WO2016070810A1 - 双执行环境之间双向访问应用的方法 - Google Patents
双执行环境之间双向访问应用的方法 Download PDFInfo
- Publication number
- WO2016070810A1 WO2016070810A1 PCT/CN2015/093770 CN2015093770W WO2016070810A1 WO 2016070810 A1 WO2016070810 A1 WO 2016070810A1 CN 2015093770 W CN2015093770 W CN 2015093770W WO 2016070810 A1 WO2016070810 A1 WO 2016070810A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- application
- communication module
- return visit
- client
- request
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
Definitions
- the present invention relates to the field of intelligent mobile device technologies, and more particularly to a method for bidirectional access application between dual execution environments.
- the Trusted execution environment proposed by GlobalPlatform has been widely used as a technical implementation platform of the solution.
- the function implementation to meet a certain business needs is divided into two applications by the original single application: one is deployed as a client application in a multimedia execution environment, also known as a REE (Rich execution environment) application, and the other Deployed as a security application in a trusted execution environment, also known as a TEE application.
- the REE application in the multimedia execution environment needs to access the TEE application in the trusted execution environment, that is, access the service provided by the TEE application, and the corresponding service result is returned to the multimedia execution environment by the TEE application.
- REE application REE application.
- the REE application and the TEE application use the following mechanisms for communication: the REE communication module and the TEE communication module operate in a multimedia execution environment and a trusted execution environment, respectively, and implement a REE application using a request-response method. Data interaction with the TEE application. Specifically, when the REE application requests access to the TEE application, the access request is first forwarded to the REE communication module, and the REE communication module switches to the secure operating system through a switching mechanism between the dual systems, and then sends the request to the TEE in the form of a Request command.
- the communication module after obtaining the request, determines the TEE application to which the request is to be sent and forwards the request data to the TEE application, and after receiving the request, the TEE application processes the data to generate the result data, and then invokes the TEE communication.
- the module's Response command returns the result data to REE application.
- the new Request command cannot be initiated until the Response command returns the REE application.
- This solution has the following problems: When the TEE application needs to perform more complicated processing on the access request of the REE application, the TEE application can no longer be used in the multimedia execution environment because a new Request command cannot be inserted between the previous Request-Response commands.
- the REE application captures the basic data needed to perform complex processing, requiring the trusted execution environment to have more and more powerful capabilities to support this complex processing.
- the TEE application when a TEE application requires background participation or access to a smart memory card for complex processing, the TEE application needs a trusted execution environment to be networked or has a smart memory card access interface, which will undoubtedly The structure of the trusted execution environment becomes larger and more complex, which increases the difficulty of the verifiability of the secure operating system, and also causes more system defects, which in turn reduces the security of the system.
- the present invention provides a technical solution as follows:
- a method for bidirectionally accessing an application between two execution environments wherein the dual execution environment includes a trusted execution environment and a multimedia execution environment, and the multimedia execution environment is deployed with at least one client application and a first communication module, and the trusted execution environment is deployed at least A security application and a second communication module, the client application and the security application perform data interaction through the first communication module and the second communication module, the method comprising the following steps: a), the first client application sends a pair through the first communication module An access request of the first security application; wherein the first client application is any client application, the first security application is a security application that the first client application needs to access; b) the first security application performs the first phase processing on the access request Obtaining the first result data and forwarding the data to the second communication module; wherein the first result data specifies at least one second client application, the second client application is a client application that the first security application needs to return; c), the second communication The module establishes at least one pair between the first communication module and the second communication module according to the first result
- the second communication module establishes at least one bidirectional communication channel in a request-response manner with the first communication module.
- the step c) specifically includes: c1), the second communication module generates at least one return request for the client application based on the first result data, and sends the at least one return request to the first communication module; wherein, the return request and the The second communication module receives each return request, and selects each second client application based on each return visit request; c3), each second client application separately processes the corresponding return request, Generating at least one return visit result and forwarding the result to the first communication module; wherein, the return visit result is in one-to-one correspondence with the return visit request; c4), the first communication module generates at least one return visit response based on each return visit result, and sends each return visit response back to the first a communication module, wherein the return visit response corresponds to the return visit result; c5), the second communication module parses each return visit response into each return visit result and forwards each return visit result to the first security application.
- the second client application is multiple, and the first security application returns to each second client application in parallel.
- the method for bidirectionally accessing the application between the dual execution environments enables the TEE application to return to the REE application during the process of processing the request from the REE application, so that the TEE application can perform complex processing on the access request from the REE application.
- Embodiments of the present invention can also effectively reduce the structural complexity of the trusted execution environment while ensuring system security, thereby reducing the possibility of generating system defects.
- embodiments of the present invention support a security application to revisit multiple client applications in parallel, and each return visit is performed through an independent two-way communication channel, which significantly improves system efficiency.
