WO2020093214A1 - Application program login method, application program login device and mobile terminal - Google Patents

Abstract

An application program login method, an application program login device and a mobile terminal, the method comprising: reading a login account saved in a memory of a trusted execution environment (TEE) in a mobile terminal (S101); sending the login account to a first server to indicate the first server to execute determination of whether the login account is a registered account used for logging into a target application program (S102); receiving a determination result returned by the first server (S103); and if the determination result indicates that the login account is the registered account used for logging into the target application program, logging into the target application program (S104). By means of the described method, the security of login of an application program may be improved to some extent, and operation steps when a user logs into an application program are reduced, thereby improving user experience.

Description

Application program login method, application program login device and mobile terminal Technical field

The present application belongs to the field of electronic technology, and particularly relates to an application program login method, an application program login device, a mobile terminal, and a computer-readable storage medium.

Background technique

For most applications in the mobile terminal, in order to ensure the privacy of the user, before the user uses an application, the user is required to log in to the application first. At present, the commonly used login method is: the user fills in the login account on the login interface (for example, fills in the phone number and SMS verification code), the application verifies whether the login account filled in by the user is legal, and if it is legal, logs in to the application, otherwise, login The application.

Summary of the invention

This application provides an application program login method, an application program login device, a mobile terminal, and a computer-readable storage medium, which can improve the security of application program login to a certain extent.

The first aspect of this application provides an application login method, which is applied to a mobile terminal and includes:

Reading the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

Sending the login account to the first server to instruct the first server to determine whether the login account is a registered account for logging in to the target application;

Receiving the judgment result returned by the first server;

If the judgment result indicates that the login account is a registered account for logging in to the target application, log in to the target application.

A second aspect of the present application provides a mobile terminal, including a preset memory, a processor, and a computer program stored in the preset memory and executable on the processor, and the processor implements the following steps when executing the computer program :

Reading the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

Sending the login account to the first server to instruct the first server to determine whether the login account is a registered account for logging in to the target application;

Receiving the judgment result returned by the first server;

If the judgment result indicates that the login account is a registered account for logging in to the target application, log in to the target application.

The third aspect of the present application provides an application login device, which is applied to a mobile terminal and includes:

The account reading module is used to read the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

The account sending module is used to send the above login account to the first server to instruct the first server to perform the judgment whether the above login account is a registered account for logging in to the target application;

A result receiving module, configured to receive the judgment result returned by the first server;

The first login module is configured to log in to the target application if the judgment result indicates that the login account is a registered account for logging in to the target application.

A fourth aspect of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method of the first aspect described above are implemented.

A fifth aspect of the present application provides a computer program product. The computer program product includes a computer program. When the computer program is executed by one or more processors, the steps of the method of the first aspect described above are implemented.

BRIEF DESCRIPTION

In order to more clearly explain the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required in the embodiments or the description of the prior art. Obviously, the drawings in the following description are only for the application In some embodiments, for those of ordinary skill in the art, without paying creative labor, other drawings may be obtained based on these drawings.

1 is a schematic diagram of an implementation process of an application login method provided in Embodiment 1 of the present application;

2 is a flowchart of an implementation method for writing a login account to a TEE memory provided by Embodiment 1 of the present application;

3 is a schematic flowchart of another application login method provided in Embodiment 2 of the present application;

4 is a schematic structural diagram of an application login device provided in Embodiment 3 of the present application;

5 is a schematic structural diagram of a mobile terminal provided in Embodiment 4 of the present application.

detailed description

In the following description, for the purpose of illustration rather than limitation, specific details such as specific system structure and technology are proposed to thoroughly understand the embodiments of the present application. However, those skilled in the art should understand that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details hindering the description of the present application.

The application program login method provided in the embodiment of the present application is applicable to a mobile terminal. Exemplarily, the mobile terminal includes but is not limited to: a smart phone, a palmtop computer, a notebook, a wearable device, and the like.

It should be understood that when used in this specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements, and / or components, but does not exclude one or more other features , Wholes, steps, operations, elements, components and / or their existence or addition.

It should also be understood that the terminology used in the description of this application is for the purpose of describing particular embodiments only and is not intended to limit this application. As used in the specification of the present application and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an", and "the" are intended to include the plural forms.

It should also be further understood that the term "and / or" used in the specification of the present application and the appended claims refers to any and all possible combinations of one or more of the associated listed items and includes these combinations .

