WO2014206172A1 - 移动设备中的非可信环境与可信环境之间的切换 - Google Patents

移动设备中的非可信环境与可信环境之间的切换 Download PDF

Info

Publication number
WO2014206172A1
WO2014206172A1 PCT/CN2014/078594 CN2014078594W WO2014206172A1 WO 2014206172 A1 WO2014206172 A1 WO 2014206172A1 CN 2014078594 W CN2014078594 W CN 2014078594W WO 2014206172 A1 WO2014206172 A1 WO 2014206172A1
Authority
WO
WIPO (PCT)
Prior art keywords
trusted environment
mobile device
trusted
application
environment
Prior art date
Application number
PCT/CN2014/078594
Other languages
English (en)
French (fr)
Inventor
陈成钱
周钰
郭伟
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2014206172A1 publication Critical patent/WO2014206172A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/461—Saving or restoring of program or task context
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode

Definitions

  • the present invention relates to computer technology, and more particularly to a method of implementing a handover between a non-trusted environment and a trusted environment in a mobile device and a mobile device implementing the method.
  • Background technique
  • Mobile Internet-based services are infiltrating into every aspect of people's daily lives, such as social, shopping, gold n transactions, and access to life information.
  • Many mobile Internet services involve the storage, reading, and transmission of sensitive information (such as user privacy, login identities, and passwords) and therefore require security mechanisms to protect them.
  • security applications based on security mechanisms are generally between the open system and the Caotong application, which can be invoked by the Caotong application to implement the corresponding security mechanism.
  • the Caotong application can be invoked by the Caotong application to implement the corresponding security mechanism.
  • a greater number of security applications are embedded in mobile devices.
  • the entire business process flow of some applications is designed to be done in a trusted environment.
  • the external device In the architecture of the dual-system, in order to achieve the closed processing of sensitive data in a trusted environment, the external device needs to directly interact with the security application on the security system.
  • user intervention is generally required to implement switching between an open system (such as an interface-friendly multimedia production system) and a security system, for example, by a user to initiate a call to a secure application.
  • an open system such as an interface-friendly multimedia production system
  • a security system for example, by a user to initiate a call to a secure application.
  • Ordinary applications or by user actions to switch mobile devices to a trusted environment This will undoubtedly reduce the user experience, especially in applications with high response requirements.
  • One of the objectives of the present invention is to provide a method for implementing switching between a non-trusted environment and a trusted environment in a mobile device, which has the advantages of high efficiency and simple implementation.
  • the method according to the embodiment comprises the following steps: switching to a first switching command of the trusted environment;
  • the mobile device performs security specified by the external device in the trusted environment to perform service processing.
  • the switching operation is triggered in response to the reception of the switching command, and the switching command can be automatically generated by the external device, so that the user does not need to manually perform the operation and the response speed of the application is improved.
  • the method further comprises the following steps:
  • the receiving of the first switching command and the execution of the first switching operation are detected by means of a monitoring module operating in the non-trusted environment.
  • the second switching operation is performed by means of an application interface provided under the trusted environment.
  • the trusted environment is provided by the security system, and includes an application distribution module and a security application list, and the security application specified by the external device is executed in the following manner:
  • the application distribution module analyzes an application selection command received from the external device
  • the application distribution module searches for an application matching the parsed application in the application list and executes the matched application.
  • a mobile device in accordance with an embodiment of the present invention includes: a communication unit adapted to communicate with an external device;
  • a processor associated with the communication unit, storing "and security carrier” and adapted to operate in a non-trusted ring block and a trusted environment, which is concealed to be received from the external device via the communication unit Performing a first handover operation from the non-trusted environment to the trusted environment when the first handover command is switched from the non-trusted environment to the trusted environment, where the first handover operation includes Storing the context information under the non-trusted ring block within the storage, the processor is further configured to perform, in the trusted environment, the specified by the external device in the secure carrier Secure applications to perform business processing.
  • the secure carrier is a smart card or a USB dongle.
  • the processor is further configured to: when receiving, by the communication unit, a second handover command from the external device to switch from the trusted environment to the non-trusted environment And performing, when the service processing is performed by the security application, performing a second switching operation from the trusted environment to the non-trusted environment.