- FIG. 1 is a schematic diagram showing a data interaction process between a REE application and a TEE application in a trusted execution environment in a multimedia execution environment in the prior art.
- FIG. 2 is a schematic flowchart diagram of a method for bidirectionally accessing an application between dual execution environments according to a first embodiment of the present invention.
- FIG. 3 is a schematic diagram of a data interaction process in a method for bidirectionally accessing an application between dual execution environments according to the first embodiment of the present invention.
- the dual execution environment includes a trusted execution environment and a multimedia execution environment, Both run together in the same smart mobile device, for example, a smartphone.
- the multimedia execution environment is deployed with at least one client application and a first communication module
- the trusted execution environment is deployed with at least one security application and a second communication module
- each client application and security application respectively provide at least one service, a client application, and a security application.
- Communication is performed between the first communication module and the second communication module.
- any client application or security application can provide at least one service
- the “service” referred to herein is a function implemented by a client application or a security application, in other words, any client application or security application.
- At least one feature can be implemented.
- the first client application accessing the first security application is essentially at least one service provided for accessing the first security application.
- the "first client application” referred to herein is any client application in the multimedia execution environment, and the “first security application” is a security application in the trusted execution environment that the first client application needs to access.
- the first embodiment of the present invention provides a method for bidirectional access application between dual execution environments, which includes the following steps:
- Step S10 The first client application sends an access request to the first security application by using the first communication module.
- the first client application generates an access request 100 for the first security application
- the first communication module encapsulates the access request 100 according to a certain data format, for example, is encapsulated into a Request command 101, and then sent to the second communication module;
- the second communication module parses, obtains the access request 100, and forwards it to the first security application.
- Step S20 The first security application performs a first stage process on the access request to obtain the first result data 102 and forwards the result data to the second communication module.
- the first result data 102 specifies at least one second client application, which may or may not include the first client application.
- the second client application referred to herein is a client application in a multimedia execution environment that needs to be returned to the first security application.
- the first security application performs a phased processing on the access request 100 from the first client application, the basic data required for the first phase processing is obtained from the access request 100, and the basic data required for the second phase processing is required. Return to the second customer application to get it.
- the first stage of processing generates first result data 102,
- the first security application forwards the first result data 102 to the second communication module.
- a person skilled in the art may understand that there may be a case that after the first security process is performed on the access request, the first security application needs to access the second security application that is in the trusted execution environment to complete the subsequent processing.
- the second security application needs to return to at least one client application in the multimedia execution environment, so that the first result data can be generated by the second security application at this time. Such a situation is encompassed within the scope of the invention.
- Step S30 The second communication module establishes at least one bidirectional communication channel between the first communication module and the second communication module according to the first result data 102, so that the first security application returns to each second client through each bidirectional communication channel. application.
- the second communication module establishes at least one two-way communication channel between the second communication module and the first communication module in a request-response manner with the first communication module, and the two-way communication channel and the second client application are one by one.
- the first security application accesses each of the second client applications in parallel through separate independent two-way communication channels.
- step S30 specifically includes:
- Step S301 The second communication module generates at least one return visit request 200 to the client application based on the first result data 102, and sends the at least one return visit request 200 to the first communication module.
- the return visit request 200 has a one-to-one correspondence with the second client application.
- Step S302 The first communication module receives each return visit request 200, and selects each second client application based on each return visit request 200.
- Step S303 Each second client application separately processes the corresponding return request 200 to generate at least one return visit result 201 and forward it to the first communication module.
- Each second client application separately calls one or more services provided by itself, and performs independent processing on its corresponding return request from the secure application in the trusted execution environment, and separately generates a return visit result.
- the return visit result 201 is in one-to-one correspondence with the return visit request 200.
- Step S304 The first communication module generates at least one return visit response 202 based on each return visit result 201, and sends each return visit response 202 back to the second communication module.
- the return visit response 202 has a one-to-one correspondence with the return visit result 201.
- the first communication module will encapsulate each return visit result 201 to form a corresponding return visit response 202.
- the return visit request 200 and the return visit response 202 respectively access the first security application with the first client application. Find 100 to have different feature fields.
- the return visit response 202 can use the corresponding return visit result 201 as a feature field.
- the access request 100 can have the following feature fields:
- the return visit request 200 and the return visit response 202 may have the following feature fields, for example:
- the “TEE information” and “TEE/REE information” feature fields describe status information of the multimedia execution environment or the trusted execution environment;
- the “first security application information” and the feature field record the object targeted by the access request 100, “the first A security application/second client application information feature field records an object for which the return visit response/return request is directed;
- the "command” feature field may indicate which service provided by the first security application needs to be accessed by the first client application, or the first security application It is necessary to return to which service provided by the second client application;
- the "parameter” feature field may include information such as a background IP address, a port number, and a connection status with the background server;
- the "status information” feature field may use different default values to distinguish the return visit.