As used in this specification and the appended claims, the term "if" may be interpreted as "when" or "once" or "in response to determination" or "in response to detection" depending on the context . Similarly, the phrase "if determined" or "if [described condition or event] is detected" can be interpreted in the context to mean "once determined" or "in response to a determination" or "once detected [described condition or event ] "Or" In response to detection of [the described condition or event] ".

In addition, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

In order to explain the above technical solutions of the present application, the following will be described by specific embodiments.

Example 1

The following describes the application login method provided in Embodiment 1 of the present application. The application login method is applied to a mobile terminal in which a target application is installed, please refer to FIG. 1, the application in Embodiment 1 of the present application Login methods include:

In step S101, read the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

The login account described in step S101 is specifically the login account used to log in to the target application. The login account described in step S101 may be a login account in the form of “user name + password”, for example, the user name is sunshine and the password is 12345; or, the login account described in step S101 may also be a phone number, for example, 13588888888; or, it can also be an ID number, for example, 411XXX19950808XXXX. The specific form of the login account is not limited in this application.

At present, for many mobile terminals, they can simultaneously support a rich execution environment (Rich Execution Environment, REE) and a trusted execution environment (Trusted Execution Environment, TEE). Programs running based on REE will share the same hardware resources when running. Therefore, the data in the program based on REE can be easily stolen. TEE is another operating environment that is different from REE. The hardware resources occupied by TEE code at runtime are completely different from the hardware resources occupied by REE code at runtime. For TEE code, it can run at runtime. In terms of the hardware resources accessed, the code of REE is inaccessible at runtime. In step S101, the memory of the above-mentioned trusted execution environment TEE is a memory that can only be accessed by the code of TEE, and programs running based on TEE are often It is a program specified by the mobile terminal manufacturer. Not every program installed in a mobile terminal can be run based on TEE. Therefore, programs running on TEE are less likely to be stolen than programs running on REE.

Generally, for a mobile terminal, reading and writing data to the TEE memory in the mobile terminal can often only be performed by a program specified by the mobile terminal manufacturer of the mobile terminal, so the data in the TEE memory is difficult It is difficult to be written by illegal programs if it is read by illegal programs. Therefore, if the login account of an application is stored in the TEE memory, the login account is very difficult to be stolen and modified. For traditional login methods, users are required to actively memorize the login accounts of different applications. Users often record each login account in a paper file or an electronic file. This recording method is different from recording the login account in TEE's memory. Compared with it, obviously the security level is lower. Therefore, this application provides a more secure way to log in to the account.

In the technical solution provided by this application, the login account for logging in to the above target application needs to be stored in the TEE memory of the mobile terminal in advance, because reading and writing data to the TEE memory can often only be performed by the program specified by the mobile terminal manufacturer Therefore, in order to write the login account into the TEE memory, a preset program can be developed in advance. The preset program is certified by the mobile terminal manufacturer and can write data to the TEE memory. The preset program, fill in the login account for logging in to the above target application on the interface provided by the preset program. After receiving the login account filled in by the user, the preset program writes the login account filled in by the user into the TEE memory ( Through the preset program, any user can be allowed to write data into the TEE memory. This will allow illegal users to steal all legal users ’login accounts used to log in to the target application. The stolen login account used to log in to the target application is written to the TE of a mobile terminal X In the memory of E, an illegal user can be pretended to be a legitimate user in the mobile terminal X to log in to the target application program. Therefore, when the user is allowed to write data into the memory of TEE through the preset program, the user can first be reminded to upload the identity ID number, photo and other information, and then verify the user's identity based on the ID number, photo and other information uploaded by the user, and after the verification is passed, the user is allowed to write data to the TEE memory). In addition, in order to prevent the above-mentioned preset program from stealing the login account by an illegal program during the process of writing the login account into the TEE memory, the preset program first encrypts the received login account after receiving the login account, and then The encrypted login account is transferred to TEE's memory, which is decrypted by a decryption program based on TEE. In this way, the login account is encrypted during the transfer to TEE's memory, so it can be to a certain extent. Reduce the possibility that the login account is stolen by an illegal program during the process of writing the login account into the TEE memory; in addition, in order to prevent the above preset program from being stolen by the illegal program during the process of writing the login account into the TEE memory Account, the preset program may also be a program running based on TEE.

In the embodiment of the present application, in order to write the login account into the TEE memory, in addition to the way in which the user fills in the login account through the above-mentioned preset program, the target application can also be logged in through the method shown in FIG. 2 The login account is written into TEE's memory. As shown in FIG. 2, the mobile terminal writes the login account for logging in to the target application into the TEE memory by executing steps S201-S203.