  • the communication unit comprises at least one of the following interfaces: a near field communication interface, a 7816 interface, an SDIO interface, and a WiFi interface.
  • the trusted environment is implemented by a security system.
  • FIG. 1 is a block diagram of a mobile device in accordance with one embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a dual-system architecture applicable to the mobile device shown in FIG. 1.
  • 3 is a flow chart of a method of implementing a handover between a non-trusted environment and a trusted environment in a mobile device in accordance with another embodiment of the present invention. detailed description
  • a trusted environment refers to the behavior of components, processes, or operations under such conditions that are predictable under any conditions and are well protected against bad code and certain physical interference. damage.
  • the trusted environment is coordinated by the hardware platform and the security system.
  • a security system refers to a system that enables a mobile device to operate in a secure mode.
  • An unsecured system refers to an open system that enables a mobile device to operate in a normal mode.
  • a security bearer refers to an independent hardware module with computing and storage functions, which on the one hand is equipped with an application that implements security functions, and on the other hand, is externally provided with a callable security mechanism.
  • secure carriers include, but are not limited to
  • SIM card and smart SD card etc.
  • a monitoring module is provided in a non-secure operating system such as a multimedia production system for detecting whether a message received from an external device includes a switching command and detecting a switching command Allows the mobile device to switch from a non-trusted environment to a trusted environment.
  • a non-secure operating system such as a multimedia production system for detecting whether a message received from an external device includes a switching command and detecting a switching command Allows the mobile device to switch from a non-trusted environment to a trusted environment.
  • a non-secure operating system such as a multimedia production system for detecting whether a message received from an external device includes a switching command and detecting a switching command Allows the mobile device to switch from a non-trusted environment to a trusted environment.
  • FIG. 1 is a block diagram of a mobile device in accordance with one embodiment of the present invention.
  • the mobile device 10 of the present embodiment includes a communication interface 110, a storage «120, a security carrier 130, and a processor 140, wherein the processor 140 is coupled to the communication unit 110, the memory 120, and the secure carrier 130.
  • the communication unit 110 is responsible for communication between the mobile device 10 and the external device 20, which may, for example, comprise at least one of the following interfaces: a WIFI interface, an NFC interface, 7816 Interface and SDIO interface.
  • the memory 120 includes a nonvolatile memory 121 and a dynamic random access memory 122.
  • the computer program e.g., non-secure operating system
  • the security system can be loaded into dynamic memory 122 at power up, or loaded into dynamic memory 122 upon receipt of a switch command.
  • the secure application is stored in the secure carrier 130, and operations of sensitive data involved in the execution of the secure application (eg, encryption, decryption, modification, etc. of sensitive data) are performed within the secure carrier 130, and the sensitive data is on the secure carrier 130.
  • sensitive data eg, encryption, decryption, modification, etc. of sensitive data
  • the outside is presented in cipher text.
  • the processor 140 runs a computer program loaded into the dynamic memory 121 to cooperate with other components of the mobile device 10 to perform various application processes. For example, when processing « 140 in a non-trusted environment, it can interact with external device 20 via communication unit 110 to perform normal business processing. At the same time, the processor 140 runs a monitoring module to detect whether the external device 20 sends a first switching command from the non-trusted environment to the trusted environment, and after detecting the command, the context generated in the non-trusted environment The information is saved to the dynamic random access memory 122, and then the operation of the non-secure operating system is terminated and the secure operating system is activated.
  • the security system parses the request message received by the communication unit 110 from the external device 20 to determine the security application to be invoked, and then, under the control of the security system, the external device 20 and the security carrier Interactions are made between 130 to perform business processing in secure mode.
  • the security system detects the second switching command sent from the trusted environment to the non-trusted environment sent by the external device 20, the security system will end the operation and start the non-secure operation. Make a system to return to an untrusted environment.
  • the processor 140 will also perform a handover operation from the trusted environment to the non-trusted environment.
  • the dual operating system architecture 200 includes a non-secure operating system 210 and a security operating system 220.
