for obtaining an application package for installing the application; Determine whether the application package includes a trusted application that can be installed on the electronic device, and if the application package includes the trusted application, install the trusted application on the electronic device. It includes a processor.

According to an embodiment of the present disclosure, a method of distributing an application to an electronic device includes: obtaining a normal application to be installed on the electronic device and a trusted application to be installed on the electronic device; Combining the normal application and the trusted application into an application package; And transmitting the application package to the electronic device.

In one embodiment, a computer-readable recording medium having recorded thereon a program for implementing a method of installing an application on an electronic device.

Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present disclosure. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In addition, in order to clearly describe the present disclosure in the drawings, irrelevant parts are omitted, and like reference numerals designate like parts throughout the specification.

The terms used in the present disclosure are described as general terms currently used in consideration of the functions mentioned in the present disclosure, but they may mean various other terms according to the intention or precedent of a person skilled in the art, the emergence of new technologies, and the like. Can be. Therefore, the terms used in the present disclosure should not be interpreted only by the names of the terms, but should be interpreted based on the meanings of the terms and the contents throughout the present disclosure.

Also, terms such as first and second may be used to describe various components, but the components should not be limited by these terms. These terms are used to distinguish one component from another.

Also, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. Expression in the singular includes the plural unless the context clearly indicates the singular. In addition, when a part is said to "include" a certain component, this means that it may further include other components, without excluding other components unless otherwise stated. As used herein and in the claims, in particular, the above and the like, may refer to both the singular and the plural. In addition, if there is no description explicitly specifying the order of steps describing the method according to the present disclosure, the described steps may be performed in a suitable order. The present disclosure is not limited to the order of description of the described steps.

The phrases “in some embodiments” or “in one embodiment” appearing in various places in the specification are not necessarily all referring to the same embodiment.

Some embodiments of the present disclosure may be represented by functional block configurations and various processing steps. Some or all of these functional blocks may be implemented in various numbers of hardware and / or software configurations that perform particular functions. For example, the functional blocks of the present disclosure may be implemented by one or more microprocessors or by circuit configurations for a given function. In addition, for example, the functional blocks of the present disclosure may be implemented in various programming or scripting languages. The functional blocks may be implemented in algorithms running on one or more processors. In addition, the present disclosure may employ the prior art for electronic configuration, signal processing, and / or data processing. Terms such as "mechanism", "element", "means" and "configuration" may be used broadly and are not limited to mechanical and physical configurations.

In addition, the connecting lines or connecting members between the components shown in the drawings are merely illustrative of functional connections and / or physical or circuit connections. In an actual device, the connections between components may be represented by various functional connections, physical connections, or circuit connections that are replaceable or added.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings.

Referring to FIG. 1, a system for distributing trusted applications includes an electronic device 100, an application distribution service apparatus 110, and a network 120.

The application distribution service apparatus 110 may transmit an application package for installing an application to the electronic device to the at least one electronic device 100 through the network 120. The application distribution service apparatus 110 may transmit an application package to the electronic device 100 according to a request of the electronic device 100.

The electronic device 100 includes a processor 101, a network interface 102 for connecting to a network, and a memory 103 for storing a computer program that can be executed by the processor 101. The processor 101 may include at least one of a rich OS environment 101a and a trusted execution environment (TEE) 101b shown in FIG. 2. Rich OS environment 101a and trusted execution environment 101b may provide an environment in which normal and trusted applications can run. Hereinafter, an application installed in the rich OS environment 101a will be referred to as a normal application.

The memory 103 may include a computer readable recording medium. The memory 103 of the electronic device 100 includes an application manager 104 and a trusted application installation service unit 105. In an embodiment, the application manager 104 and the trusted application installation service unit 105 may be software programs stored in the memory 103. In addition, the application manager 104 and the trusted application installation service unit 105 may be embedded in the electronic device 100.

The application manager 104 may obtain an application package from the application distribution service device 110. The application package may include a normal application that may be installed in the rich OS environment 101a.

The trusted application installation service unit 105 may check whether the application package obtained from the application distribution service apparatus 110 includes a trusted application. When the application package includes a trusted application, the trusted application installation service unit 105 may extract the trusted application from the application package and install the trusted application in the trusted execution environment 101b.