In step S201, sending login account request information to the second server, the login account request information is used to instruct the second server to search for the login account;

In step S202, receiving the login account feedback information returned by the second server, the login account feedback information includes the login account;

In step S203, based on the feedback information of the login account, write the login account into the memory of the TEE;

That is, the login account for logging in to the target application is saved through the second server, and the mobile terminal communicates with the second server to obtain the login account, and write the acquired login account into the TEE memory . In addition, it is not difficult for those skilled in the art to realize that the procedures for implementing the above steps S201-S203 need to write data into the TEE memory, so the procedures for implementing the above steps S201-S203 also need to be authenticated by the mobile terminal manufacturer. In addition, in order to prevent the above steps S201-S203 from being executed, the login account is stolen by an illegal program, the above steps S201-S203 may also be a program running based on TEE; or, in the process of writing the login account into the TEE memory, The login account is encrypted and decrypted by a decryption program based on TEE. In this way, the login account is encrypted during the transfer to the TEE memory, which can reduce the writing of the login account to the TEE memory to a certain extent. The possibility of being stolen login account by illegal program during the process.

It is not difficult for those skilled in the art to understand that when the mobile terminal obtains the login account of the login target application through the above steps S201-S203, it needs to communicate with the second server, in order to avoid mutual communication between the mobile terminal and the second server The data is intercepted illegally, and the data communicated with each other can be encrypted. For example, in order to prevent the login account returned by the second server from being intercepted illegally, the feedback information of the login account is obtained by the second server through encryption processing using a preset first encryption rule; accordingly, the above step S203 includes: The decryption rule corresponding to the encryption rule decrypts the feedback information of the login account to obtain the login account, and writes the login account into the TEE memory.

In addition, the step S101 may be executed when the user starts the target application, for example, when the user clicks the icon of the target application on the desktop of the mobile terminal, the mobile terminal executes the step S101 to obtain the TEE memory location. The saved login account for logging into the target application. In addition, in the embodiment of the present application, if the login account for logging in to the target application is not obtained from the TEE memory, the user may be reminded to start the preset program or the mobile terminal automatically starts the preset program to obtain the user manual The input login account for logging in to the target application; or, performing the above steps S201-S203 to obtain the login account for logging in to the target application.

In step S102, the above login account is sent to the first server to instruct the first server to determine whether the above login account is a registered account for logging in to the target application;

In the embodiment of the present application, after reading the login account for logging in to the target application through step S101, the login account read in step S101 is sent to the first server, where the first server may be the same as the target application A server corresponding to the program, and each registered account for logging in to the target application program is stored in the first server.

The mobile terminal sends the login account read in step S101 to the first server to instruct the first server to verify the login account, and the first server determines whether the login account is used to log in to the target application Register an account and return the judgment result to the mobile terminal.

In addition, in order to avoid that the login account is intercepted when the mobile terminal communicates with the first server, this step S102 may include:

Encrypt the above login account by using a preset second encryption rule to obtain an encrypted login account after the encryption process;

The encrypted login account is sent to the first server to instruct the first server to determine whether the login account is a registered account for logging in to the target application.

In step S103, receiving the judgment result returned by the first server;

In the embodiment of the present application, step S103 may include: after sending the login account to the first server, detecting whether a judgment result returned by the first server is received within a preset time period (such as 5 milliseconds); if If the judgment result returned by the first server is received within the preset time period, the subsequent step S104 is executed; if the judgment result returned by the first server is not received within the preset time period, the judgment is sent to the first Whether the number of times the server sends the login account reaches the preset number; if it does not arrive, return to step S102, and send the login account read in step S101 to the first server again; if the preset number of times is reached, the user is reminded that he cannot connect Network, so it is not possible to log in to the target application.

In step S104, if the result of the determination indicates that the login account is a registered account for logging in to the target application, log in to the target application;

In the embodiment of the present application, if the judgment result returned by the first server indicates that the login account read in step S101 is a registered account for logging in to the target application, the target application is automatically logged in; otherwise, if the above judgment The result indicates that the login account is not a registered account used to log in to the target application, and then prompt information is generated, and the prompt information is used to prompt the user that the target application cannot be logged in.

The application login method provided in the first embodiment of the present application needs to read the login account saved in the TEE memory. Therefore, the procedures for implementing the steps of the first embodiment of the present application can be authenticated by the mobile terminal manufacturer, thereby making the first embodiment of the present application The provided method can realize reading data in the TEE memory.