  • the non-secure production system includes, for example, but not limited to, a multimedia production system such as Android, Linux platform, and the security production system is based on hardware security technology (for example, ARM's TrustZone technology, Intel's chaabi technology). .
  • the non-secure operating system 210 includes a communication module 211 and an affinity with the communication module 211.
  • Monitoring module 212 detects the message received by the communication module 211 from the external device, and saves the context information generated in the non-trusted environment to the dynamic random when detecting the first switching command from the non-trusted environment to the trusted environment.
  • the operation of the non-secure operating system is subsequently established and the secure operating system is activated.
  • the secure operating system 220 includes an application distribution module 221 and a secure application list 222, wherein the application distribution module 221 is coupled to the monitoring module 212.
  • the application distribution module 221 parses the application selection command received by the communication unit 110 from the external device 20, and then selects and runs the security application matching the analysis result from the security application list 222, whereby the external device 20 interacts with the security application.
  • the application distribution module 221 parses the application selection command received by the communication unit 110 from the external device 20, and then selects and runs the security application matching the analysis result from the security application list 222, whereby the external device 20 interacts with the security application.
  • To perform the corresponding business process When the entire business process is closed, the mobile device 10 will return from the trusted environment to the non-trusted environment, and the switching operation (i.e., the second switching operation described above) can be triggered by the following events.
  • the security application when the executed security application actively ends the service processing flow, the security application directly performs the second switching operation; or may be sent by the external device 20 to the mobile device 10 when the service processing flow ends. Switching the switching command of the operation, the second switching is completed by the security operating system.
  • the switching performed by the secure application can be implemented uniformly by the API provided by the security system.
  • FIG. 3 is a flow chart of a method of implementing a handover between a non-trusted environment and a trusted environment in a mobile device in accordance with another embodiment of the present invention.
  • the architecture of the mobile device shown in FIG. 1 and the dual-system architecture shown in FIG. 2 are employed, but it will be recognized from the following description that the method of the present embodiment does not depend on a specific Architecture.
  • step S301 the external device 20 establishes a communication connection with the mobile device 10, which may be based on various technologies including, for example, but not limited to, near field communication technology, Bluetooth technology, WiFi technology, and the like.
  • step S302 the mobile device 10 receives the message from the external device 20.
  • step S303 the mobile device 10 in the non-trusted environment detects, by means of the monitoring module 212, for example, whether the message received from the external device 20 includes a first switching command for switching from the non-trusted environment to the trusted environment, if When the first switching command is detected, the process proceeds to step S304, otherwise returns to step S302.
  • step S304 the context information in the non-trusted environment is saved in the dynamic memory 122, and the control of the mobile device 10 is transferred by the non-secure operating system 210 to the secure operating system 220 to effect switching from the non-trusted environment. Switch to a trusted environment. Then, step S305 is executed, and the application distribution module 211 of the security system 210 parses the message sent by the external device 20 to retrieve an application selection command, where the application selection command specifies the security application that needs to be executed.
  • step S306 the application distribution module 211 retrieves the secure application list 211 to determine whether there is a secure application matching the parsing result, and if so, proceeds to step S307, otherwise proceeds to step S308.
  • step S307 the external device 20 interacts with the secure application within the secure carrier 130 to begin the required service processing.
  • step S309 the security operating system 220 detects whether a second handover command sent from the trusted environment to the non-trusted environment sent by the external device 20 is received, or the service processing ends by the executed security application, if the event is detected. Either step S310, the switching operation from the trusted environment to the non-trusted environment is performed by the security system 220, otherwise the detection is continued.
  • step S308 the security system performs a handover operation from the trusted environment to the non-trusted environment and sends a message to the external device 20 that the security application call failed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Telephone Function (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明涉及计算机技术，特别涉及在移动设备中实现非可信环境与可信环境之间切换的方法以及实现该方法的移动设备。按照本发明一个实施例的方法包括下列步骤：检测是否从外部设备接收到指示使所述移动设备从所述非可信环境切换至所述可信环境的第一切换命令；如果检测到所述第一切换命令，执行从所述非可信环境至所述可信环境的第一切换操作，该第一切换操作包括在所述非可信环境下的上下文信息的保存；以及所述移动设备在所述可信环境下执行所述外部设备指定的安全应用以执行业务处理。