The trusted application installation service unit 105 may be provided in advance in the electronic device 100 by the manufacturer of the electronic device 100. Accordingly, the trusted application installation service unit 105 may be provided in the electronic device 100 to be adapted to the architecture of the trusted execution environment 101b. The trusted application installation service unit 105 may extract a trusted application from the application package and install the trusted application. Therefore, according to an embodiment, a separate server-based system for distributing and managing a trusted application to the plurality of electronic devices 100 may not be required.

Referring to FIG. 2, the processor 101 of the electronic device 100 may include at least one of a rich OS environment 101a and a trusted execution environment 101b on which a normal application and a trusted application may be installed and executed, respectively. Can be.

In the rich OS environment 101a, a normal application can be executed on an operating system (OS). The rich OS environment 101a may include an operating system on which conventional normal applications of the electronic device 100 may run. The normal applications executed in the rich OS environment 101a may be isolated from each other by the operating system and executed. Thus, normal applications can be protected against external attacks. However, since the operating system of the rich OS environment 101a is not relatively high in security level, there is a possibility that the operating system of the rich OS environment 101a is contaminated by malware. Since the security level of the application is dependent on the underlying operating system, if the operating system of the rich OS environment 101a is contaminated, the normal application is also likely to be contaminated. Thus, in the rich OS environment 101a, processes that handle relatively insignificant data may be performed by the normal application.

In the trusted execution environment (TEE) 101b, a trusted application can be executed on a secure operating system (OS). The security operating system further includes additional security features and can strongly control external access to trusted execution environments. The trusted execution environment 101b may include a secure operating system to provide an isolated environment in which trusted applications can run.

Rich OS environment 101a and trusted execution environment 101b may be separate operating system environments that run in parallel. As the data flow between the rich OS environment 101a and the trusted execution environment 101b is strictly controlled, the data of the trusted execution environment 101b can be protected. External access to trusted execution environment 101b as compared to rich OS environment 101a may be strictly limited for the protection of data processed in trusted execution environment 101b.

The trusted application can be invoked and executed by one or more normal applications running on the operating system of the rich OS environment 101a. For example, a mobile banking application may request access to a trusted application to process sensitive and sensitive data, such as private information of a user.

Referring to FIG. 3, in operation S310, the electronic device 100 may obtain an application package for installing an application in the electronic device 100 through the network 120. According to an embodiment, the application package may include a normal application installed in the rich OS environment 101a.

In operation S320, the electronic device 100 may determine whether the application package obtained in operation S310 includes a trusted application. For example, the electronic device 100 may determine whether the application package includes a trusted application based on a flag value indicating whether a trusted application is included. The flag may be included in the application package. According to an embodiment, regardless of whether the application package includes a trusted application, the electronic device 100 may install a normal application in the rich OS environment 101a using the application package.

In operation S330, when the application package includes a trusted application, the electronic device 100 may extract a trusted application from the application package and install the installed application in the electronic device 100. For example, the trusted application may be installed in the secure area of the electronic device 100. The secure area of the electronic device 100 may provide a high security level environment to trusted applications. For example, the security zone may include a trusted execution environment 101b. Trusted execution environment 101b can provide a highly secure environment to trusted applications by strictly restricting access from the outside. Trusted applications can be installed in the security domain to handle sensitive and sensitive data in high security environments.

Referring to FIG. 4, an embodiment of a method of installing a trusted application will be further described.

Referring to FIG. 4, in operation S410, the electronic device 100 may obtain an application package for installing an application in the electronic device 100 through the network 120.

For example, the electronic device 100 may access an app store provided by the application distribution service apparatus 110. The app store may provide the electronic device 100 with at least one of information about an application installed in the electronic device 100 and information about a new application that may be installed in the electronic device 100. When an application to be installed in the electronic device 100 is selected, the electronic device 100 may download an application package for installing the selected application in the electronic device 100 through the app store.

In operation S420, the electronic device 100 may install a normal application in the rich OS environment 101a using an application package.

In operation S430, when the normal application is installed in the rich OS environment 101a, the electronic device 100 may recognize that a new application is installed in the rich OS environment 101a. For example, the electronic device 100 may use 'New App Installed' (“android.intent.action.PACKAGE_ADDED”) that is an event notification indicating that a new application is installed. 'New App Installed' (“android.intent.action.PACKAGE_ADDED”) may be used by the electronic device 100 to recognize that a new application is installed. The above-described event notification is merely an example, and different types of event notifications may be used according to the type of OS used in the electronic device 100.

