CN114117458A

CN114117458A - Key using method and related product

Info

Publication number: CN114117458A
Application number: CN202010890848.1A
Authority: CN
Inventors: 李维晅; 周一耒; 方习文
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2020-08-29
Filing date: 2020-08-29
Publication date: 2022-03-01
Also published as: WO2022042273A1

Abstract

The application discloses a key using method and a related product. The method includes the first device sending a key usage request to a second device, the second device including a secure hardware environment; and the first equipment receives a key use result sent by the second equipment, wherein the key use result is obtained by processing the data to be processed in the key use request by the second equipment according to the key in the secure hardware environment. Therefore, the key can be prevented from being cracked when being stored in the first equipment without a secure hardware environment, the complexity of the key is not limited by the computing capacity of the first equipment, and the first equipment can support more types of keys with more complexity.

Description

Key using method and related product

Technical Field

The present application relates to the field of terminal technologies, and in particular, to a key using method and a related product.

Background

With the continuous development of electronic technology and computer technology, terminals such as mobile phones, tablet computers, intelligent wearable devices and the like have become popular. The security and the reliability of the operations of data encryption, data integrity protection, identity authentication and the like of the terminal are ensured through the secret key. The complete life cycle of the key includes generation, storage, use, transmission, destruction of the key. Each stage presents a risk of leakage.

Disclosure of Invention

The application provides a key using method and a related product.

In a first aspect, an embodiment of the present application provides a key using method, including:

a first device sends a key usage request to a second device, the second device comprising a secure hardware environment;

and the first equipment receives a key use result sent by the second equipment, wherein the key use result is obtained by processing the data to be processed in the key use request by the second equipment according to the key in the secure hardware environment.

In this way, in the key using process, the key does not need to be stored in the first device without a secure hardware environment, and the first device does not need to process the data to be processed by using the key. Therefore, the key can be prevented from being cracked when being stored in the first equipment without a secure hardware environment, the complexity of the key is not limited by the computing capacity of the first equipment, and the first equipment can support more types of keys with more complexity.

In this application, the first device may be a device without a secure hardware environment. The first device may also be referred to as a thin device and the second device may be referred to as a rich device.

In some embodiments, before the first device sends the key use request to the second device, the method further comprises:

the first equipment acquires the connection state of one or more second equipment in an equipment list and the first equipment;

the first device selects a second device for processing the key use request from the one or more second devices according to the connection state of the one or more second devices and the first device;

the first device sending a key use request to a second device includes:

the first device sends the key use request to the second device for processing the key use request.

In this way, the first device can select the second device with the optimal connection state from the plurality of second devices, so that the data to be processed can be processed by using the key in the second device more quickly and efficiently.

the first device sends a key escrow request to a second device, wherein the key escrow request comprises the key, and the key escrow request is used for requesting the second device to save the key.

In some embodiments, the key escrow request further includes an index of the key, the key escrow further to request the second device to save the index of the key; the key use request includes an index of the key and the data to be processed.

In this way, the first device can host the key to the second device after generating the key. The second device stores the key into the secure hardware environment, so that the storage security of the key can be ensured.

In a second aspect, an embodiment of the present application provides another key using method, including:

the method comprises the steps that a second device receives a key use request sent by a first device, wherein the second device comprises a secure hardware environment;

the second equipment processes the data to be processed in the key use request by using a key in a secure hardware environment to obtain a key use result;

the second device sends the key usage result to the first device.

In some embodiments, before the second device receives the key usage request sent by the first device, the method further includes:

the second device receiving a key escrow request of the first device, the key escrow request including the key;

the second device stores the key to the secure hardware environment.

In some embodiments, the key escrow request further includes an index of the key; the method further comprises the following steps: the second device storing an index of the key to the secure hardware environment;

the key use request includes an index of the key and the data to be processed.

Therefore, the second device can find the key required to be used according to the index of the key in the key use request, and the key use request of the first device can be responded accurately and efficiently.

In a third aspect, the present application provides an electronic device comprising a memory, one or more processors, and a plurality of applications. One or more programs are stored in the storage, and when the one or more programs are executed by the one or more processors, the terminal is enabled to execute the processing method of the application program in any possible implementation manner of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer storage medium, which includes computer instructions, and when the computer instructions are executed on a terminal, the terminal is caused to execute the processing method of the application program in any one of the possible implementations of the first aspect.

In a fifth aspect, the present application provides a computer program product, which when run on a terminal, causes the terminal to execute the processing method of the application program in any one of the possible implementations of the first aspect.

Drawings

FIG. 1 is a schematic diagram of a network architecture according to an embodiment of the present application;

fig. 2 is a schematic structural diagram of a terminal according to an embodiment of the present application;

fig. 3 is a block diagram of a software structure of a terminal according to an embodiment of the present disclosure;

fig. 4A is a schematic flowchart of a key using method according to an embodiment of the present application;

FIG. 4B is a flowchart illustrating another key using method according to an embodiment of the present application;

FIG. 5 is a flowchart illustrating a key storage method according to an embodiment of the present application;

FIG. 6 is a block diagram of a first device and a second device according to an embodiment of the present application;

FIG. 7 is a schematic flowchart of another key storage method according to an embodiment of the present application;

fig. 8 is another flowchart illustrating a key using method according to an embodiment of the present application.

Detailed Description

The technical solution in the embodiments of the present application will be described in detail and removed with reference to the accompanying drawings. In the description of the embodiments herein, "/" means "or" unless otherwise specified, for example, a/B may mean a or B; "and/or" in the text is only an association relationship describing an associated object, and means that three relationships may exist, for example, a and/or B may mean: three cases of a alone, a and B both, and B alone exist, and in addition, "a plurality" means two or more than two in the description of the embodiments of the present application.

In the following, the terms "first", "second" are used for descriptive purposes only and are not to be understood as implying or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of embodiments of the application, unless stated otherwise, "plurality" means two or more.

Referring to fig. 1, fig. 1 is a diagram of a network architecture according to an embodiment of the present disclosure. As shown in fig. 1, the network architecture 100 includes a first device 10, and a second device 20. One first device 10 may communicate with one or more second devices 20. The communication mode between the first device 10 and the second device 20 may be wireless communication or wired communication. The first device 10 and the second device 20 are both electronic devices.

The first device 10 may be, for example, a terminal. The second device 20 may be, for example, a server or a terminal. The first device 10 does not include a secure hardware environment and the second device 20 does include a secure hardware environment.

The terminal may include, but is not limited to, a personal computer, a smart phone, a smart wearable device, a tablet computer, a personal digital assistant, a bluetooth speaker, a bluetooth headset, a smart appliance, and so on.