Description

移动设备中的非可信环境与可信环境之间的切换 技术领域
本发明涉及计算机技术，特别涉及在移动设备中实现非可信环境 与可信环境之间切换的方法以及实现该方法的移动设备。 背景技术
随着宽带无线接入技术和移动终端技术的飞速发展，移动互联网 应运而生并且成为发展最快、 潜力最大和前景最为诱人的市场。 基于 移动互联网的业务正在滲入人们日常生活的各个方面，例如社交、 购 物、 金 n交易和生活信息获取等。 许多移动互联网业务涉及敏臻信息 (例如用户除私、 登录身份和密码等）的存储、 读取和传输， 因此需 要提供安全机制加以保护。
在现有的移动设备中 ，基于安全机制的安全应用一般处于开放性 搡作系统与曹通应用之间 ，其可以被曹通应用调用以实现相应的安全 机制。 随着安全需求的日益增多，移动设备中内匿了更多数量的安全 应用。 此外，为了提供更高的安全性，有些应用的整个业务处理流程 被设计为都在可信环境下完成。 上面这些技术发展态势使得集成多种 安全应用的应用平台应运而生， 由于其独立于开放性搡作系统， 因此 其又被称为安全操作系统。
在双搡作系统的架构下，为了实现敏感数据在可信环境下的封闭 处理，外部设备需要直接与安全搡作系统上的安全应用进行交互。 然 而在现有的移动设备中 ，一般需要用户干预才能实现在开放性搡作系 统（例如界面友好的多媒体搡作系统）与安全搡作系统之间的切换， 例如通过用户来启动调用安全应用的普通应用或者通过用户搡作以将 移动设备切换到可信环境。 这无疑会降低用户体验，特别是在对响应 要求较高的应用场景下。
由此可见，如何在移动设备中实现非可信环境与可信环境之间的 流畅切换是一个迫切需要解决的问题。 发明内容 本发明的目的之一是提供一种在移动设备中实现非可信环境与可 信环境之间切换的方法，其具有高效和实现简单等优点。
按照本实施例的方法包括下列步骤： 境切换至所述可信环境的第一切换命令；
如果检測到所述第一切换命令，执行从所述非可信环境至所述可 信环境的第一切换搡作，该第一切换搡作包括在所述非可信环境下的 上下文信息的保存；以及
所述移动设备在所述可信环境下执行所述外部设备指定的安全应 用以执行业务处理。
在上述实施例中 ，响应于切换命令的接收而触发切换搡作，而该 切换命令可以由外部设备自动生成， 因此无需用户手动搡作并且提高 了应用的响应速度。
优选地，在上述方法中 ，进一步包括下列步骤：
如果检測到从外部设备接收的使所述移动设备从所述可信环境切 换到所述非可信环境的第二切换命令，或者如果所述业务处理由所述 安全应用结束执行，则执行从所述可信环境至所述非可信环境的第二 切换搡作。
优选地，在上述方法中 ，借助内匿于所述非可信环境下运行的监 測模块来检測第一切换命令的接收和执行所述第一切换搡作。
优选地，在上述方法中 ，借助内匿于所述可信环境下提供的应用 程序接口执行所述第二切换搡作。
优选地，在上述方法中 ，所述可信环境由安全搡作系统搵供，其 包括应用分发模块和安全应用列表，按照下列方式执行所述外部设备 指定的安全应用程序：
所述应用分发模块对接收自所述外部设备的应用选择命令进行解 析；以及
所述应用分发模块在所述应用列表中査找与解析得到的应用匹配 的应用并且执行该匹配的应用。
本发明的还有一个目的是提供一种移动设备，其可以高效和简单 的方式实现非可信环境与可信环境之间的切换。
按照本发明一个实施例的移动设备包括： 适于与外部设备进行通信的通信单元；
存储器；
适于存储安全应用的安全载体；
与所述通信单元、 存储《和安全载体 «合并且适于在非可信环塊 和可信环境下运行的处理器，其被配匿为当经所述通信单元从所述外 部设备接收到从所述非可信环境切换至所述可信环境的第一切换命令 时，执行从所述非可信环境至所述可信环境的第一切换搡作，该第一 切换搡作包括所述非可信环塊下的上下文信息在所述存储《内的保 存，所述处理器还被配匿为在所述可信环境下执行所述安全载体内的、 由所述外部设备指定的安全应用以执行业务处理。
优选地，在上述移动设备中 ，所述安全载体为智能卡或 USB加密 锁。
优选地，在上述移动设备中 ，所述处理器进一步配匿为 ： 当经所 述通信单元从所述外部设备接收到从所述可信环境切换至所述非可信 环境的第二切换命令时，或者当所述业务处理由所述安全应用结朿执 行时，执行从所述可信环境至所述非可信环境的第二切换搡作。
优选地，在上述移动设备中 ，所述通信单元包含下列接口中的至 少一种：近场通信接口、 7816接口、 SDIO接口和 WiFi接口。