In operation S440, in response to an event notification indicating that a new application is installed, the electronic device 100 may determine whether an application package of a new application installed in the rich OS environment 101a includes a trusted application. For example, the electronic device 100 may determine whether the application package includes a trusted application based on a flag value indicating whether the application package includes a trusted application. In one embodiment, if the application package does not include a trusted application, installation of the trusted application is not necessary, so the installation of the application may be terminated.

In operation S450, when the application package includes a trusted application, the electronic device 100 may determine whether a plurality of trusted applications are included in the application package. For example, the electronic device 100 may determine whether a plurality of trusted applications are included in the application package based on identification information indicating a trusted application included in the application package.

An application package according to an embodiment may include a plurality of trusted applications that may be installed in different types of trusted execution environments 101b or different types of electronic devices 100. Different types of trusted execution environments may be from different versions provided by different vendors or from the same vendor. The electronic device 100 may extract, from an application package, a trusted application that may be installed in the trusted execution environment 101b of the electronic device 100 among a plurality of trusted applications. The electronic device 100 may install the extracted trusted application in the trusted execution environment 101b.

In operation S460, when the application package includes a plurality of trusted applications, the electronic device 100 may select a trusted application that may be installed in the trusted execution environment 101b in which the trusted application is to be installed. For example, the electronic device 100 may select a trusted application that can be installed and executed in the trusted execution environment 101b among a plurality of trusted applications.

In one embodiment, where different types of trusted execution environments 101b exist in the electronic device 100, the electronic device 100 may be installed in each trusted execution environment 101b. You can select more than one.

In operation S470, the electronic device 100 may extract the trusted application selected in operation S460 from the application package and install the trusted application in the trusted execution environment 101b.

According to an embodiment, the trusted application may be installed after the normal application is installed in the rich OS environment 101a or before the normal application is installed in the rich OS environment 101a. In addition, in the rich OS environment 101a, the normal application and the trusted application may be installed in parallel.

However, when a system notification indicating that a new application is installed when a new application is installed is activated, it is preferable that a trusted application is installed after the application is installed in the rich OS environment 101a. This is because, by the system notification, the electronic device 100 may recognize that a new application is installed and perform installation of a trusted application.

Meanwhile, when only one trusted application is included in the application package, the electronic device 100 may install the trusted application included in the application package in the trusted execution environment 101b. However, if the trusted application cannot be installed in the trusted execution environment 101b, the trusted application installation service unit 105 may terminate the process of installing the trusted application without installing the trusted application. For example, when the type of the trusted application and the type of the trusted execution environment 101b are different, the trusted application installation service unit 105 may terminate the process of installing the trusted application without installing the trusted application. Can be.

The apparatus illustrated in FIG. 5 may be included in the embodiment of the application distribution service apparatus 110 of FIG. 1. The application distribution service apparatus 110 includes an application package generator 111 that combines at least one of a flag 114, a normal application 115, and a trusted application 116 to generate an application package 113. do.

For example, the application package generator 111 may generate the application package 113 using a software development kit based on a predetermined operating system. Software development kits are a set of development tools that enable you to create applications for hardware platforms, computer systems, operating systems, and more. The application package generator 111 may generate an application package 113 that may be installed in an operating system installed in the electronic device 100 using a software development kit.

The application package generator 111 may generate an application package 113 including the trusted application 116 so that the trusted application 116 may be installed in the electronic device 100 together with the normal application 115. have. The application package generator 111 may set a state of the flag 114 to indicate whether the trusted application 116 is included in the application package 113. For example, the flag 114 may be set to 'TRUE' if the trusted application 116 is included or to 'FALSE' if the trusted application 116 is not included.

As an example, for compatibility with the metadata structure of the application package 113, the flag 114 may be defined using custom android permission. Custom Android credential information is an option to set the necessary permissions when a given activity is executed. The presence of the above-mentioned authorization information may be checked by the electronic device 100. In addition, the credential information may be used to indicate the presence or absence of trusted application 116 for application package 113. The authorization information may appear as a sentence (eg, "com.samsung.sec.TA_EXISTS"). The authority information may be stored in a manifest file including information related to the normal application. In addition to the examples described above, the flag 114 may be defined in the application package 113 in various ways. In addition, the information indicating whether the application package 113 includes the trusted application 116 may be included in the application package 113 as various types of information as well as the flag 144.