Fig. 2 shows a schematic structural diagram of the terminal. The terminal may be the first device or the second device.

The following describes embodiments in detail by taking a terminal as an example. It should be understood that the terminal shown in fig. 2 is only an example, and the terminal may have more or fewer components than shown in fig. 2, may combine two or more components, or may have a different configuration of components. The various components shown in the figures may be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and/or application specific integrated circuits.

The terminal may include: the mobile terminal includes a processor 110, an external memory interface 120, an internal memory 121, a Universal Serial Bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, a Subscriber Identity Module (SIM) card interface 195, and the like. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, and the like.

It is to be understood that the illustrated structure of the embodiments of the present invention does not limit the terminal specifically. In other embodiments of the present application, the terminal may include more or fewer components than shown, or some components may be combined, some components may be split, or a different arrangement of components may be used. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

Processor 110 may include one or more processing units, such as: the processor 110 may include an Application Processor (AP), a modem processor, a Graphics Processing Unit (GPU), an Image Signal Processor (ISP), a controller, a memory, a video codec, a Digital Signal Processor (DSP), a baseband processor, and/or a neural-Network Processing Unit (NPU), etc. The different processing units may be separate devices or may be integrated into one or more processors.

Wherein, the controller can be the neural center and the command center of the terminal. The controller can generate an operation control signal according to the instruction operation code and the timing signal to complete the control of instruction fetching and instruction execution.

A memory may also be provided in processor 110 for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may hold instructions or data that have just been used or recycled by the processor 110. If the processor 110 needs to reuse the instruction or data, it can be called directly from the memory. Avoiding repeated accesses reduces the latency of the processor 110, thereby increasing the efficiency of the system.

In some embodiments, processor 110 may include one or more interfaces. The interface may include an integrated circuit (I2C) interface, an integrated circuit built-in audio (I2S) interface, a Pulse Code Modulation (PCM) interface, a universal asynchronous receiver/transmitter (UART) interface, a Mobile Industry Processor Interface (MIPI), a general-purpose input/output (GPIO) interface, a Subscriber Identity Module (SIM) interface, and/or a Universal Serial Bus (USB) interface, etc.

The I2C interface is a bi-directional synchronous serial bus that includes a serial data line (SDA) and a Serial Clock Line (SCL). In some embodiments, processor 110 may include multiple sets of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces, respectively. For example: the processor 110 may be coupled to the touch sensor 180K through an I2C interface, so that the processor 110 and the touch sensor 180K communicate through an I2C bus interface to implement the touch function of the terminal.

The I2S interface may be used for audio communication. In some embodiments, processor 110 may include multiple sets of I2S buses. The processor 110 may be coupled to the audio module 170 via an I2S bus to enable communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 may communicate audio signals to the wireless communication module 160 via the I2S interface, enabling answering of calls via a bluetooth headset.

The PCM interface may also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 may be coupled by a PCM bus interface. In some embodiments, the audio module 170 may also transmit audio signals to the wireless communication module 160 through the PCM interface, so as to implement a function of answering a call through a bluetooth headset. Both the I2S interface and the PCM interface may be used for audio communication.

The UART interface is a universal serial data bus used for asynchronous communications. The bus may be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, a UART interface is generally used to connect the processor 110 with the wireless communication module 160. For example: the processor 110 communicates with a bluetooth module in the wireless communication module 160 through a UART interface to implement a bluetooth function. In some embodiments, the audio module 170 may transmit the audio signal to the wireless communication module 160 through a UART interface, so as to realize the function of playing music through a bluetooth headset.

MIPI interfaces may be used to connect processor 110 with peripheral devices such as display screen 194, camera 193, and the like. The MIPI interface includes a Camera Serial Interface (CSI), a Display Serial Interface (DSI), and the like. In some embodiments, the processor 110 and the camera 193 communicate through a CSI interface to implement the terminal's shooting function. The processor 110 and the display screen 194 communicate through the DSI interface to implement the display function of the terminal.

The GPIO interface may be configured by software. The GPIO interface may be configured as a control signal and may also be configured as a data signal. In some embodiments, a GPIO interface may be used to connect the processor 110 with the camera 193, the display 194, the wireless communication module 160, the audio module 170, the sensor module 180, and the like. The GPIO interface may also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, and the like.

The USB interface 130 is an interface conforming to the USB standard specification, and may specifically be a Mini USB interface, a Micro USB interface, a USB Type C interface, or the like. The USB interface 130 may be used to connect a charger to charge the terminal, and may also be used to transmit data between the terminal and a peripheral device. And the earphone can also be used for connecting an earphone and playing audio through the earphone. The interface may also be used to connect other electronic devices, such as AR devices and the like.

It should be understood that the interface connection relationship between the modules in the embodiment of the present invention is only an exemplary illustration, and does not form a limitation on the structure of the terminal. In other embodiments of the present application, the terminal may also adopt different interface connection manners or a combination of multiple interface connection manners in the foregoing embodiments.

The charging management module 140 is configured to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger via the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive a wireless charging input through a wireless charging coil of the terminal. The charging management module 140 may also supply power to the electronic device through the power management module 141 while charging the battery 142.

The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and/or the charge management module 140 and provides power to the processor 110, the internal memory 121, the external memory, the display 194, the camera 193, the wireless communication module 160, and the like. The power management module 141 may also be used to monitor parameters such as battery capacity, battery cycle count, battery state of health (leakage, impedance), etc. In some other embodiments, the power management module 141 may also be disposed in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 may be disposed in the same device.

The wireless communication function of the terminal can be realized by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, the baseband processor, and the like.

The antennas 1 and 2 are used for transmitting and receiving electromagnetic wave signals. Each antenna in a terminal may be used to cover a single or multiple communication bands. Different antennas can also be multiplexed to improve the utilization of the antennas. For example: the antenna 1 may be multiplexed as a diversity antenna of a wireless local area network. In other embodiments, the antenna may be used in conjunction with a tuning switch.

The mobile communication module 150 may provide a solution including 2G/3G/4G/5G wireless communication and the like applied on the terminal. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a Low Noise Amplifier (LNA), and the like. The mobile communication module 150 may receive the electromagnetic wave from the antenna 1, filter, amplify, etc. the received electromagnetic wave, and transmit the electromagnetic wave to the modem processor for demodulation. The mobile communication module 150 may also amplify the signal modulated by the modem processor, and convert the signal into electromagnetic wave through the antenna 1 to radiate the electromagnetic wave. In some embodiments, at least some of the functional modules of the mobile communication module 150 may be disposed in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 may be disposed in the same device as at least some of the modules of the processor 110.