- Request 200 and return visit response 202 may be used to distinguish the return visit.
- Step S305 The second communication module parses each return visit response 202 into each return visit result 201 and forwards each return visit result 201 to the first security application.
- step S30 in the form of the return visit request 200 and the return visit response 202 (ie, the request-response mode), at least one two-way communication channel, the two-way communication channel and the return visit request may be established between the second communication module and the first communication module.
- the 200-one correspondence also has a one-to-one correspondence with the second client application.
- Each two-way communication channel is a dedicated channel for data interaction between the first security application and the second client application corresponding to the two-way communication channel.
- the two-way communication channels can be used in parallel, that is, the first security application can return to each of the second client applications in parallel, thereby significantly improving the working efficiency of the system.
- the second communication module obtains each return visit result 201.
- Step S40 The first security application performs a second-stage processing on the access request based on each returning result 201 obtained by returning to each second client application to generate final result data 103 corresponding to the access request 100.
- each returning result 201 obtained by the first security application returning to each second client application returns to the first security application through the corresponding two-way communication channel. Based on these return visit results 201, the first security application performs a second stage of processing on the access request 100 from the first client application to generate final result data 103 as a final response to the access request 100.
- the second-stage processing may not be able to generate the final result data corresponding to the access request, that is, the first security application needs to acquire some basic data from the client application in the multimedia execution environment to perform the third-stage processing. And even more processing to form a final response to the access request, so that after the second phase of processing, the first security application may still revisit the client application in the multimedia execution environment. Such a situation is encompassed within the scope of the invention.
- Step S50 The first security application returns final result data to the first client application.
- the first security application returns the final result data 103 to the first client application via the second communication module and the first communication module.
- the second communication module encapsulates the final result data, for example, encapsulated into a Response command 104, and the first communication module parses the package data (Response command 104) to obtain final result data 103.
- the first communication module may include a protocol processing module and a service management module, and the protocol processing module performs encapsulation and/or parsing of the access request, the return visit request, the return visit result, and the service management module registers the multimedia execution.
- Each client application in the environment establishes (or assists in establishing) a two-way communication channel and selects each second client application based on the first result data.
- the client application in the multimedia execution environment provides any one or more of an external device communication service, a secure carrier access service, a data storage service, and a resource operation service. among them:
- Communication with external devices provides the ability to connect to external devices, including the ability to connect to the Sockets required by the wifi, GPRS, etc., or the ability to access other terminals using devices such as Bluetooth or NFC.
- the Secure Carrier Access Service provides access to a variety of secure bearers on smart terminals, including SD cards, smart SD cards, SIM cards, eSE, and more.
- the data storage service provides the ability to store local data. It can provide temporary and permanent storage of data in the form of a file system or a specific implementation of read and write interfaces, and can provide secure storage of data protection as needed.
- the resource operation service provides a way to operate other resources of the smart device, such as accessing a camera, a GPS module, and the like.
- the method for bidirectionally accessing an application between the dual execution environments provided by the foregoing embodiment of the present invention enables the TEE application to return to the REE application during processing of the request from the REE application, so that the TEE application can perform complex processing on the access request from the REE application. Achieve more complete functionality.
- the structural complexity of the trusted execution environment can be effectively reduced while ensuring system security, thereby reducing the possibility of generating system defects.