In addition, the steps described in the first embodiment of the present application can also be completely implemented by the target application, and the mobile terminal can provide the target application with a preset interface function. When the target application is started, the target application You can call the preset interface function to read data from the TEE memory. Since the program to read the data in the TEE memory must be authenticated by the mobile terminal manufacturer, the developer of the target application must contact the mobile terminal in advance. The manufacturer communicates and applies to call the preset interface function of the mobile terminal, so as to read the data in the TEE memory of the mobile terminal.

Embodiment 1 of the present application provides an application login method, which automatically reads the login account from the memory of the trusted execution environment TEE when logging in to the target application, and automatically logs in to the target application when the login account is legal Because the data read and write of the TEE memory can often only be performed by the program specified by the mobile terminal manufacturer, the data in the TEE memory is difficult to be read by illegal programs (that is, it is difficult to be stolen), and it is also difficult to be Illegal program writing (even if it is stolen by an illegal user, it is difficult to write to the memory of the TEE in the mobile terminal of the illegal user), so the login account saved in the memory of the TEE in the mobile terminal has a high degree of credibility Once the login account saved in TEE's memory is successfully verified, it largely indicates that the user who uses the target application is a legitimate user (because the login account is saved in TEE's memory, the stolen account The possibility is very low, even if it is stolen, it is difficult to write into the TEE memory of the mobile terminal of the illegal user). In the traditional login method, the login account is easily obtained by illegal users (for example, the login method of the phone number and SMS verification code is used as an example. The illegal user can obtain the international mobile user identification code IMSI of the legal user by broadcasting, and then pass the legal The user's IMSI obtains the legal user's phone number, and intercepts the SMS verification code to obtain the legal user's phone number and SMS verification code), and the traditional login method requires the user to manually enter the login account, the manual input process is very unsafe, It is easy for illegal users to use tools such as cameras to steal the user ’s login account. Therefore, traditional login accounts are more likely to be stolen. In addition, for traditional login methods, once a legitimate user ’s login account is stolen, the illegal user You can manually enter the stolen login account and pretend to be a legitimate user to log in to the target application. Therefore, for traditional login methods, even if the login account is successfully verified, it cannot be stated that the user using the target application is a legitimate user (because there is a login account number Theft possible). In summary, the login method provided in this application is more secure than the traditional login method, and can improve the security of login to a certain extent. In addition, the login method provided by the present application avoids manually inputting a login account. Therefore, compared with the traditional login method, the user's operation steps can be reduced to a certain extent, and the user experience can be improved.

Example 2

The following describes another application login method provided in Embodiment 2 of the present application. As in Embodiment 1, the application login method is applied to a mobile terminal in which a target application is installed.

In the technical solution provided in the second embodiment of the present application, the login account in the technical solution provided in the first embodiment is specifically limited to the phone number corresponding to the mobile terminal. Referring to FIG. 3, the application login method in the second embodiment of the present application includes:

In step S301, obtain the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the SIM card of the user identification module in the mobile terminal;

Usually, the phone number of the mobile terminal is the IMEI (International Mobile Equipment Identification) of the mobile terminal or the SIM (Subscriber Identification Module, user identification mode) card installed in the mobile terminal. Mobile Subscriber Identification (International Mobile Subscriber Identification Number) corresponds, therefore, you can first obtain the IMEI of the mobile terminal or the IMSI of the SIM card in the mobile terminal, so as to obtain the phone number of the mobile terminal through the IMEI or IMSI.

In step S302, login account request information is generated according to the IMEI or the IMSI, where the login account request information includes the IMEI or the IMSI;

After acquiring the IMEI of the mobile terminal and the IMSI of the SIM card in the mobile terminal, the mobile terminal uses the IMEI or IMSI to generate login account request information.

In step S303, the above login account request information is sent to the second server, and the login account request information is used to instruct the second server to search for the phone number corresponding to the IMEI or IMSI;

The above-mentioned second server may store a preset correspondence table, which records correspondence information between different IMEIs and phone numbers or correspondence information between different IMSIs and phone numbers. After receiving the login account request information, the second server extracts the IMEI or IMSI in the login account request information, and according to the IMEI or the IMSI, searches for a corresponding phone number in a preset correspondence table, and searches for The received phone number is returned to the above mobile terminal.