The modem processor may include a modulator and a demodulator. The modulator is used for modulating a low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used for demodulating the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then passes the demodulated low frequency baseband signal to a baseband processor for processing. The low frequency baseband signal is processed by the baseband processor and then transferred to the application processor. The application processor outputs a sound signal through an audio device (not limited to the speaker 170A, the receiver 170B, etc.) or displays an image or video through the display screen 194. In some embodiments, the modem processor may be a stand-alone device. In other embodiments, the modem processor may be provided in the same device as the mobile communication module 150 or other functional modules, independent of the processor 110.

The wireless communication module 160 may provide solutions for wireless communication applied to a terminal, including Wireless Local Area Networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), Global Navigation Satellite System (GNSS), Frequency Modulation (FM), Near Field Communication (NFC), Infrared (IR), and the like. The wireless communication module 160 may be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, performs frequency modulation and filtering processing on electromagnetic wave signals, and transmits the processed signals to the processor 110. The wireless communication module 160 may also receive a signal to be transmitted from the processor 110, perform frequency modulation and amplification on the signal, and convert the signal into electromagnetic waves through the antenna 2 to radiate the electromagnetic waves.

In some embodiments, the antenna 1 of the terminal is coupled to the mobile communication module 150 and the antenna 2 is coupled to the wireless communication module 160 so that the terminal can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), General Packet Radio Service (GPRS), code division multiple access (code division multiple access, CDMA), Wideband Code Division Multiple Access (WCDMA), time-division code division multiple access (time-division code division multiple access, TD-SCDMA), Long Term Evolution (LTE), LTE, BT, GNSS, WLAN, NFC, FM, and/or IR technologies, etc. The GNSS may include a Global Positioning System (GPS), a global navigation satellite system (GLONASS), a beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS), and/or a Satellite Based Augmentation System (SBAS).

The terminal implements the display function through the GPU, the display screen 194, and the application processor, etc. The GPU is a microprocessor for image processing, and is connected to the display screen 194 and an application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or alter display information.

The display screen 194 is used to display images, video, and the like. The display screen 194 includes a display panel. The display panel may adopt a Liquid Crystal Display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (active-matrix organic light-emitting diode, AMOLED), a flexible light-emitting diode (FLED), a miniature, a Micro-oeld, a quantum dot light-emitting diode (QLED), and the like. In some embodiments, the terminal may include 1 or N display screens 194, with N being a positive integer greater than 1.

The terminal can implement a shooting function through the ISP, the camera 193, the video codec, the GPU, the display screen 194, the application processor, and the like.

The ISP is used to process the data fed back by the camera 193. For example, when a photo is taken, the shutter is opened, light is transmitted to the camera photosensitive element through the lens, the optical signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing and converting into an image visible to naked eyes. The ISP can also carry out algorithm optimization on the noise, brightness and skin color of the image. The ISP can also optimize parameters such as exposure, color temperature and the like of a shooting scene. In some embodiments, the ISP may be provided in camera 193.

The camera 193 is used to capture still images or video. The object generates an optical image through the lens and projects the optical image to the photosensitive element. The photosensitive element may be a Charge Coupled Device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The light sensing element converts the optical signal into an electrical signal, which is then passed to the ISP where it is converted into a digital image signal. And the ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into image signal in standard RGB, YUV and other formats. In some embodiments, the terminal may include 1 or N cameras 193, N being a positive integer greater than 1.

The digital signal processor is used for processing digital signals, and can process digital image signals and other digital signals. For example, when the terminal selects a frequency point, the digital signal processor is used for performing fourier transform and the like on the frequency point energy.

Video codecs are used to compress or decompress digital video. The terminal may support one or more video codecs. In this way, the terminal can play or record video in a plurality of coding formats, such as: moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, and the like.

The NPU is a neural-network (NN) computing processor that processes input information quickly by using a biological neural network structure, for example, by using a transfer mode between neurons of a human brain, and can also learn by itself continuously. The NPU can realize the intelligent cognition and other applications of the terminal, such as: image recognition, face recognition, speech recognition, text understanding, and the like.

The external memory interface 120 may be used to connect an external memory card, such as a Micro SD card, to extend the storage capability of the terminal. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function. For example, files such as music, video, etc. are saved in an external memory card.

The internal memory 121 may be used to store computer-executable program code, which includes instructions. The processor 110 executes various functional applications of the terminal and data processing by executing instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. The storage program area may store an operating system, an application program (such as a sound playing function, an image playing function, etc.) required by at least one function, and the like. The storage data area may store data (such as audio data, a phonebook, etc.) created during use of the terminal, and the like. In addition, the internal memory 121 may include a high-speed random access memory, and may further include a nonvolatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash memory (UFS), and the like.

The terminal can implement an audio function through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the earphone interface 170D, and the application processor. Such as music playing, recording, etc.

The audio module 170 is used to convert digital audio information into an analog audio signal output and also to convert an analog audio input into a digital audio signal. The audio module 170 may also be used to encode and decode audio signals. In some embodiments, the audio module 170 may be disposed in the processor 110, or some functional modules of the audio module 170 may be disposed in the processor 110.

The speaker 170A, also called a "horn", is used to convert the audio electrical signal into an acoustic signal. The terminal can listen to music through the speaker 170A or listen to a hands-free call.

The receiver 170B, also called "earpiece", is used to convert the electrical audio signal into an acoustic signal. When the terminal answers a call or voice information, it can answer a voice by placing the receiver 170B close to the human ear.

The microphone 170C, also referred to as a "microphone," is used to convert sound signals into electrical signals. When making a call or transmitting voice information, the user can input a voice signal to the microphone 170C by speaking the user's mouth near the microphone 170C. The terminal may be provided with at least one microphone 170C. In other embodiments, the terminal may be provided with two microphones 170C to achieve a noise reduction function in addition to collecting sound signals. In other embodiments, the terminal may further include three, four, or more microphones 170C to collect sound signals, reduce noise, identify sound sources, and implement directional recording functions.

The headphone interface 170D is used to connect a wired headphone. The headset interface 170D may be the USB interface 130, or may be a 3.5mm open mobile electronic device platform (OMTP) standard interface, a cellular telecommunications industry association (cellular telecommunications industry association of the USA, CTIA) standard interface.