- the present invention supports a certain security application to access multiple client applications in parallel by using a plurality of mutually independent two-way communication channels, which significantly improves system efficiency.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
- Computer And Data Communications (AREA)
Abstract
本发明涉及一种双执行环境之间双向访问应用的方法，包括：第一客户应用通过第一通信模块发出对第一安全应用的访问请求；第一安全应用对访问请求进行第一阶段处理，以得到第一结果数据并转送到第二通信模块；第二通信模块根据第一结果数据，在第一通信模块和第二通信模块之间建立至少一双向通信信道，以使第一安全应用分别通过各双向通信信道回访各第二客户应用；第一安全应用基于回访各第二客户应用所得的各回访结果，对访问请求进行第二阶段处理，以生成对应于访问请求的最终结果数据；第一安全应用向第一客户应用返回最终结果数据。其使TEE应用在处理来自REE应用的请求过程中可以并行地回访多个REE应用。
Description
本发明涉及智能移动设备技术领域，更具体地说，涉及一种双执行环境之间双向访问应用的方法。
随着智能移动设备(如智能手机)逐步“支付工具”化，其现有的智能操作系统已无法满足支付应用对其所处的运行环境的安全性要求。由于系统资源所限，若提高智能操作系统的安全性，几乎肯定会使功能及用户体验有所降低。针对于此，当前业界基于最新移动芯片的技术发展，提出了双执行环境方案：即一个设备上同时运行有两个执行环境，其中一个是注重功能、用户体验的多媒体执行环境，另一个是注重安全的可信执行环境。
当前，GlobalPlatform所提出的可信执行环境(Trusted execution environment，简称TEE)作为该方案的一个技术实现平台，得到了广泛应用。在该平台上，满足某项业务需求的功能实现由原先的单一应用分为两种应用：一种作为客户应用部署在多媒体执行环境中，也称为REE(Rich execution environment)应用，另一种作为安全应用部署在可信执行环境中，也称为TEE应用。为实现系统的安全功能，多媒体执行环境中的REE应用需要访问可信执行环境中的TEE应用，即，访问TEE应用所提供的服务，相应的服务结果再由TEE应用返回给多媒体执行环境中的REE应用。
如图1所示，REE应用和TEE应用之间采用以下机制进行通信：REE通信模块和TEE通信模块分别运行在多媒体执行环境和可信执行环境下，采用一种请求-应答方式来实现REE应用和TEE应用之间的数据交互。具体地，REE应用请求访问TEE应用时，首先将访问请求转送至REE通信模块，REE通信模块通过双系统之间的切换机制切换到安全操作系统下，再以Request命令的形式将请求发送至TEE通信模块，TEE通信模块获取到请求后，确定该请求要具体发往的TEE应用并将请求数据转送到该TEE应用，该TEE应用收到请求之后，进行处理以产生结果数据，再调用TEE通信模块的Response命令，将结果数据返回给
REE应用。上述方案中，在Response命令没有返回REE应用前，不能发起新的Request命令。
这种方案存在如下问题：当TEE应用需要对REE应用的访问请求进行较为复杂的处理时，由于前一对Request-Response命令之间无法插入新的Request命令，TEE应用无法再从多媒体执行环境中的REE应用获取进行复杂处理所需的有关基础数据，从而要求可信执行环境自身具备更多、更强的能力来支撑这种复杂处理。比如：在TEE应用需要后台的参与、或需要访问智能存储卡等来进行复杂处理时，TEE应用就相应地需要可信执行环境能够联网、或设有智能存储卡访问接口等，这无疑会使可信执行环境结构变大、变复杂，从而使安全操作系统可验证性的难度增加，也会产生更多的系统缺陷，进而会降低系统的安全性。
因此，本领域技术人员期望获得一种使TEE应用在处理来自REE应用的请求过程中可以回访REE应用的方法。
发明内容
本发明的目的在于提供一种双执行环境之间双向访问应用的方法，以便于安全应用对客户应用的访问请求进行分阶段的复杂处理。
为实现上述目的，本发明提供一种技术方案如下：
一种双执行环境之间双向访问应用的方法，其中，双执行环境包括可信执行环境与多媒体执行环境，多媒体执行环境部署有至少一个客户应用和第一通信模块，可信执行环境部署有至少一个安全应用和第二通信模块，客户应用和安全应用之间通过第一通信模块和第二通信模块进行数据交互，该方法包括如下步骤：a)、第一客户应用通过第一通信模块发出对第一安全应用的访问请求；其中，第一客户应用为任一客户应用，第一安全应用为第一客户应用需要访问的安全应用；b)、第一安全应用对访问请求进行第一阶段处理，以得到第一结果数据并转送到第二通信模块；其中，第一结果数据指定至少一第二客户应用，第二客户应用为第一安全应用需要回访的客户应用；c)、第二通信模块根据第一结果数据，在第一通信模块和第二通信模块之间建立至少一双向通信信道，以使第一安全应用分别通过各双向通信信道回访各第二客户应用；其中，双向通信信道与第二客户应用一一对应；d)、第一安全应用基于回访各第二客户应用所得的各回访结果，对访问请求进行第二阶段处理，以生成对应于访问请求的最终结果数据；e)、
第一安全应用向第一客户应用返回最终结果数据。
优选地，步骤c)中，第二通信模块以与第一通信模块之间的请求-响应方式建立至少一双向通信信道。