The electronic device 100 may determine whether the application package 113 includes a trusted application 116 by checking the state of the flag 114. If the value of the flag 114 is 'TRUE', the electronic device 100 may perform a process for installing the trusted application 116.

In addition, authentication tokens for management of trusted execution environments may be embedded in the application package 113. Thus, with the authentication token, various management functions (eg, trusted application deletion, update and status update) for the trusted application 116 at the electronic device 100 can be supported. The authentication token is electronically representing authenticated instructions issued by a privileged entity associated with the trusted execution environment or trusted application 116 of the electronic device 100, such as a vendor of a trusted execution environment or a secure domain owner. Signed binary data.

As described above, the flag 114 may signal the presence and absence of the trusted application 116. Not limited to this, the existence and absence of the trusted application 116 may include a package name attribute by including a suffix, for example, ".TA PKG", which is a signal indicating the existence of the trusted application 116. Signaled via

The application distribution service apparatus 110 may include an application distribution unit 112 that transmits an application package 113 to the electronic device 100. The application distributor 112 may transmit the application package 113 generated by the application package generator 111 to the electronic device 100. The application distributor 112 may transmit the application package 113 to the electronic device 100 according to a request of the electronic device 100.

Referring to FIG. 6, the application package 600 may include a flag 610, a normal application 620, and a plurality of trusted

applications

630 and 640. The flag 610 may include information about whether the application package 600 includes a trusted application. Each trusted

application

630, 640 may correspond to a type 1 trusted execution environment 101b and a type 2 trusted execution environment 101b. Alternatively, each

trusted application

630, 640 may correspond to a type 1 and type 2 electronic device 100, respectively.

The developer of the application may provide the same application package 600 to different types of electronic devices 100. Different types of electronic devices 100 may include different types of trusted execution environments 101b. The application package 600 may include a plurality of trusted

applications

630 and 640 that may be installed in different types of trusted execution environments 101b. Thus, one application package 600 may be provided to the electronic devices 100. In one embodiment, the electronic device 100 extracts from the application package 600 a trusted

application

630, 640 that matches the type of the electronic device 100 and trustworthy execution environment 101b of the electronic device 100. ) Can be installed.

Referring to FIG. 7, a mobile electronic device 720 such as a smart phone may be paired with a wearable electronic device 710 such as a smart watch. Various types of electronic devices may be paired with each other, not limited to the wearable electronic device 710 and the mobile electronic device 720.

In the following description, the second application package may refer to an application package included in the first application package. The third application package may refer to an application package included in the second application package.

According to an embodiment, the first application package may be an application package that may be directly connected to a network or installed in an electronic device used as a main apparatus. In addition, the second application package may be an application package that may be installed in an electronic device that is not directly connected to the network but is connected to the network through another electronic device or used as an auxiliary device. In addition, the electronic device in which the first application package and the second application package may be installed, respectively, may be devices that are connected or paired with each other by wire or wireless. The second application package may be installed in an electronic device of a type that may be connected or paired with an electronic device of the type in which the first application package may be installed.

The

second application package

723, 726 may be included in the first application package 721, and the

second application package

723, 726 may include another application package, for example, a third application package. The second application package 723 may be installed in the type 1 wearable electronic device 710 paired with the mobile electronic device 720. The second application package may include at least one of a normal application 724 and a trusted application 725 that may be installed in the wearable electronic device 710.

The third application package, which may be included in the

second application package

723, 726, may be installed in an electronic device of the type that may be paired or connected with an electronic device of the type in which the

second application package

723, 726 may be installed. have. The application package may include application packages that can be installed repeatedly on another electronic device as in the above-described embodiment.

The mobile electronic device 720 extracts the normal application 729 and the trusted application 730 from the first application package 721 to extract the normal application 729 and the trusted application 730 from the rich OS environment 731. And trusted execution environment 732, respectively. The mobile electronic device 720 determines, based on the value of the flag 722, whether a trusted application 730 exists in the first application package 721, and sends the trusted application 730 to the mobile electronic device 720. Can be installed.