优选地，在上述移动设备中 ，所述可信环境由安全搡作系统实现。 附图说明
从结合附图的以下详细说明中 ，将会使本发明的上述和其它目的 及优点更加完全清楚。
图 1为按照本发明一个实施例的移动设备的架构图。
图 2为可应用于图 1所示移动设备的双搡作系统架构的示意图。 图 3为按照本发明另一个实施例的在移动设备中实现非可信环境 与可信环境之间切换的方法的流程图。 具体实施方式
下面通过参考附图描述具体实施方式来阐述本发明。 但是需要理 解的是，这些具体实施方式仅仅是示例性的，对于本发明的精神和保 护范围并无限制作用。 在本说明书中 ， " 包含" 和" 包括" 之类的用语表示除了具有在 说明书和权利要求书中有直接和明病表述的单元和步骤以外，本发明 的技术方案也不排除具有未被直接或明确表述的其它单元和步骤的情 形。 再者，诸如" 第一" 、 " 第二" 、 " 第三" 和" 第四" 之类的用 语并不表示单元或数值在时间、 空间、 大小等方面的順序而仅仅是作 区分各单元或数值之用。
在本说明书中 ，可信环境指的是在该环境下，组件、 过程或搡作 的行为在任意搡作条件下是可预測的，并且能很好地抵御不良代码和 一定的物理干扰造成的破坏。 在现有的移动设备中 ，可信环境由硬件 平台与安全搡作系统协同搵供。
在本说明书中 ，安全搡作系统指的是使移动设备在安全模式下工 作的搡作系统，非安全搡作系统指的是使移动设备在正常模式下工作 的开放性搡作系统。
在本说明书中 ，安全载体指的是一种具有计算和存储功能的独立 硬件模块，其一方面配匿实现安全功能的应用程序，另一方面还向外 部装匿搵供可调用的安全机制服务。 安全载体的例子包括但不限于
SIM卡和智能 SD卡等。
按照本发明的实施例，在诸如多媒体搡作系统之类的非安全搡作 系统中坩设一个监測模块，用于检測从外部设备接收到的消息中是否 包含切换命令并且在检測到切换命令时使移动设备从非可信环境切换 至可信环境。 在上述实施例中 ， 当由非可信环境切换至可信环境时， 原先在非可信环境下的上下文信息将被保留，并且随后外部设备与移 动设备之间交互的控制权将交由安全搡作系统，使得移动设备执行安 全载体内的、 由外部设备指定或调用的安全应用。 另一方面， 当外部 设备发送由可信环境切换至非可信环境的命令或者安全应用主动结束 执行业务处理时，安全搡作系统将结束运行并启动非安全搡作系统。
图 1为按照本发明一个实施例的移动设备的架构图。
如图 1所示，本实施例的移动设备 10包括通信接口 110、 存储 « 120、 安全载体 130和处理器 140，其中 ，处理器 140与通信单元 110、 存储器 120和安全载体 130耦合。
通信单元 110负责移动设备 10与外部设备 20之间的通信，其例 如可以包含下列接口中的至少一种：如 WIFI接口、 NFC接口、 7816 接口和 SDIO接口等。
在本实施例中 ，存储器 120包括非易失存储器 121和动态随机存 储器 122。 当移动设备 10加电启动时，非易失存储器 121中存储的计 算机程序（例如非安全搡作系统）被加载到动态随机存储 « 122 内。 安全搡作系统可以在加电启动时加载到动态存储器 122 内，或者在接 收到切换命令时被加载到动态存储器 122内。
安全应用存储在安全载体 130内，并且安全应用执行过程中所涉 及的敏感数据的操作（例如敏感数据的加密、 解密和修改等）等都在 安全载体 130内部完成，并且敏感数据在安全载体 130外部都以密文 的形式呈现。
处理器 140运行加载到动态存储器 121中的计算机程序，从而与 移动设备 10的其它部件协同完成各种应用处理。 例如， 当处理 « 140 在非可信环境运行时，其可经通信单元 110与外部设备 20交互以执行 普通的业务处理。 与此同时，处理器 140运行监測模块以检測外部设 备 20是否发送从非可信环境到可信环境的第一切换命令，并且在检測 到该命令后，将非可信环境下产生的上下文信息保存到动态随机存储 器 122内，随后结束非安全搡作系统的运行并启动安全搡作系统。 在 可信环境下，安全搡作系统对通信单元 110从外部设备 20接收的请求 消息进行解析以¾定需要调用的安全应用 ，随后，在安全搡作系统的 控制下，外部设备 20与安全载体 130之间进行交互以在安全模式下执 行业务处理。 另一方面，在可信环境下， 当安全搡作系统检測到外部 设备 20发送的从可信环境到非可信环境的第二切换命令时，安全搡作 系统将结束运行并启动非安全搡作系统以返回非可信环境。 另外，在 可信环境下，当安全载体 130内的安全应用结朿执行上述业务处理时， 处理器 140也将执行从可信环境至非可信环境的切换搡作。