In step S304, receiving login account feedback information returned by the second server, the login account feedback information includes the phone number;

In order to prevent the communication data between the mobile terminal and the second server from being stolen, the communication data between the mobile terminal and the second server may be encrypted. For example, in step S303, the second server encrypts the login account feedback information to ensure that the phone number in the login information feedback information is not intercepted by illegal users.

In step S305, according to the login account feedback information, write the phone number into the memory of the trusted execution environment TEE in the mobile terminal;

In this step S305, the phone number needs to be written into the TEE memory of the mobile terminal. Therefore, the procedure for implementing the above steps S301-S305 needs to be authenticated by the mobile terminal manufacturer. In addition, in order to prevent the above steps S301-S305 from being executed, the login account is stolen by an illegal program. The above steps S301-S305 may be a program running based on TEE; The number is encrypted and decrypted by a decryption program based on TEE. In this way, the phone number is encrypted in the process of being transferred to TEE's memory, which can reduce the number of phone numbers written into TEE's memory to a certain extent. In the process, the possibility of the login account being stolen by an illegal program.

Those skilled in the art should understand that the above steps S301-S305 are not executed together with the subsequent steps S306-S309 every time. The steps S301-S305 may only be executed when the user changes the phone number, for example, when detected to indicate that the user has When the trigger signal of the SIM card is replaced, the IMEI of the mobile terminal or the IMSI of the SIM card in the mobile terminal is obtained (for example, when the mobile terminal detects that the user removes the SIM card and inserts the SIM again, a trigger signal is generated so that The mobile terminal re-acquires the IMEI of the mobile terminal or the IMSI of the replaced SIM card). In addition, in some cases, even if the user replaces the SIM card, the IMEI of the mobile terminal may not be bound to the replaced mobile phone number. Therefore, the IMEI of the mobile terminal may not obtain the correct phone number, so In this embodiment of the present application, in order to ensure that the replaced phone number can be obtained through IMEI when the user replaces the SIM card, the operator should update the IMEI and mobile terminal IMEI of the second server in time before delivering the user's new SIM Correspondence of phone numbers.

In step S306, read the phone number stored in the memory of the TEE;

In step S307, the above-mentioned phone number is sent to the first server to instruct the first server to perform judgment to determine whether the phone number is a registered account for logging in to the target application;

In step S308, receive the judgment result returned by the first server;

In step S309, if the result of the determination indicates that the phone number is a registered account for logging in to the target application, log in to the target application.

Generally, for most applications, the login method based on the phone number is supported. Therefore, in the second embodiment of the present application, it can be determined whether the phone number of the mobile terminal is the registered account for logging in to the target application , If yes, log in to the target application.

In addition, compared with the first embodiment, the second embodiment of the present application only restricts the login account to the phone number, except that the above steps S306-S309 are exactly the same as the steps S101-S104 in the first embodiment. For details, please refer to the description of Embodiment 1, which will not be repeated here.

Generally, in the memory of the TEE in the mobile terminal, not only the login account of only one application program is stored, but the login accounts of multiple application programs are often saved. If the login account described in the first embodiment is limited to the user name and password, it will occupy a large TEE memory space for the following reasons: for the same user, different applications often log in with different user names and passwords, For example, the user name for Xiaoming's login to WeChat is: xiaoming and the password is: 123, but the user name for logging in to Taobao is: xiaomifeng and the password is: happy123. The account number is limited to the user name and password, which will occupy a large amount of storage space in the TEE memory. However, for the same user, it often has only one phone number or several phone numbers, and most current applications support the login method based on the phone number. Therefore, in order to avoid storing too much in the TEE memory in the mobile terminal The login accounts of multiple application programs avoid occupying a large amount of storage space of the TEE memory. In the second embodiment of the present application, the login account in the first embodiment is limited to a phone number. In addition, the second embodiment of the present application is the same as the first embodiment, and can also improve the security of login to a certain extent, and can reduce the operation steps of the user when logging in to the application to a certain extent.

It should be understood that the size of the sequence numbers of the steps in the above embodiments does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

Example 3

Embodiment 3 of the present application provides an application program login device. The application program login device is applied to a mobile terminal. As shown in FIG. 4, the application program login device 400 includes:

The account reading module 401 is used to read the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

The account sending module 402 is used to send the login account to the first server to instruct the first server to perform the judgment whether the login account is a registered account for logging in to the target application;

A result receiving module 403, configured to receive the judgment result returned by the first server;

The first login module 404 is configured to log in to the target application if the judgment result indicates that the login account is a registered account for logging in to the target application.