In addition, the first application package 721 may further include a second application package 723 for the type 1 wearable electronic device 710 and an application package 726 for the type 2 wearable electronic device. Different types of wearable electronic devices may include different operating systems or different trusted execution environments. The application package 723 for the type 1 wearable electronic device and the application package 726 for the type 2 wearable electronic device are respectively provided for

normal applications

724 and 727 that can be installed on different operating systems and different trusted execution environments. It may include at least one of trusted applications 725, 728 that may be installed. For example, the first application package 721 obtained by the mobile electronic device 720 may include an Android package for the Android Wear smart work as a second application package, or may include a widget for the Samsung Gear Smart Watch. have.

Each

second application package

723, 726 may further include

flags

741, 742 indicating whether the trusted applications 725, 728 are included. The electronic device in which the second application packages 723 and 726 are installed may determine whether the trusted applications 725 and 728 exist using the

flags

741 and 742.

The mobile electronic device 720 may extract a second application package 723, which may be installed in the type 1 wearable electronic device 710, from the first application package 721. In addition, the mobile electronic device 720 may transmit the second application package 723 to the type 1 wearable electronic device 710. As shown in FIG. 7, the type 1 trusted application 725 included in the second application package 723 may be installed in the trusted execution environment 715 of the type 1 wearable electronic device 710. . The second application package 723 may further include a type 1 normal application 724 to be installed in the rich OS environment 714 of the wearable electronic device 710. According to an embodiment, the second application package 723 may include at least one of a type 1 normal application 725 and a trusted application 725 that may be installed in the type 1 wearable electronic device 710. have.

At least one of the normal application 724 and the trusted application 725 included in the second application package 723 may be related to the normal application 729 or the trusted application 730 installed in the mobile electronic device 720. have. For example, the second application package 723 may include at least one of the type 1 normal application 724 and the trusted application 725 that may be executed in conjunction with the normal application 729 installed in the mobile electronic device 720. It may include.

Referring to FIG. 8, in operation S810, the electronic device may acquire a first application package. The electronic device and the other electronic device may be paired with each other or connected in a wired or wireless manner.

In operation S820, the electronic device may determine a second application package to be transmitted to another electronic device among one or more second application packages included in the first application package. The second application package may be determined according to whether the application of the second application package can be installed in another electronic device.

At least one of a normal application and a trusted application included in the second application package may be installed in another electronic device that receives the second application package. The other electronic device may install the trusted application based on the flag included in the second application package.

According to an embodiment, the first application package for the mobile electronic device may include one or more second application packages for different types of wearable electronic devices. When the specified type of wearable electronic device is paired with the mobile electronic device, a second application package that may be installed in the paired wearable electronic device may be selected. The second application package may be transmitted to the paired wearable electronic device.

In operation S830, the electronic device may extract the second application package determined in operation S820 from the first application package to be transmitted to another electronic device.

In operation S840, the extracted second application package may be transmitted to another electronic device. The second application package may include at least one of a normal application that may be installed in a rich OS environment and a trusted application that may be installed in a trusted execution environment. In addition, the second application package may further include a flag indicating whether a trusted application is included. As another example, the trusted application may not be included in the second application package but may be transmitted by itself to another electronic device extracted and paired by the electronic device.

The second application package sent to the other paired electronic device may include one or more third application packages. The other paired electronic device may extract the third application package from the second application package and transmit the third application package to the electronic device where the application of the third application package is to be installed. The electronic device in which the third application package is to be installed may be another electronic device paired with the electronic device in which the application of the second application package is installed.

9 is a flowchart illustrating a method of distributing an application including a trusted application, according to an exemplary embodiment.

9, in operation S910, an apparatus for distributing an application may acquire a normal application to be installed in an electronic device and a trusted application to be installed in a secure area of the electronic device.

In operation S920, the apparatus for distributing the application may combine the normal application and the trusted application into the application package. The application package may further include a flag indicating whether to include a trusted application. The application package may include a plurality of trusted applications corresponding to the types of the plurality of trusted execution environments.

In operation S930, the apparatus may transmit the application package to the electronic device where the application is to be installed. The apparatus may transmit the application package to the electronic device at the request of the electronic device.

Referring to FIG. 10, the electronic device 1000 may include, for example, a network interface 1010 and a processor 1020.

The network interface 1010 may obtain an application package for installing an application through an external network. The application package may be provided to the electronic device 1000 through an app store that provides an application package that can be installed in the electronic device 1000.