优选地，步骤c)具体包括：c1)、第二通信模块基于第一结果数据生成对客户应用的至少一回访请求，并将至少一回访请求发送至第一通信模块；其中，回访请求与第二客户应用一一对应；c2)、第一通信模块接收各回访请求，并基于各回访请求分别选择各第二客户应用；c3)、各第二客户应用分别对相应的回访请求进行处理，以生成至少一回访结果并转送给第一通信模块；其中，回访结果与回访请求一一对应；c4)、第一通信模块基于各回访结果分别生成至少一回访响应，并将各回访响应发送回第二通信模块；其中，回访响应与回访结果一一对应；c5)、第二通信模块将各回访响应分别解析为各回访结果并将各回访结果转送至第一安全应用。
优选地，第二客户应用为多个，第一安全应用并行地回访各第二客户应用。
本发明各实施例所提供的双执行环境之间双向访问应用的方法，使得TEE应用在处理来自REE应用的请求过程中可以回访REE应用，从而TEE应用能够对来自REE应用的访问请求进行复杂处理以实现更完备的功能。本发明各实施例还可在保证系统安全性的同时有效降低可信执行环境的结构复杂度，从而降低了产生系统缺陷的可能性。此外，本发明各实施例支持某一安全应用并行地回访多个客户应用，且每一回访是通过独立的双向通信信道来进行的，这显著提高了系统工作效率。
图1示出现有技术中多媒体执行环境中REE应用与可信执行环境中TEE应用之间数据交互过程的示意图。
图2示出本发明第一实施例提供的双执行环境之间双向访问应用的方法的流程示意图。
图3示出本发明第一实施例提供的双执行环境之间双向访问应用的方法中的数据交互过程示意图。
在本文所提供实施例中，双执行环境包括可信执行环境与多媒体执行环境，
两者共同运行于同一智能移动装置中，例如，智能手机。多媒体执行环境部署有至少一个客户应用和第一通信模块，可信执行环境部署有至少一个安全应用和第二通信模块，各客户应用和安全应用分别提供至少一种服务，客户应用和安全应用之间通过第一通信模块和第二通信模块进行通信。需要说明的是，本文所指“回访”表示在多媒体执行环境中的第一客户应用向可信执行环境中的第一安全应用发出访问请求时，为使第一安全应用获取多媒体执行环境中的某些服务资源以实现对该访问请求的响应，而逆向访问多媒体执行环境中的任一个或任多个客户应用，而非仅访问第一客户应用。
在本文所提供的实施例中，任一客户应用或安全应用均可提供至少一项服务，本文所指“服务”为客户应用或安全应用所实现的功能，换言之，任一客户应用或安全应用均可实现至少一项功能。第一客户应用访问第一安全应用本质上即为访问第一安全应用所提供的至少一项服务。
本文所指“第一客户应用”为多媒体执行环境中任一客户应用，而“第一安全应用”为第一客户应用需要访问的、可信执行环境中的安全应用。
如图2和图3所示，本发明第一实施例提供一种双执行环境之间双向访问应用的方法，其包括如下步骤：
步骤S10、第一客户应用通过第一通信模块发出对第一安全应用的访问请求；
具体地，第一客户应用产生对第一安全应用的访问请求100，第一通信模块会按照一定的数据格式对访问请求100进行封装，例如封装为Request命令101，随后发送给第二通信模块；第二通信模块收到封装数据(Request命令101)后进行解析，获得访问请求100并转送到第一安全应用。
步骤S20、第一安全应用对访问请求进行第一阶段处理，以得到第一结果数据102并转送到第二通信模块。
其中，第一结果数据102指定至少一个第二客户应用，该至少一个第二客户应用可能包括第一客户应用，也可能不包括。本文所指第二客户应用为第一安全应用需要回访的、多媒体执行环境中的客户应用。
第一安全应用对来自第一客户应用的访问请求100进行分阶段处理，第一阶段处理所需的基础数据从该访问请求100中即可获得，而第二阶段处理所需的基础数据则需要回访第二客户应用来获得。第一阶段处理生成第一结果数据102，
第一安全应用将该第一结果数据102转送到第二通信模块。
本领域技术人员可以理解，可能存在如下情况：第一安全应用在对访问请求进行第一阶段处理后，得知需要访问同处于可信执行环境中的第二安全应用来完成后续处理，而第二安全应用需要回访多媒体执行环境中的至少一个客户应用，从而此时第一结果数据可由第二安全应用来生成。这种情况涵盖于本发明的范围内。
步骤S30、第二通信模块根据第一结果数据102，在第一通信模块和第二通信模块之间建立至少一双向通信信道，以使第一安全应用分别通过各双向通信信道回访各第二客户应用。
该步骤中，第二通信模块以与第一通信模块之间的请求-响应方式在第二通信模块与第一通信模块之间建立至少一双向通信信道，双向通信信道与第二客户应用一一对应，以便第一安全应用分别通过独立的双向通信信道来并行地回访各第二客户应用。
优选情况下，步骤S30具体包括：
步骤S301、第二通信模块基于第一结果数据102生成对客户应用的至少一回访请求200，并将该至少一回访请求200发送至第一通信模块。
其中，回访请求200与第二客户应用一一对应。
步骤S302、第一通信模块接收各回访请求200，并基于各回访请求200分别选择各第二客户应用。
步骤S303、各第二客户应用分别对相应的回访请求200进行处理，以生成至少一回访结果201并转送给第一通信模块。
每个第二客户应用分别调用其自身提供的一个或多个服务，对与其相应的、来自可信执行环境中安全应用的回访请求进行独立的处理，并分别生成回访结果。其中，回访结果201与回访请求200一一对应。
步骤S304、第一通信模块基于各回访结果201分别生成至少一回访响应202，并将各回访响应202发送回第二通信模块。
其中，回访响应202与回访结果201一一对应。第一通信模块将对各回访结果201进行封装以形成相应的回访响应202。
回访请求200、回访响应202分别与第一客户应用对第一安全应用的访问请
求100具有不同的特征字段。其中，回访响应202可将对应的回访结果201用作为一特征字段。