Optionally, the above application login device 400 further includes:

The account request module is used to send login account request information to the second server, and the login account request information is used to instruct the second server to search for the login account;

An account receiving module, configured to receive feedback information of the login account returned by the second server, and the feedback information of the login account includes the login account;

The account writing module is configured to write the login account into the TEE memory according to the login account feedback information.

Optionally, the login account feedback information is information obtained by the second server through encryption processing using a preset first encryption rule;

Correspondingly, the account writing module is specifically used to decrypt the login account feedback information according to the decryption rule corresponding to the first encryption rule to obtain the login account and write the login account into the TEE In memory.

Optionally, the login account is a phone number corresponding to the mobile terminal;

Correspondingly, the above account request module includes:

An identification code acquiring unit, configured to acquire the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the user identification mode SIM card in the mobile terminal;

A request information generating unit, configured to generate the login account request information according to the IMEI or the IMSI, wherein the login account request information includes the IMEI or the IMSI;

The request information sending unit is configured to send the login account request information to the second server, and the login account request information is used to instruct the second server to search for a phone number corresponding to the IMEI or the IMSI.

Optionally, the identification code acquiring unit is specifically configured to: when detecting a trigger signal indicating that the user has completed the replacement of the SIM card, acquire the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user of the SIM card Identification code IMSI.

Optionally, the above account sending module 402 includes:

An account encryption unit for encrypting the above login account using a preset second encryption rule to obtain an encrypted login account after the encryption process;

The encrypted account sending unit is configured to send the encrypted login account to the first server to instruct the first server to determine whether the login account is a registered account for logging in to the target application.

Optionally, the above application login device 400 further includes:

The second login module is configured to generate prompt information if the judgment result indicates that the login account is not a registered account for logging in to the target application, and the prompt information is used to prompt the user that the target application cannot be logged in.

Optionally, the account reading module 401 is specifically configured to: when it is detected that the user starts the target application, read the login account saved in the memory of the TEE in the mobile terminal.

Optionally, the account reading module 401 is specifically configured to: when it is detected that the user starts the target application, read the login account saved in the memory of the TEE in the mobile terminal by calling a preset interface function.

It should be noted that the information interaction and execution process between the above devices / units are based on the same concept as the method embodiments of the present application, and their specific functions and technical effects can be referred to the method embodiments. I will not repeat them here.

Example 4

FIG. 5 is a schematic diagram of a mobile terminal provided in Embodiment 4 of the present application. As shown in FIG. 5, the mobile terminal 5 of this embodiment includes: a processor 50, a preset memory 51 and a computer program 52 stored in the preset memory 51 and executable on the processor 50. When the processor 50 executes the computer program 52, the steps in the above method embodiments are implemented, for example, steps 101 to 104 shown in FIG. 1. Alternatively, when the processor 50 executes the computer program 52, the functions of the modules / units in the foregoing device embodiments are realized, for example, the functions of the modules 401 to 404 shown in FIG. 4.

Exemplarily, the computer program 52 may be divided into one or more modules / units, the one or more modules / units are stored in the preset memory 51, and executed by the processor 50 to complete the application . The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions. The instruction segments are used to describe the execution process of the computer program 52 in the mobile terminal 5. For example, the above-mentioned computer program 52 may be divided into an account reading module, an account sending module, a result receiving module, and a first login module. The specific functions of each module are as follows:

Reading the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

Sending the login account to the first server to instruct the first server to determine whether the login account is a registered account for logging in to the target application;

Receiving the judgment result returned by the first server;

If the judgment result indicates that the login account is a registered account for logging in to the target application, log in to the target application.

The above mobile terminal may include, but is not limited to, the processor 50 and the preset memory 51. Those skilled in the art may understand that FIG. 5 is only an example of the mobile terminal 5 and does not constitute a limitation on the mobile terminal 5, and may include more or fewer components than those illustrated, or combine certain components, or different components For example, the above mobile terminal may further include input and output devices, network access devices, buses, and the like.

The so-called processor 50 may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The preset memory 51 may be an internal storage unit of the mobile terminal 5, such as a hard disk or a memory of the mobile terminal 5. The preset memory 51 may also be an external storage device of the mobile terminal 5, such as a plug-in hard disk equipped on the mobile terminal 5, a smart memory card (Smart Media (SMC), a secure digital (SD) card) , Flash card (Flash Card), etc. Further, the preset memory 51 may also include both the internal storage unit of the mobile terminal 5 and an external storage device. The preset memory 51 is used to store the computer program and other programs and data required by the mobile terminal. The preset memory 51 can also be used to temporarily store data that has been output or is to be output.