The pressure sensor 180A is used for sensing a pressure signal, and converting the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A may be disposed on the display screen 194. The pressure sensor 180A can be of a wide variety, such as a resistive pressure sensor, an inductive pressure sensor, a capacitive pressure sensor, and the like. The capacitive pressure sensor may be a sensor comprising at least two parallel plates having an electrically conductive material. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The terminal determines the intensity of the pressure from the change in capacitance. When a touch operation is applied to the display screen 194, the terminal detects the intensity of the touch operation according to the pressure sensor 180A. The terminal may also calculate the touched position based on the detection signal of the pressure sensor 180A. In some embodiments, the touch operations that are applied to the same touch position but different touch operation intensities may correspond to different operation instructions. For example: and when the touch operation with the touch operation intensity smaller than the first pressure threshold value acts on the short message application icon, executing an instruction for viewing the short message. And when the touch operation with the touch operation intensity larger than or equal to the first pressure threshold value acts on the short message application icon, executing an instruction of newly building the short message.

The gyro sensor 180B may be used to determine the motion attitude of the terminal. In some embodiments, the angular velocity of the terminal about three axes (i.e., the x, y, and z axes) may be determined by the gyro sensor 180B. The gyro sensor 180B may be used for photographing anti-shake. Illustratively, when the shutter is pressed, the gyroscope sensor 180B detects the shake angle of the terminal, calculates the distance to be compensated for by the lens module according to the shake angle, and allows the lens to counteract the shake of the terminal through reverse movement, thereby achieving anti-shake. The gyroscope sensor 180B may also be used for navigation, somatosensory gaming scenes.

The air pressure sensor 180C is used to measure air pressure. In some embodiments, the terminal calculates altitude from the barometric pressure measured by barometric pressure sensor 180C to assist in positioning and navigation.

The magnetic sensor 180D includes a hall sensor. The terminal may detect the opening and closing of the flip holster using the magnetic sensor 180D. In some embodiments, when the terminal is a folder, the terminal may detect the opening and closing of the folder according to the magnetic sensor 180D. And then according to the opening and closing state of the leather sheath or the opening and closing state of the flip cover, the automatic unlocking of the flip cover is set.

The acceleration sensor 180E can detect the magnitude of acceleration of the terminal in various directions (typically three axes). When the terminal is static, the size and the direction of gravity can be detected. The method can also be used for recognizing the posture of the electronic equipment, and is applied to horizontal and vertical screen switching, pedometers and other applications.

A distance sensor 180F for measuring a distance. The terminal may measure the distance by infrared or laser. In some embodiments, a scene is photographed and the terminal may range using the distance sensor 180F to achieve fast focus.

The proximity light sensor 180G may include, for example, a Light Emitting Diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The terminal emits infrared light outward through the light emitting diode. The terminal uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the terminal. When insufficient reflected light is detected, the terminal may determine that there are no objects near the terminal. The terminal can utilize the proximity light sensor 180G to detect that the user holds the terminal to talk close to the ear, so that the screen is automatically extinguished to achieve the purpose of saving power. The proximity light sensor 180G may also be used in a holster mode, a pocket mode automatically unlocks and locks the screen.

The ambient light sensor 180L is used to sense the ambient light level. The terminal may adaptively adjust the brightness of the display screen 194 based on the perceived ambient light level. The ambient light sensor 180L may also be used to automatically adjust the white balance when taking a picture. The ambient light sensor 180L may also cooperate with the proximity light sensor 180G to detect whether the terminal is in a pocket, to prevent accidental touches.

The fingerprint sensor 180H is used to collect a fingerprint. The terminal can utilize the collected fingerprint characteristics to realize fingerprint unlocking, access to an application lock, fingerprint photographing, fingerprint incoming call answering and the like.

The temperature sensor 180J is used to detect temperature. In some embodiments, the terminal implements a temperature processing strategy using the temperature detected by the temperature sensor 180J. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold, the terminal performs a reduction in the performance of the processor located near the temperature sensor 180J, so as to reduce power consumption and implement thermal protection. In other embodiments, the terminal heats the battery 142 when the temperature is below another threshold to avoid a low temperature causing an abnormal shutdown of the terminal. In other embodiments, the terminal performs a boost on the output voltage of the battery 142 when the temperature is below a further threshold to avoid an abnormal shutdown due to low temperature.

The touch sensor 180K is also referred to as a "touch panel". The touch sensor 180K may be disposed on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, which is also called a "touch screen". The touch sensor 180K is used to detect a touch operation applied thereto or nearby. The touch sensor can communicate the detected touch operation to the application processor to determine the touch event type. Visual output associated with the touch operation may be provided through the display screen 194. In other embodiments, the touch sensor 180K may be disposed on the surface of the terminal at a different position than the display screen 194.

The bone conduction sensor 180M may acquire a vibration signal. In some embodiments, the bone conduction sensor 180M may acquire a vibration signal of the human vocal part vibrating the bone mass. The bone conduction sensor 180M may also contact the human pulse to receive the blood pressure pulsation signal. In some embodiments, the bone conduction sensor 180M may also be disposed in a headset, integrated into a bone conduction headset. The audio module 170 may analyze a voice signal based on the vibration signal of the bone mass vibrated by the sound part acquired by the bone conduction sensor 180M, so as to implement a voice function. The application processor can analyze heart rate information based on the blood pressure beating signal acquired by the bone conduction sensor 180M, so as to realize the heart rate detection function.

The keys 190 include a power-on key, a volume key, and the like. The keys 190 may be mechanical keys. Or may be touch keys. The terminal may receive a key input, and generate a key signal input related to user setting and function control of the terminal.

The motor 191 may generate a vibration cue. The motor 191 may be used for incoming call vibration cues, as well as for touch vibration feedback. For example, touch operations applied to different applications (e.g., photographing, audio playing, etc.) may correspond to different vibration feedback effects. The motor 191 may also respond to different vibration feedback effects for touch operations applied to different areas of the display screen 194. Different application scenes (such as time reminding, receiving information, alarm clock, game and the like) can also correspond to different vibration feedback effects. The touch vibration feedback effect may also support customization.

Indicator 192 may be an indicator light that may be used to indicate a state of charge, a change in charge, or a message, missed call, notification, etc.

The SIM card interface 195 is used to connect a SIM card. The SIM card can be brought into and out of contact with the terminal by being inserted into the SIM card interface 195 or being pulled out of the SIM card interface 195. The terminal can support 1 or N SIM card interfaces, and N is a positive integer greater than 1. The SIM card interface 195 may support a Nano SIM card, a Micro SIM card, a SIM card, etc. The same SIM card interface 195 can be inserted with multiple cards at the same time. The types of the plurality of cards may be the same or different. The SIM card interface 195 may also be compatible with different types of SIM cards. The SIM card interface 195 may also be compatible with external memory cards. The terminal interacts with the network through the SIM card to realize functions of conversation, data communication and the like. In some embodiments, the terminal employs eSIM, namely: an embedded SIM card. The eSIM card can be embedded in the terminal and cannot be separated from the terminal.