例如，访问请求100可具有如下特征字段：
回访请求200、回访响应202可具有如下特征字段，例如：
其中，例如，“TEE信息”、“TEE/REE信息”特征字段记载多媒体执行环境或可信执行环境的状态信息；“第一安全应用信息”、特征字段记载访问请求100针对的对象，“第一安全应用/第二客户应用信息”特征字段记载回访响应/回访请求针对的对象；“命令”特征字段可指示第一客户应用需要访问第一安全应用提供的哪一个服务，或第一安全应用需要回访第二客户应用提供的哪一个服务；“参数”特征字段可包括后台IP地址、端口号、与后台服务器的连接状态等信息；“状态信息”特征字段可使用不同的默认值来区分回访请求200与回访响应202。
步骤S305、第二通信模块将各回访响应202分别解析为各回访结果201并将各回访结果201转送至第一安全应用。
通过步骤S30，以回访请求200与回访响应202的形式(即，请求-响应方式)，可在第二通信模块与第一通信模块之间建立起至少一条双向通信信道，双向通信信道与回访请求200一一对应，同样也与第二客户应用一一对应。每一双向通信信道都为专用的信道，仅供第一安全应用与对应于该双向通信信道的第二客户应用进行数据交互。在第一安全应用需要回访多个第二客户应用的情况下，各双向通信信道可并行地使用，即，第一安全应用可并行地回访各第二客户应用，从而显著提高系统的工作效率。
步骤S30结束后，第二通信模块获得了各回访结果201。
步骤S40、第一安全应用基于回访各第二客户应用所得的各回访结果201，对访问请求进行第二阶段处理，以生成对应于访问请求100的最终结果数据103。
具体地，第一安全应用回访各第二客户应用所得的各回访结果201分别通过对应的双向通信信道返回第一安全应用。第一安全应用基于这些回访结果201，对来自第一客户应用的访问请求100进行第二阶段处理，以便生成最终结果数据103，作为对该访问请求100的最终响应。
本领域技术人员理解，第二阶段处理有可能还不能生成对应于访问请求的最终结果数据，即，第一安全应用需要从多媒体执行环境中的客户应用再获取一些基础数据来进行第三阶段处理、甚至更多次的处理，以形成对该访问请求的最终响应，从而在第二阶段处理之后，第一安全应用仍可能会对多媒体执行环境中的客户应用进行再次回访。这种情况涵盖于本发明的范围内。
步骤S50、第一安全应用向第一客户应用返回最终结果数据。
具体地，该步骤中，第一安全应用依次经由第二通信模块、第一通信模块向第一客户应用返回最终结果数据103。其中，第二通信模块对最终结果数据进行封装，例如封装为Response命令104，第一通信模块对封装数据(Response命令104)进行解析而获得最终结果数据103。
根据上述实施例的优选实施方式，第一通信模块可包括协议处理模块和服务管理模块，协议处理模块执行对访问请求、回访请求、回访结果的封装和/或解析，而服务管理模块注册多媒体执行环境中各客户应用、建立(或协助建立)双向通信信道、以及根据第一结果数据选择各第二客户应用。
进一步地，多媒体执行环境中的客户应用提供与外部设备通信服务、安全载体访问服务、数据存储服务以及资源操作服务中的任一个或任多个。其中：
与外部设备通信服务提供连接外部设备的能力，包括使用wifi、GPRS等连接后台所需要的Socket能力或者使用蓝牙、NFC等设备来访问其他终端的能力。
安全载体访问服务提供访问智能终端上各种安全载体的能力，包括SD卡、智能SD卡、SIM卡、eSE等。
数据存储服务提供本地数据存储的能力，可以文件系统、特定实现的读写接口等方式提供对数据的临时性和永久性存储，并可根据需要提供数据保护的安全性存储。
资源操作服务提供操作智能设备其他资源的方式，如访问摄像头、GPS模块等。
本发明上述实施例提供的双执行环境之间双向访问应用的方法，使得TEE应用在处理来自REE应用的请求过程中可以回访REE应用，从而TEE应用能够对来自REE应用的访问请求进行复杂处理以实现更完备的功能。
基于本发明的实施例，可在保证系统安全性的同时有效降低可信执行环境的结构复杂度，从而降低了产生系统缺陷的可能性。
此外，在某一安全应用需要回访多个客户应用的情况下，后续回访不必等前次回访结束才开始，而是可并行地进行多个回访过程。因而，本发明通过使用多个相互独立的双向通信信道来支持某一安全应用并行地回访多个客户应用，这显著提高了系统工作效率。
上述说明仅针对于本发明的优选实施例，并不在于限制本发明的保护范围。基于本发明的思想，本领域技术人员可作出各种变形设计，而不脱离本发明的思想及附随的权利要求。
Claims (10)
- 一种双执行环境之间双向访问应用的方法，其中，所述双执行环境包括可信执行环境与多媒体执行环境，所述多媒体执行环境部署有至少一个客户应用和第一通信模块，所述可信执行环境部署有至少一个安全应用和第二通信模块，所述客户应用和安全应用之间通过所述第一通信模块和第二通信模块进行数据交互，所述方法包括如下步骤：a)、第一客户应用通过所述第一通信模块发出对第一安全应用的访问请求；其中，所述第一客户应用为任一所述客户应用，所述第一安全应用为所述第一客户应用需要访问的所述安全应用；b)、所述第一安全应用对所述访问请求进行第一阶段处理，以得到第一结果数据并转送到所述第二通信模块；其中，所述第一结果数据指定至少一第二客户应用，所述第二客户应用为所述第一安全应用需要回访的所述客户应用；c)、所述第二通信模块根据所述第一结果数据，在所述第一通信模块和所述第二通信模块之间建立至少一双向通信信道，以使所述第一安全应用分别通过各所述双向通信信道回访各所述第二客户应用；其中，所述双向通信信道与所述第二客户应用一一对应；d)、所述第一安全应用基于回访各所述第二客户应用所得的各回访结果，对所述访问请求进行第二阶段处理，以生成对应于所述访问请求的最终结果数据；e)、所述第一安全应用向所述第一客户应用返回所述最终结果数据。