Those skilled in the art can clearly understand that, for convenience and conciseness of description, only the above-mentioned division of each functional unit and module is used as an example for illustration. In practical applications, the above-mentioned functions may be allocated by different functional units, Module completion means that the internal structure of the above device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above integrated unit may use hardware It can also be implemented in the form of software functional units. In addition, the specific names of each functional unit and module are only for the purpose of distinguishing each other, and are not used to limit the protection scope of the present application. For the specific working processes of the units and modules in the above system, reference may be made to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the above embodiments, the description of each embodiment has its own emphasis. For a part that is not detailed or recorded in an embodiment, you can refer to the related descriptions of other embodiments.

Those of ordinary skill in the art may realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of external device software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application of the technical solution and design constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

In the embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above-mentioned modules or units is only a division of logical functions. In actual implementation, there may be other divisions, for example, multiple units or components may be combined Or it can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

If the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the present application can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through a computer program. The above computer program can be stored in a computer-readable storage medium, and the computer program When executed by the processor, the steps of the foregoing method embodiments may be implemented. Wherein, the above-mentioned computer program includes computer program code, and the above-mentioned computer program code may be in the form of source code, object code, executable file or some intermediate form. The above-mentioned computer-readable storage medium may include: any entity or device capable of carrying the above-mentioned computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer-readable memory, read-only memory (ROM, Read-Only Memory) ), Random Access Memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals and software distribution media, etc. It should be noted that the content contained in the above computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in jurisdictions. For example, in some jurisdictions, according to legislation and patent practice, computer-readable storage The medium does not include electrical carrier signals and telecommunications signals.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, persons of ordinary skill in the art should understand that they can still perform the foregoing embodiments The recorded technical solutions are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of this application, and should be included in this Within the scope of protection applied for.

Claims (20)

1. An application program login method applied to a mobile terminal, characterized in that the application program login method includes:

   Reading the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

   Sending the login account to the first server to instruct the first server to perform judgment as to whether the login account is a registered account for logging in to the target application;

   Receiving the judgment result returned by the first server;

   If the judgment result indicates that the login account is a registered account for logging in to the target application, log in to the target application.
2. The application program login method according to claim 1, wherein before the step of reading the login account stored in the memory of the trusted execution environment TEE in the mobile terminal, further comprising:

   Sending login account request information to the second server, where the login account request information is used to instruct the second server to search for the login account;

   Receiving login account feedback information returned by the second server, where the login account feedback information includes the login account;

   According to the feedback information of the login account, write the login account into the memory of the TEE.
3. The application program login method according to claim 2, wherein the login account feedback information is information obtained by the second server through encryption processing using a preset first encryption rule;

   Correspondingly, according to the feedback information of the login account, writing the login account into the memory of the TEE includes:

   According to the decryption rule corresponding to the first encryption rule, decrypt the login account feedback information to obtain the login account, and write the login account into the TEE memory.
4. The application login method according to claim 2, wherein the login account is a phone number corresponding to the mobile terminal;

   Correspondingly, the sending login account request information to the second server, the login account request information used to instruct the second server to search for the login account, includes:

   Acquiring the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the user identification mode SIM card in the mobile terminal;

   Generating the login account request information according to the IMEI or the IMSI, wherein the login account request information includes the IMEI or the IMSI;

   Sending the login account request information to the second server, where the login account request information is used to instruct the second server to search for a phone number corresponding to the IMEI or the IMSI.
5. The application login method according to claim 4, wherein the acquiring the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the SIM card includes:

   When a trigger signal indicating that the user has replaced the SIM card is detected, the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the SIM card is acquired.
6. The application login method according to any one of claims 1 to 5, wherein the sending the login account to a first server instructs the first server to perform judgment on whether the login account is Registered account used to log in to the target application, including:

   Encrypting the login account using a preset second encryption rule to obtain an encrypted login account after the encryption process;

   Sending the encrypted login account to the first server to instruct the first server to perform judgment on whether the login account is a registered account for logging in to the target application.
7. The application login method according to any one of claims 1 to 5, wherein after the step of receiving the judgment result returned by the first server, the method further comprises:

   If the judgment result indicates that the login account is not a registered account for logging in to the target application, then prompt information is generated, and the prompt information is used to prompt the user that the target application cannot be logged in.
8. The application login method according to any one of claims 1 to 5, wherein the reading of the login account stored in the memory of the trusted execution environment TEE in the mobile terminal includes:

   When it is detected that the user starts the target application program, the login account stored in the memory of the TEE in the mobile terminal is read.
9. The application login method according to claim 8, wherein, when it is detected that the user starts the target application, reading the login account stored in the memory of the TEE in the mobile terminal includes:

   When it is detected that the user starts the target application program, by calling a preset interface function, the login account stored in the memory of the TEE in the mobile terminal is read.
10. A mobile terminal includes a preset memory, a processor, and a computer program stored in the preset memory and executable on the processor, characterized in that, when the processor executes the computer program, it is implemented as follows step:

    Reading the login account saved in the memory of the trusted execution environment TEE in the mobile terminal;

    Sending the login account to the first server to instruct the first server to perform judgment as to whether the login account is a registered account for logging in to the target application;

    Receiving the judgment result returned by the first server;

    If the judgment result indicates that the login account is a registered account for logging in to the target application, log in to the target application.
11. The mobile terminal according to claim 10, wherein before the step of reading the login account stored in the memory of the trusted execution environment TEE in the mobile terminal, further comprising:

    Sending login account request information to the second server, where the login account request information is used to instruct the second server to search for the login account;

    Receiving login account feedback information returned by the second server, where the login account feedback information includes the login account;

    According to the feedback information of the login account, write the login account into the memory of the TEE.
12. The mobile terminal according to claim 11, wherein the login account feedback information is information obtained by the second server through encryption processing using a preset first encryption rule;

    Correspondingly, according to the feedback information of the login account, writing the login account into the memory of the TEE includes:

    According to the decryption rule corresponding to the first encryption rule, decrypt the login account feedback information to obtain the login account, and write the login account into the TEE memory.
13. The mobile terminal according to claim 11, wherein the login account is a phone number corresponding to the mobile terminal;

    Correspondingly, the sending login account request information to the second server, the login account request information used to instruct the second server to search for the login account, includes:

    Acquiring the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the user identification mode SIM card in the mobile terminal;

    Generating the login account request information according to the IMEI or the IMSI, wherein the login account request information includes the IMEI or the IMSI;

    Sending the login account request information to the second server, where the login account request information is used to instruct the second server to search for a phone number corresponding to the IMEI or the IMSI.
14. The mobile terminal according to claim 13, wherein the acquiring the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the SIM card includes:

    When a trigger signal indicating that the user has replaced the SIM card is detected, the international mobile equipment identification code IMEI of the mobile terminal or the international mobile user identification code IMSI of the SIM card is acquired.
15. The mobile terminal according to any one of claims 10 to 14, wherein the sending the login account to the first server instructs the first server to perform judgment on whether the login account is used Registered account for logging into the target application, including:

    Encrypting the login account using a preset second encryption rule to obtain an encrypted login account after the encryption process;

    Sending the encrypted login account to the first server to instruct the first server to perform judgment on whether the login account is a registered account for logging in to the target application.
16. The mobile terminal according to any one of claims 10 to 14, after the step of receiving the judgment result returned by the first server, further comprising:

    If the judgment result indicates that the login account is not a registered account for logging in to the target application, then prompt information is generated, and the prompt information is used to prompt the user that the target application cannot be logged in.
17. The mobile terminal according to any one of claims 10 to 14, wherein the reading of the login account stored in the memory of the trusted execution environment TEE in the mobile terminal includes:

    When it is detected that the user starts the target application program, the login account stored in the memory of the TEE in the mobile terminal is read.
18. The mobile terminal according to claim 17, wherein, when it is detected that the user starts the target application, reading the login account stored in the memory of the TEE in the mobile terminal includes:

    When it is detected that the user starts the target application program, by calling a preset interface function, the login account stored in the memory of the TEE in the mobile terminal is read.
19. An application program login device applied to a mobile terminal, characterized in that the application program login device includes:

    An account reading module, used to read the login account stored in the memory of the trusted execution environment TEE in the mobile terminal;

    An account sending module, configured to send the login account to the first server to instruct the first server to perform judgment on whether the login account is a registered account for logging in to the target application;

    A result receiving module, configured to receive the judgment result returned by the first server;

    The first login module is configured to log in to the target application if the judgment result indicates that the login account is a registered account for logging in to the target application.
20. A computer-readable storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images