图 2为可应用于图 1所示移动设备的双搡作系统架构的示意图。 如图 2所示，双操作系统架构 200包括非安全搡作系统 210和安 全搡作系统 220。 在本实施例中 ，非安全搡作系统例如包括但不限于 Android, Linux平台之类的多媒体搡作系统，安全搡作系统基于硬件 安全技术（例如 ARM公司的 TrustZone技术、 Intel公司的 chaabi技 术）。
非安全搡作系统 210包括通信模块 211和与通信模块 211親合的 监測模块 212。监测模块 212对通信模块 211从外部设备接收到的消息 进行检測 ，并且当检測到从非可信环境到可信环境的第一切换命令时 将非可信环境下产生的上下文信息保存到动态随机存储器 122内，随 后结朿非安全搡作系统的运行并启动安全搡作系统。
安全操作系统 220包括应用分发模块 221和安全应用列表 222，其 中应用分发模块 221与监测模块 212耦合。 当监測模块 212检测到第 一切换命令时而使移动设备切换至安全搡作系统后，应用分发模块 221 开始运行。应用分发模块 221将对通信单元 110从外部设备 20接收的 应用选择命令进行解析，然后从安全应用列表 222中选出与解析结果 匹配的安全应用并运行，由此外部设备 20与该安全应用交互以执行相 应的业务处理。 当整个业务处理流程结朿后，移动设备 10将从可信环 境返回非可信环境，该切换搡作（也即上述第二切换搡作）可以由下 列事件触发。 具体而言， 当所执行的安全应用主动结束业务处理流程 时，该安全应用将直接执行第二切换搡作；或者可以由外部设备 20在 结束业务处理流程时，通过向移动设备 10发送执行第二切换搡作的切 换命令， 由安全操作系统完成第二切换。 优选地，安全应用执行的切 换搡作可以统一由安全搡作系统提供的 API来实现。
图 3为按照本发明另一个实施例的在移动设备中实现非可信环境 与可信环境之间切换的方法的流程图。 示例性地，这里假设采用图 1 所示的移动设备的架构以及图 2所示的双搡作系统架构，但是从下面 的描述中将会认识到，本实施例的方法并不依赖于特定的架构。
如图 3所示，在步骤 S301中 ，外部设备 20与移动设备 10建立通 信连接，该通信连接可以基于各种技术，例如包括但不限于近场通信 技术、 蓝牙技术和 WiFi技术等。
随后在步骤 S302中 ，移动设备 10从外部设备 20接收消息。接着 执行步骤 S303，处于非可信环境下的移动设备 10例如借助监測模块 212检測从外部设备 20接收到的消息中是否包含从非可信环境切换至 可信环境的第一切换命令，如果检測到第一切换命令，则进入步骤 S304，否则返回步骤 S302。
在步骤 S304，非可信环境下的上下文信息被保存在动态存储器 122中 ，并且对移动设备 10的控制权由非安全操作系统 210被转交至 安全搡作系统 220以实现从非可信环境切换至可信环境的切换。 随后执行步骤 S305，安全搡作系统 210的应用分发模块 211对外 部设备 20发送的消息进行解析以搵取应用选择命令，该应用选择命令 指定需要执行的安全应用。
接着进入步骤 S306，应用分发模块 211检索安全应用列表 211以 确定是否存在与解析结果匹配的安全应用 ，如果存在，则进入步骤 S307，否则进入步骤 S308。
在步骤 S307，外部设备 20与安全载体 130内的安全应用交互以 开始所需的业务处理。 接着执行步骤 S309，安全操作系统 220检測是 否接收到外部设备 20发送的从可信环境返回非可信环境的第二切换命 令，或者业务处理由被执行的安全应用结束，如果检測到上述事件的 任一个，则进入步骤 S310，由安全搡作系统 220执行从可信环境至非 可信环境的切换操作，否则继续检测。
回到步骤 S306的后续另一个分支。 在步骤 S308，安全搡作系统 将执行从可信环境至非可信环境的切换搡作并且向外部设备 20发送安 全应用调用失败的消息。
由于可以在不背禽本发明基本精神的情况下，以各种形式实施本 发明 ， 因此上面描述的具体实施方式仅是说明性的而不是限制性的。 本发明的范围由所附权利要求定义，对上面描述方式所作的各种变化 或变动都厲于所附权利要求的保护范围。