The software system of the terminal can adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture or a cloud architecture. The embodiment of the invention takes an Android system with a layered architecture as an example, and exemplarily illustrates a software structure of a terminal.

Fig. 3 is a block diagram of a software configuration of a terminal according to an embodiment of the present invention.

The layered architecture divides the software into several layers, each layer having a clear role and division of labor. The layers communicate with each other through a software interface. In some embodiments, the Android system is divided into four layers, an application layer, an application framework layer, an Android runtime (Android runtime) and system library, and a kernel layer from top to bottom.

The application layer may include a series of application packages.

The application framework layer provides an Application Programming Interface (API) and a programming framework for the application program of the application layer. The application framework layer includes a number of predefined functions.

As shown in FIG. 3, the application framework layers may include a window manager, content provider, view system, phone manager, resource manager, notification manager, and the like.

The window manager is used for managing window programs. The window manager can obtain the size of the display screen, judge whether a status bar exists, lock the screen, intercept the screen and the like.

The content provider is used to store and retrieve data and make it accessible to applications. The data may include video, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

The view system includes visual controls such as controls to display text, controls to display pictures, and the like. The view system may be used to build applications. The display interface may be composed of one or more views. For example, the display interface including the short message notification icon may include a view for displaying text and a view for displaying pictures.

The telephone manager is used for providing a communication function of the terminal. Such as management of call status (including on, off, etc.).

The resource manager provides various resources for the application, such as localized strings, icons, pictures, layout files, video files, and the like.

The notification manager enables the application to display notification information in the status bar, can be used to convey notification-type messages, can disappear automatically after a short dwell, and does not require user interaction. Such as a notification manager used to inform download completion, message alerts, etc. The notification manager may also be a notification that appears in the form of a chart or scroll bar text at the top status bar of the system, such as a notification of a background running application, or a notification that appears on the screen in the form of a dialog window. For example, prompting text information in the status bar, sounding a prompt tone, vibrating the electronic device, flashing an indicator light, etc.

The Android Runtime comprises a core library and a virtual machine. The Android runtime is responsible for scheduling and managing an Android system.

The core library comprises two parts: one part is a function which needs to be called by java language, and the other part is a core library of android.

The application layer and the application framework layer run in an android virtual machine (DALVIK). And executing java files of the application program layer and the application program framework layer into binary files by the android virtual machine. The android virtual machine is used for performing the functions of object life cycle management, stack management, thread management, safety and exception management, garbage recovery and the like.

The system library may include a plurality of functional modules. For example: surface managers (surface managers), Media Libraries (Media Libraries), three-dimensional graphics processing Libraries (e.g., OpenGL ES), 2D graphics engines (e.g., SGL), and the like.

The surface manager is used to manage the display subsystem and provide fusion of 2D and 3D layers for multiple applications.

The media library supports a variety of commonly used audio, video format playback and recording, and still image files, among others. The media library may support a variety of audio-video encoding formats, such as MPEG4, h.264, MP3, AAC, AMR, JPG, PNG, and the like.

The three-dimensional graphic processing library is used for realizing three-dimensional graphic drawing, image rendering, synthesis, layer processing and the like.

The 2D graphics engine is a drawing engine for 2D drawing.

The kernel layer is a layer between hardware and software. The inner core layer at least comprises a display driver, a camera driver, an audio driver and a sensor driver.

In the prior art, key management schemes include a key local management scheme and a key management scheme relying on cloud interaction.

In the local management scheme, a multi-level key management scheme from a root key to a working key is adopted. The root key is composed of a combination of key components. The protection of the root key relies on hard coding the key components when the keys are stored. The key components are stored scattered in a local memory. When the key is used, the key is recovered through the key component, and then the data needing to be encrypted is encrypted by using the key. However, with such an arrangement, the key component hard-coding cannot prevent decompilation. After the illegal user decompiles the password, the key assembly and the assembling mode thereof can be obtained, so that the key can be cracked.

In a key management scheme relying on cloud interaction, a terminal may store a key in a server at the cloud. This ensures the security of the key during storage, but the terminal device has limited computing power, and when using the key, the terminal needs to perform operations such as encryption and decryption with the key, and the computing power of the terminal is limited, resulting in limited types of keys supported.

The embodiment of the present application provides a key protection scheme, which is based on the network architecture shown in fig. 1, and a first device is associated with one or more second devices. The first plant may be understood as a thin plant and the second plant may be understood as a rich plant. The rich device is a device with a secure hardware environment, and the thin device is a device without a secure hardware environment.

The first device stores the keys in the plurality of second devices during key storage. When the first device needs to use the key, for example, when the first device needs to encrypt the data to be encrypted by using the key, the data to be encrypted may be sent to the second device, and the second device encrypts the data to be encrypted by using the stored key and then sends the encrypted data to the first device. So that the first device can obtain encrypted data from the second device. Even under the condition that the first equipment has no secure hardware environment, the key is not stored on the first equipment, so that the condition that an illegally-invaded user steals the key and decompiles the key can be avoided. Furthermore, the encryption process is implemented on the second device such that the complexity of the key is not limited by the computational power of the first device, thereby allowing more, more complex key types to be supported.

In this application, the first device may be understood as a thin device and the second device may be understood as a rich device.

The first device may be, for example, a terminal device that does not have a secure hardware environment. Specifically, the first device may be, for example, but not limited to, a smart speaker, a smart appliance, a mobile phone without a secure hardware environment, a media player, and the like.

The second device may be, for example, but not limited to, a server, a cell phone with a secure hardware environment, a personal computer, a tablet computer, and the like.

In one possible implementation, the secure hardware environment is a Trusted Execution Environment (TEE). For example, the second device includes a Trusted Execution Environment (TEE) and a Rich Execution Environment (REE). The TEE provides a security row environment for Trusted Applications (TAs), while also protecting the resources and data confidentiality, integrity and access rights of the TAs. The rich execution environment REE runs with an operating system of the terminal, such as an android system.

In another possible implementation, the secure hardware environment is a software protection extensions (SGX). SGX is a secure hardware environment on an Intel chip.

In yet another possible implementation, the Secure hardware environment is a Secure Enclave Processor (SEP). The second device may include a hardware environment running an ios system, and a SEP.

The technical solution of the present application is described in detail below with reference to a key usage method.

As shown in fig. 4A, a flow chart of a key using method is schematically illustrated, and the key using method according to the embodiment of the present application includes the following steps:

401. a first device sends a key usage request to a second device, the second device comprising a secure hardware environment;

the first device is a terminal device of a user side, and the second device can be a terminal device, and can also be a server or a cloud device. The first device and the second device can communicate through a wired or wireless communication mode.