- 根据权利要求1所述的方法，其特征在于，所述步骤c)中，所述第二通信模块以与所述第一通信模块之间的请求-响应方式建立所述至少一双向通信信道。
- 根据权利要求2所述的方法，其特征在于，所述步骤c)具体包括：c1)、所述第二通信模块基于所述第一结果数据生成对所述客户应用的至少一回访请求，并将所述至少一回访请求发送至所述第一通信模块；其中，所述回访请求与所述第二客户应用一一对应；c2)、所述第一通信模块接收各所述回访请求，并基于各所述回访请求分别选择各所述第二客户应用；c3)、各所述第二客户应用分别对相应的所述回访请求进行处理，以生成至少一所述回访结果并转送给所述第一通信模块；其中，所述回访结果与所述回访请求一一对应；c4)、所述第一通信模块基于各所述回访结果分别生成至少一回访响应，并将各所述回访响应发送回所述第二通信模块；其中，所述回访响应与所述回访结果一一对应；c5)、所述第二通信模块将各所述回访响应分别解析为各所述回访结果并将各所述回访结果转送至所述第一安全应用。
- 根据权利要求3所述的方法，其特征在于，所述第一通信模块包括协议处理模块和服务管理模块，所述协议处理模块执行对所述访问请求、所述回访请求、所述回访结果的封装和/或解析，所述服务管理模块注册各所述客户应用、建立所述双向通信信道、以及根据所述第一结果数据选择各所述第二客户应用。
- 根据权利要求3所述的方法，其特征在于，所述回访请求、所述回访响应与所述访问请求具有不同的特征字段。
- 根据权利要求3所述的方法，其特征在于，所述回访响应将对应的所述回访结果作为一特征字段。
- 根据权利要求1所述的方法，其特征在于，所述第二客户应用为多个，所述第一安全应用并行地回访各所述第二客户应用。
- 根据权利要求1所述的方法，其特征在于，所述客户应用提供与外部设备通信服务、安全载体访问服务、数据存储服务以及资源操作服务中的任一个或任多个。
- 根据权利要求1至8中任一项所述的方法，其特征在于，所述可信执行环境与多媒体执行环境共同运行于同一智能移动装置中。
- 根据权利要求9所述的方法，其特征在于，所述智能移动装置为智能手机。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410613548.3A CN105592019B (zh) | 2014-11-05 | 2014-11-05 | 双执行环境之间双向访问应用的方法 |
| CN201410613548.3 | 2014-11-05 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2016070810A1 true WO2016070810A1 (zh) | 2016-05-12 |
Family
ID=55908597
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2015/093770 WO2016070810A1 (zh) | 2014-11-05 | 2015-11-04 | 双执行环境之间双向访问应用的方法 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN105592019B (zh) |
| WO (1) | WO2016070810A1 (zh) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106547633B (zh) * | 2016-10-19 | 2019-12-31 | 沈阳微可信科技有限公司 | 多通道通信系统和电子设备 |
| CN108282764A (zh) * | 2017-01-03 | 2018-07-13 | 中国移动通信有限公司研究院 | 一种信息交互方法及终端设备 |
| US10528749B2 (en) * | 2017-03-20 | 2020-01-07 | Huawei Technologies Co., Ltd. | Methods and apparatus for containerized secure computing resources |
| CN111357255B (zh) * | 2018-04-27 | 2021-11-19 | 华为技术有限公司 | 构建多个应用通用的可信应用 |
| EP4290373A3 (en) | 2018-08-14 | 2023-12-20 | Huawei Technologies Co., Ltd. | Artificial intelligence (ai) processing method and ai processing device |
| CN110011956B (zh) | 2018-12-12 | 2020-07-31 | 阿里巴巴集团控股有限公司 | 一种数据处理方法和装置 |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120331550A1 (en) * | 2011-06-24 | 2012-12-27 | Microsoft Corporation | Trusted language runtime on a mobile platform |
| CN103745155A (zh) * | 2014-01-03 | 2014-04-23 | 东信和平科技股份有限公司 | 一种可信Key及其安全操作方法 |
| US20140317686A1 (en) * | 2013-04-22 | 2014-10-23 | Oracle International Corporation | System with a trusted execution environment component executed on a secure element |