Claims

权 利 要 求
1. 一种在移动设备中实现非可信环境与可信环境之间切换的方 法，其特征在于，所述方法包括下列步骤：
检測是否从外部设备接收到指示使所述移动设备从所述非可信环 塊切换至所述可信环境的第一切换命令；
如果检測到所述第一切换命令，执行从所述非可信环境至所述可 信环境的第一切换搡作，该第一切换搡作包括在所述非可信环境下的 上下文信息的保存；以及
所述移动设备在所述可信环境下执行所述外部设备指定的安全应 用以执行业务处理。
2. 如权利要求 1所述的方法，其中 ，进一步包括下列步骤： 如果检測到从外部设备接收的使所述移动设备从所述可信环境切 换到所述非可信环境的第二切换命令，或者如果所述业务处理由所述 安全应用结束执行，则执行从所述可信环境至所述非可信环境的第二 切换搡作。
3. 如权利要求 2所述的方法，其中 ，借助内匿于所述非可信环境 下运行的监測模块来检測第一切换命令的接收和执行所述第一切换搡 作。
4. 如权利要求 1所述的方法，其中 ，借助内匿于所述可信环境下 提供的应用程序接口执行所述第二切换搡作。
5. 如权利要求 1所述的方法，其中 ，所述可信环境由安全操作系 统提供，其包括应用分发模块和安全应用列表，按照下列方式执行所 述外部设备指定的安全应用程序：
所述应用分发模块对接收自所述外部设备的应用选择命令进行解 析；以及
所述应用分发模块在所述应用列表中査找与解析得到的应用匹配 的应用并且执行该匹配的应用。
6. 一种移动设备，其特征在于，包括：
适于与外部设备进行通信的通信单元；
存储器；
适于存储安全应用的安全载体； 与所述通信单元、 存储器和安全载体耦合并且适于在非可信环境 和可信环境下运行的处理器，其被配匿为当经所述通信单元从所述外 部设备接收到从所述非可信环境切换至所述可信环境的第一切换命令 时，执行从所述非可信环境至所述可信环塊的第一切换搡作，该第一 切换搡作包括所述非可信环境下的上下文信息在所述存储器内的保 存，所述处理器还被配匿为在所述可信环境下执行所述安全载体内的、 由所述外部设备指定的安全应用以执行业务处理。
7. 如权利要求 6所述的移动设备，其中 ，所述安全载体为智能卡 或 USB加密锁。
8. 如权利要求 6所述的移动设备，其中 ，所述处理器进一步配匿 为 ： 当经所述通信单元从所述外部设备接收到从所述可信环境切换至 所述非可信环塊的第二切换命令时，或者当所述业务处理由所述安全 应用结束执行时，执行从所述可信环境至所述非可信环境的第二切换 搡作。
9. 如权利要求 6所述的移动设备，其中 ，所述通信单元包含下列 接口中的至少一种：近场通信接口、 7816 接口、 SDIO 接口和 WiFi 接口。
10. 如权利要求 6所述的移动设备，其中 ，所述可信环境由安全搡 作系统实现。
PCT/CN2014/078594 2013-06-27 2014-05-28 移动设备中的非可信环境与可信环境之间的切换 WO2014206172A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310262079.0 2013-06-27
CN201310262079.0A CN104252388B (zh) 2013-06-27 2013-06-27 移动设备中的非可信环境与可信环境之间的切换