Specifically, the first device sends a key use request to the second device according to the key use request of the service module.

The key use request includes pending data. The data to be processed can be understood as the object of key usage. Optionally, the key usage request may further include at least one of an identifier of the first device, an index of the key, a parameter required for key usage, an identifier of the service module, and a key usage operation.

The key using operation may be, but is not limited to, a key using step of requesting to encrypt or decrypt data to be processed, requesting to generate a certificate or verify a certificate, and the like.

The service module is used for realizing the functional service of the first equipment. For example, the smart speaker can implement a voiceprint encryption service function, but the smart speaker does not have a secure hardware environment, and the smart speaker encrypts the voiceprint with the key and stores the key may cause the key to be stolen. Then, by using the technical scheme of the application, when the smart sound box needs to encrypt the voiceprint by using the key and store the key, after the key is generated, a key use request may be sent to the second device, where the key use request includes data to be processed, and the data to be processed may include the voiceprint to be encrypted. The second device comprises a secure hardware environment, then the voiceprint can be encrypted using a key stored by the second device. The key stored by the second device may be that sent by the first device to the second device.

402. And the second equipment processes the key using request according to the key using request by using the key stored in the secure hardware environment to obtain a key using result.

Specifically, the second device processes the data to be processed by using the key stored in the secure environment, and obtains a key usage result.

For example, if the key usage request is to encrypt a voiceprint, the second device may encrypt the voiceprint using a key stored in the secure environment to obtain a key usage result, which includes the encrypted voiceprint. Of course, the key usage result may also include success or failure of the key usage result, and the key usage result may also include other information.

Optionally, the key usage request may include authentication information of the first device, and the second device may process the data to be encrypted after verifying that the key usage request sent by the first device is legal according to the authentication information of the first device, so as to obtain a key usage result.

403. The second device transmits the key use result to the first device.

The key using result may include data obtained after the key using step is performed on the data to be processed, and may also include result information such as whether the key using step is normally performed.

So that the second device can send the key usage result to the first device. For example, after encrypting the voiceprint, the second device sends the resulting voiceprint, including the encrypted voiceprint, to the first device.

The first device may then obtain the encrypted voiceprint.

It can be seen that, in the technical solution of the present application, a first device without a secure hardware environment may host a key to a second device with a secure hardware environment. When the first device needs to use the key, a key use request can be sent to the second device, and the key use request comprises the data to be processed, which can be understood as a key use object. And the second equipment processes the data to be processed by using the key stored in the secure environment to obtain a key using result and sends the key using result to the first equipment. In this way, in the key using process, the key does not need to be stored in the first device without a secure hardware environment, and the first device does not need to process the data to be processed by using the key. Therefore, the key can be prevented from being cracked when being stored in the first equipment without a secure hardware environment, the complexity of the key is not limited by the computing capacity of the first equipment, and the first equipment can support more types of keys with more complexity.

Optionally, as shown in the flowchart of fig. 4B, before step 401, the key using method may further include the steps of:

404. the first device checks the connection status of one or more second devices in the device list, and selects one second device for processing the key use request from the one or more devices in the device list; in step 401, the first device may send a key usage request to the selected second device for processing the key usage request.

The first device stores a device list and an association relationship, the device list comprises identifiers of second devices which have connection relationships with the first device and store keys of the first device, and the association relationship comprises connection modes of the second devices and the first device in the device list.

For example, the device list may include an identifier of the second device 1, an identifier of the second device 2, an identifier of the second device 3, and an identifier of the second device 4, which have an association relationship with the first device and store the key of the first device. The association relationship includes: the association relationship between the first device and the second device 1 is a bluetooth link, the association relationship between the first device and the second device 2 is a bluetooth link, the association relationship between the first device and the second device 3 is a WiFi connection, and the association relationship between the first device and the second device 4 is a wired connection.

When the first device obtains the connection state of one or more second devices in the device list, it is determined whether each second device in the device list can be normally connected with the first device according to the connection mode in the stored association relationship. And the first equipment selects second equipment with the optimal connection state from the second equipment which can be normally connected. The second device with the optimal connection state may be, for example, the second device that responds to the connection first, or the second device with the highest security level of the connection mode with the first device.

If the first device selects the second device k according to the selection method, the first device sends a key use request to the second device k.

It should be understood that the above-mentioned step 401-404 is a step in the process of using the key. The first device may host the key to the second device prior to using the key. That is, the first device may send the key to the second device prior to using the key, the key being stored by the second device in the secure hardware environment.

Specifically, before using the key, the key using method of the embodiment of the present application may further include a step of escrowing the key, where the step of escrowing the key may also be understood as a step of storing the key, and as shown in the flowchart shown in fig. 5, the step of escrowing the key may include:

501. the first device generates a key;

specifically, the first device generates a key according to a service request of the service module. Specifically, the first device generates a key according to a key parameter input by the service. The key parameter may be, for example, plaintext provided by the service module, and the plaintext is encrypted by the first device to obtain the key.

502. The first device sends a key escrow request to the second device, the key escrow request including a key;

after the first device generates the key, the key is escrowed to the second device by sending a key escrow request to the second device.

Specifically, the key escrow request may further include an index of the key, or an index of the escrow key. Therefore, when the subsequent service module has the requirement of using the key, the first device and the second device can determine which key is used by the service module according to the index of the key.

Optionally, the key escrow request may further include an identification of the first device. So that the second device can identify which key the first device sent from based on the key escrow request.

Optionally, the key escrow request may further include a service identifier corresponding to the service module. In this way, the second device can identify which service module corresponds to the key according to the service identifier in the key escrow request.

503. The second device stores the received key;

in particular, the second device stores the key in a secure hardware environment.

Optionally, the second device includes a device list and an association relationship. The device list of the second device comprises a plurality of identifiers of the first devices, and the identifier of the first device in the device list of the second device is the identifier of the first device which has a communication connection relationship with the second device and stores the key by hosting the second device. The association relationship stored by the second device includes the connection mode between each first device in the device list and the second device.

For example, the device list of the second device includes the identifier of the first device 1, the identifier of the first device 2, the identifier of the first device 3, and the identifier of the first device 4. The second device further stores that the association relationship between the first device 1 and the second device is relationship _1, the association relationship between the first device 2 and the second device is relationship _2, the association relationship between the first device 3 and the second device is relationship _3, and the association relationship between the first device 4 and the second device is relationship _ 4.

If the first device sending the key is the first device 5, and the connection mode between the first device 5 and the second device is WiFi connection, the second device adds the identifier of the first device 5 in the device list, and stores the association relationship between the first device 5 and the second device as WiFi connection.