The processor 1020 may extract a trusted application from an application package obtained through the network interface 1010, and install the trusted application in a security area of the electronic device 1000. In an embodiment, the secure area of the electronic device 1000 may include a trusted execution environment with limited external access. Trusted applications can work with sensitive and sensitive data. Trusted applications run in a trusted execution environment, allowing them to perform their tasks with a high level of security.

Meanwhile, the above-described embodiments can be written as a program that can be executed in a computer, and can be implemented in a general-purpose digital computer which operates the program using a computer-readable medium. In addition, the structure of the data used in the above-described embodiment can be recorded on the computer-readable medium through various means. In addition, the above-described embodiments may be implemented in the form of a recording medium including instructions executable by a computer, such as a program module executed by the computer. For example, methods implemented with a software module or algorithm may be stored on a computer readable recording medium as code or program instructions that the computer can read and execute.

Computer readable media can be any recording media that can be accessed by a computer, and can include volatile and nonvolatile media, removable and non-removable media. Computer-readable media may include, but are not limited to, magnetic storage media such as ROM, floppy disks, hard disks, and the like, and optical storage media such as CD-ROMs, DVDs, etc. Do not. In addition, the computer readable medium may include computer storage media and communication media.

In addition, a plurality of computer-readable recording media may be distributed in networked computer systems, and data stored in the distributed recording media, for example, program instructions and code, may be executed by at least one computer. have.

The specific implementations described in this disclosure are only one embodiment and in no way limit the scope of the disclosure. For brevity of description, descriptions of conventional electronic configurations, control systems, software, and other functional aspects of the systems may be omitted.

The terms "... unit", "module", and the like described herein refer to a unit for processing at least one function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

The "unit" and "module" may be implemented by a program stored in a storage medium that can be addressed and executed by a processor.

For example, "part", "module" means components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, pros, etc. It can be implemented by procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays and variables.

Claims

In a method for installing an application on an electronic device,

Obtaining an application package for installing the application;

Determining whether the application package includes a trusted application that can be installed on the electronic device; And

If the application package includes the trusted application, installing the trusted application on the electronic device.
The method of claim 1,

Determining whether the application package includes a trusted application that can be installed on another electronic device; And

If the application package includes a trusted application that can be installed on the other electronic device, sending the trusted application to the other electronic device.
The method of claim 2,

Extracting, from the application package, a second application package that can be installed in the other electronic device; And

Sending the extracted second application package to the other electronic device.
The device of claim 2, wherein the other electronic device is

And a wearable electronic device paired with the electronic device.
The method of claim 1, wherein the installing step

When the application package includes a plurality of trusted applications respectively corresponding to different types of security regions, selecting a trusted application that can be installed in the security region of the electronic device based on the type of the electronic device. step;

Installing the selected trusted application in a secure area of the electronic device.
The method of claim 1, wherein the determining step

Obtaining a flag value indicating whether to include the trusted application in the application package; And

Based on the obtained flag value, determining whether the application package includes a trusted application that can be installed on the electronic device.
An electronic device in which an application is installed,

A network interface for obtaining an application package for installing the application;

Determine whether the application package includes a trusted application that can be installed on the electronic device, and if the application package includes the trusted application, install the trusted application on the electronic device. And a processor.
8. The processor of claim 7, wherein the processor is

Determine whether the application package includes a trusted application that can be installed on another electronic device,

If the application package includes a trusted application that can be installed on the other electronic device, controlling the network interface to send the trusted application to the other electronic device.
The system of claim 8, wherein the processor is

Extracting a second application package that can be installed in the other electronic device from the application package,

And control the network interface to send the extracted second application package to the other electronic device.
The device of claim 8, wherein the other electronic device is

And a wearable electronic device paired with the electronic device.
8. The processor of claim 7, wherein the processor is

If the application package includes a plurality of trusted applications, each corresponding to a different type of security zone, select a trusted application that can be installed in the security zone of the electronic device based on the type of the electronic device; And install the selected trusted application in a secure area of the electronic device.
8. The processor of claim 7, wherein the processor is

Obtaining a flag value indicating whether to include the trusted application in the application package, and determining whether the application package includes a trusted application that can be installed in the electronic device based on the obtained flag value; Electronic device.
In the method for distributing an application to an electronic device,

Obtaining a normal application to be installed in the electronic device and a trusted application to be installed in a secure area of the electronic device;

Combining the normal application and the trusted application into an application package; And

Transmitting the application package to the electronic device.