Publications (1)

Publication Number Publication Date
WO2014206172A1 true WO2014206172A1 (zh) 2014-12-31

Family

ID=52141003

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/078594 WO2014206172A1 (zh) 2013-06-27 2014-05-28 移动设备中的非可信环境与可信环境之间的切换

Country Status (2)

Country Link
CN (1) CN104252388B (zh)
WO (1) WO2014206172A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110757452A (zh) * 2019-09-25 2020-02-07 北京爱接力科技发展有限公司 机器人中多场景运行方法、装置和机器人

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105912954A (zh) * 2016-05-16 2016-08-31 北京珠穆朗玛移动通信有限公司 一种适用于移动终端的私密信息保护方法及系统
CN106155905B (zh) * 2016-06-28 2019-06-07 广州华多网络科技有限公司 应用环境切换方法以及装置
CN109214215B (zh) * 2018-06-19 2021-10-26 中国银联股份有限公司 基于tee和ree的分离式切换方法及其系统
CN111125711B (zh) * 2019-12-03 2021-05-07 支付宝(杭州)信息技术有限公司 安全任务处理方法、装置、电子设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1711526A (zh) * 2002-11-18 2005-12-21 Arm有限公司 安全处理系统内的异常类型
CN101473679A (zh) * 2006-06-16 2009-07-01 诺基亚公司 在系统间切换的情况下用于为终端传送pdp上下文信息的设备和方法
CN101477601A (zh) * 2008-01-02 2009-07-08 Arm有限公司 给非安全应用提供安全业务

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7950020B2 (en) * 2006-03-16 2011-05-24 Ntt Docomo, Inc. Secure operating system switching
CN101771754B (zh) * 2008-12-31 2014-04-23 北京联想软件有限公司 一种移动终端及其近场通信的方法
CN102111477A (zh) * 2011-02-25 2011-06-29 宇龙计算机通信科技(深圳)有限公司 终端安全验证方法、终端及智能卡
DE102011115135A1 (de) * 2011-10-07 2013-04-11 Giesecke & Devrient Gmbh Mikroprozessorsystem mit gesicherter Laufzeitumgebung
CN103150514B (zh) * 2013-03-07 2015-09-09 中国科学院软件研究所 一种基于移动设备的可信模块及其可信服务方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1711526A (zh) * 2002-11-18 2005-12-21 Arm有限公司 安全处理系统内的异常类型
CN101473679A (zh) * 2006-06-16 2009-07-01 诺基亚公司 在系统间切换的情况下用于为终端传送pdp上下文信息的设备和方法
CN101477601A (zh) * 2008-01-02 2009-07-08 Arm有限公司 给非安全应用提供安全业务

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110757452A (zh) * 2019-09-25 2020-02-07 北京爱接力科技发展有限公司 机器人中多场景运行方法、装置和机器人

Also Published As

Publication number Publication date
CN104252388A (zh) 2014-12-31
CN104252388B (zh) 2018-10-23

Similar Documents

Publication Publication Date Title
JP5596785B2 (ja) 仮想モバイル機器
AU2010265909B2 (en) Migrating functionality in virtualized mobile devices
JP5611338B2 (ja) 仮想モバイル機器のセキュリティの提供
JP5620482B2 (ja) 仮想モバイル機器の使用制御
US9578445B2 (en) Systems and methods to synchronize data to a mobile device based on a device usage context
US20100328064A1 (en) Preventing malware attacks in virtualized mobile devices
US10360369B2 (en) Securing sensor data
CN106663163B (zh) 保障音频通信安全
US20160066273A1 (en) Communication of processor state information
KR101654778B1 (ko) 하드웨어 강제 액세스 보호
CN109416800B (zh) 一种移动终端的认证方法及移动终端
WO2014206172A1 (zh) 移动设备中的非可信环境与可信环境之间的切换
US20160103716A1 (en) Method for using shared device in apparatus capable of operating two operating systems
JP6388765B2 (ja) 無効化モジュールを備えた電子アセンブリ
WO2015131585A1 (zh) 一种保证sd卡安全的方法和装置
CN105404820A (zh) 文件安全存取系统与方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14817951

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14817951

Country of ref document: EP

Kind code of ref document: A1