The association relationship between the first device and the second device in the key escrow phase is the same as the association relationship between the first device and the second device when the key is used. In the key using stage, the second device can determine the communication mode with the first device according to the association relation in the storage device list of the second device in the key using stage.

Optionally, the step of escrowing the key may further include:

504. the second device sends a hosting completion notification message to the first device.

In this way, the second device, after storing the key, notifies the first device by sending a escrow completion notification message that the key has been successfully saved. The first device confirms that the escrow of the key has been completed according to the escrow completion notification message.

Specifically, as shown in fig. 6, in the technical solution of the present application, each of the first device and the second device includes a key escrow logic processing module, a local key management module, a device connection module, and a device association relation storage module.

And the key escrow logic processing module is used for being in butt joint with the upper layer business and the lower layer functional module, and is particularly used for logic processing of a key escrow and using process.

And the local key management module is used for processing key generation, key storage, key use, key destruction and other processes related to key life cycle management.

And the equipment connection module comprises an equipment connection state sensing submodule and a connection mode processing module. The device connection state perception sub-module is used for perceiving the link states of the local device and the rich devices in the managed device list. The connection mode processing module is used for managing the connection between the first equipment and the second equipment.

And the device association relation storage module is used for storing the device list and the association relation between each device in the device list and the device.

In order to better describe the technical solution of the present application, the technical solution of the present application is elaborated below by combining a storage method of a key and a using method of the key based on the module structures of the first device and the second device shown in fig. 6.

As shown in fig. 7, a schematic flow chart of a key storage method, a key storage method according to an embodiment of the present application includes the following steps:

701. a key escrow logic processing module of first equipment UDID _ S receives a key escrow request sent by a service module;

when a business module of the first device needs to generate and store a key, a key escrow request is sent to a key escrow logic processing module of the first device. The escrow request may include a key parameter for generating a key. For example, may be plain text, so that the local key management module can generate the key from the plain text.

Alternatively, the service module may specify the key index keyAlias, the device list, and the association relationship. The association may be understood as a communication connection between the first device and the second device.

For example, the service module may specify that the device list includes the second device 1(UDID _1), the second device 2(UDID _2), the second device 3(UDID _3), and the second device 4(UDID _4), and indicate connection relationships of the second device 1 to the second device 4 with the first device, respectively.

Specifically, the business module may specify the key alias, which is the index of the managed key, and enter … …, which specifies the managed device list and corresponding associations { (UDID _1, relationship _1), (UDID _2, relationship _2), etc.

702. A key escrow logic processing module of the first device sends a key generation request to a local key management module;

after the key escrow logic processing module of the first device receives the key escrow request of the business module, the key escrow logic processing module of the first device sends a key generation request to the local key management module, wherein the key generation request includes a key parameter keyParams for generating a key.

703. A local key management module of the first device generates a key according to the key generation request;

and the local key management module of the first device generates a key according to the key parameter keyParams in the key generation request and a key generation algorithm.

704. The local key management module of the first device sends the generated key to the key escrow logic processing module of the first device;

705. a key escrow logic processing module of the first device sends a key escrow request to a device connection module of the first device and requests to store a key generated by a local key management module to the second device;

after acquiring the key generated by the local key management module, the key escrow logic processing module of the first device initiates a key escrow request to the device connection module of the first device to initiate a key escrow process.

706. And the key management logic processing module of the first device sends the device list and the association relation to the association relation storage module of the first device.

Thus, the association relation storage module of the first device stores the device list and the association relation.

Specifically, the association relation storage module of the first device stores keyAlias-UDID _ S { (UDID _1, relationship _1), (UDID _2, relationship _2) … ….

707. The device connection module of the first device reads the device list and the association relation stored by the device association relation storage module, and sends a key escrow request to at least one second device in the device list, wherein the key escrow request comprises the key.

And the device connection module of the first device sends a key escrow request to at least one second device in the device list according to the association relationship so as to escrow the key.

For example, the device connection module of the first device sends a key escrow request to UDID _1 through relationship _ 1.

The key escrow request may further include at least one of an index of the key, an identification of the first device, and an identification of the business module.

708. The device connection module of the second device receives the key escrow request sent by the device connection module of the first device and sends the key escrow request to the key escrow logic processing module of the second device;

after receiving the key escrow request, the device connection module of the second device submits the key escrow request to the key escrow logic processing module of the second device for processing.

709. The key escrow logic processing module of the second device sends the key escrow request to a local key management module of the second device.

710. The local key management module of the second device receives and stores the key.

The local key management module of the second device saves the key in the secure hardware environment of the second device.

In this way, the key generated by the first device is hosted by a local key management module maintained by the second device.

711. And the key escrow logic processing module of the second device sends the association relationship between the second device and the first device to the device association relationship storage module of the second device.

The association relationship between the second device and the first device includes a communication connection mode between the second device and the first device.

Alternatively, step 711 and step 709 may be performed in parallel.

That is to say, while the key escrow logic processing module of the second device sends the key to the local key management module, the association relationship between the second device and the first device may also be sent to the device association relationship storage module of the second device, so that the device association relationship storage module stores the association relationship between the first device and the second device.

712. And the device association relation storage module of the second device stores the association relation between the first device and the second device.

The first device and the second device are connected in a communication mode.

The association relation can be stored in the secure hardware environment of the second device, so that the security of data related to the secret key can be comprehensively guaranteed, and the security of the secret key is improved.

For example, the device association relation storage module of the second device i may store UDID _ S-UDID _ i, relationship _ i, i being any one of 1,2,3, 4.

713. A key escrow logic processing module of the second device sends an escrow completion notification to a device connection module of the second device;

714. the connection management module of the second device sends a hosting completion notification to the device connection module of the first device;

in this way, through the above-described step of storing the key, the first device can implement a secure hardware environment that hosts the generated key to the second device, and thus security during key storage can be ensured.

Optionally, the device connection module of the first device may send the key completion notification to the key escrow logic processing module of the first device.

As shown in fig. 8, a flow chart of a method for using a key is schematically illustrated, and the method for using a key according to the embodiment of the present application includes the following steps:

801. the key escrow logic processing module of the first device receives a key use request sent by a business module of the first device, wherein the key use request comprises data to be processed. The data to be processed can be understood as data of a key usage object.

Optionally, the key use request further includes parameters required for key use. Thus, the second device can complete the key using step according to the key, the parameters required by the key using step and the data to be processed.

Optionally, the key usage request may further include an index keyAlias for the escrow key. This enables the second device hosting the key to determine the key to be used from the index keyAlias.

When the service module of the first device needs to use the key, the service module sends a key use request to the key escrow logic processing module of the first device. For example, when a traffic module for voiceprint identification needs to encrypt a voiceprint, a key usage request may be sent to a key escrow logic processing module of the first device to encrypt the voiceprint using the key. The voiceprint to be encrypted can be understood as the data to be processed, or the data of the object for using the key, or the parameters required when the key is used.

802. The key escrow logic processing module of the first device sends a key use request to the device connection module.

And the key escrow logic processing module sends the key use request sent by the business module to the equipment connection module of the first equipment.

803. The device connection module of the first device acquires the device list and the association relationship from the association relationship storage module of the first device.

For example, the association relation storage module of the first device stores keyAlias _ UDID _ S { (UDID _1, relation _1), (UDID _2, relation _2) … …. The connection module of the first device can acquire keyAlias-UDID _ S { (UDID _1, relationship _1), (UDID _2, relationship _2) … … stored in the association storage module, thereby being able to obtain a device list and association in which the key corresponding to the key with the index keyAlias is stored.

804. And the device connection module of the first device determines a second device for processing the key use request according to the device list and the association relation.

Specifically, the connection mode processing unit of the device connection module checks the connection state of one or more second devices in the device list, and selects one second device for processing the key use request from the one or more devices in the device list.

The scheme for selecting the second device for processing the key usage request by the device connection module can refer to the related description in the explanation of step 404, and will not be described in detail here.

For example, the device connection state sensing unit of the device connection module determines the native connection state, checks whether each second device (UDID _ i) in the device list can be connected through a specified connection relationship _ i (i is 1,2,3,4, … … n, selects an optimal connection manner relationship _ k according to the available connection state of each device, and an optimal second device UDID _ k.

805. The device connection module of the first device transmits a key use request to the second device for processing the key use request.

Optionally, the key use request includes an index of the key, data to be processed, and parameters required for key use. The parameters required for key usage can be understood as the relevant algorithm parameters for key usage.

806. The device connection module of the second device receives the key use request sent by the first device and sends the key use request to the key escrow logic processing module of the second device.

It will be appreciated that the device connection module of the second device forwards the received key usage request to the key escrow logic processing module of the second device.

807. And the key escrow logic processing module of the second device acquires the stored association relationship from the device association relationship storage module.

For example, the key logic hosting processing module of the second device may determine a key to be used according to the key use request, and determine the first device corresponding to the key and the connection relationship between the second device and the first device according to the device list and the association relationship stored in the device association relationship storage module.

808. The key escrow logic processing module of the second device verifies whether the key use request is legitimate.

Specifically, the key escrow logic processing module of the second device verifies whether the first device that sent the key use request possesses the right to request the second device to process the key use request. For example, the identification of the first device may be included in the key use request. The key escrow logic module of the second device may verify, according to the identifier of the first device, whether the first device is a device in the device list, and verify whether a connection manner of the first device and the second device conforms to a stored association relationship between the first device and the second device. And if the first device is a device in the device list and the connection relationship of the first device and the second device also conforms to the stored association relationship of the first device and the second device, verifying whether the key use request is reasonable.

Step 808 and step 807 may be performed in parallel, or step 808 and step 807 may be performed first, or step 807 and step 808 may be performed first.

809. When the key use request is reasonable, the key escrow logic processing module of the second device sends the data to be processed in the key use request and the parameter required by key use to the local key management module of the second device.

Optionally, the key escrow logic processing module of the second device may further send the index of the key to the local key management module of the second device. Thus, the local key management module of the second device can accurately determine which stored key needs to be used for processing the data to be processed.

810. And the local key management module of the second device executes the key using step, processes the data to be processed by using the stored key and the parameters required by the key using step, and obtains the key using result.

The key usage steps may be encryption, decryption, signing, verifying a signature, and the like. Based on the example that the data to be processed is the voiceprint to be encrypted, the local key management module of the second device can encrypt the voiceprint to be encrypted by using the key hosted by the first device and the related algorithm parameters.

811. The local key management module of the second device sends the key usage result to the key escrow logic processing module of the second device.

812. The key escrow logic processing module of the second device sends the key usage result to the device connection module.

813. The device connection module of the second device transmits the key use result to the device connection module of the first device.

814. The device connection module of the first device sends the key usage result to the key escrow logic processing module of the first device.

815. And the key escrow logic processing module of the first device feeds back the key use result to the business module.

Through steps 810 to 815, the second device feeds back the key usage result to the first device, so that the service module sending the key usage request can obtain the key usage result, and complete the key usage process.

Therefore, according to the technical scheme of the application, the first device stores the secret key on the second device which is connected with the certificate, and the secret key is stored by using the secure hardware environment of the second device. The first device sends parameters required when the key is used and data to be processed to the second device, and the key is used by the aid of computing capability of the second device, or the data to be processed is processed by the aid of the computing capability of the second device. Therefore, the secret key is hosted in the second equipment with the secure hardware environment, and the security of secret key storage can be guaranteed; moreover, the key that can be used by the first device can break through the limitation of the computing capability of the first device, so that the variety of keys that can be used by the first device is more diversified.

The embodiment of the present application provides a computer storage medium, which includes computer instructions, and when the computer instructions are run on a terminal, the terminal is enabled to execute the processing method of the application program in any one of the above possible embodiments.

The embodiment of the present application provides a computer program product, which, when running on a terminal, enables the terminal to execute the processing method of the application program in any one of the above possible embodiments.

The above embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and the modifications or the substitutions do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for using a key, comprising:

2. The method of claim 1, wherein before the first device sends the key use request to the second device, the method further comprises:

the first device sending a key use request to a second device includes:

3. The method of claim 1, wherein before the first device sends the key use request to the second device, the method further comprises:

4. The method of claim 3, wherein the key escrow request further includes an index of the key, and wherein the key escrow is further configured to request the second device to save the index of the key; the key use request includes an index of the key and the data to be processed.

5. A method for using a key, comprising:

the second device sends the key usage result to the first device.

6. The method of claim 5, wherein before the second device receives the key usage request sent by the first device, the method further comprises:

the second device stores the key to the secure hardware environment.

7. The method of claim 6, wherein the key escrow request further includes an index of the key; the method further comprises the following steps: the second device storing an index of the key to the secure hardware environment;

the key use request includes an index of the key and the data to be processed.

8. An electronic device comprising a memory, one or more processors, and a plurality of application programs, wherein the memory stores the one or more programs; wherein the one or more processors, when executing the one or more programs, cause the terminal to perform the method of any of claims 1-7.

9. A computer storage medium comprising computer instructions which, when run on a terminal, cause the terminal to perform the method of any one of claims 1 to 7.

10. A computer program product, characterized in that, when run on a terminal, causes the terminal to perform the method according to any of claims 1 to 7.