| CN104125226A (zh) * | 2014-07-28 | 2014-10-29 | 北京握奇智能科技有限公司 | 一种锁定和解锁应用的方法、装置及系统 |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104077533B (zh) * | 2014-07-17 | 2017-09-15 | 北京握奇智能科技有限公司 | 一种操作敏感数据的方法和设备 |
-
2014
- 2014-11-05 CN CN201410613548.3A patent/CN105592019B/zh active Active
-
2015
- 2015-11-04 WO PCT/CN2015/093770 patent/WO2016070810A1/zh active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120331550A1 (en) * | 2011-06-24 | 2012-12-27 | Microsoft Corporation | Trusted language runtime on a mobile platform |
| US20140317686A1 (en) * | 2013-04-22 | 2014-10-23 | Oracle International Corporation | System with a trusted execution environment component executed on a secure element |
| CN103745155A (zh) * | 2014-01-03 | 2014-04-23 | 东信和平科技股份有限公司 | 一种可信Key及其安全操作方法 |
| CN104125226A (zh) * | 2014-07-28 | 2014-10-29 | 北京握奇智能科技有限公司 | 一种锁定和解锁应用的方法、装置及系统 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105592019B (zh) | 2018-12-25 |
| CN105592019A (zh) | 2016-05-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2016070810A1 (zh) | 双执行环境之间双向访问应用的方法 | |
| WO2022206229A1 (zh) | 数据处理方法、装置、设备和存储介质 | |
| US11039299B2 (en) | ESIM card activation method, wireless router, and user terminal | |
| WO2017113970A1 (zh) | 近场通信方法及移动终端 | |
| US20160205152A1 (en) | Remote calling method and apparatus | |
| WO2016101288A1 (zh) | 一种远程直接数据存取方法、设备和系统 | |
| US20160350148A1 (en) | Thin client system, server device, policy management device, control method, and non-transitory computer readable recording medium | |
| EP2770689A1 (en) | Authentication method, transfer apparatus, and authentication server | |
| WO2017162043A1 (zh) | 用于设备间服务的访问方法、配置方法及装置 | |
| US10499311B2 (en) | Method and apparatus for implementing network sharing | |
| WO2017101186A1 (zh) | 用于为用户设备的应用建立无线连接的方法 | |
| WO2015100990A1 (zh) | 一种终端间的图像共享方法、终端设备及通信系统 | |
| WO2020258782A1 (zh) | 适用蓝牙读卡器的数据传输方法及电子设备 | |
| KR101952053B1 (ko) | Soa(service-oriented architecture)에 기초하는 스케일러블 과금 시스템 | |
| CN108833500B (zh) | 服务调用方法、服务提供方法、数据传递方法和服务器 | |
| WO2015027931A1 (en) | Method and system for realizing cross-domain remote command | |
| CN111163102B (zh) | 数据处理方法及装置、网络设备、可读存储介质 | |
| US9438638B2 (en) | Method for transparently connecting augmented network socket operations | |
| CN111600833B (zh) | 网络操作系统及报文转发方法 | |
| CN108289165B (zh) | 一种基于手机控制相机的实现方法、装置及终端设备 | |
| CN116389323A (zh) | 吞吐量测试方法、设备及存储介质 | |
| US20160110235A1 (en) | Electronic device for Internet Protocol Communications | |
| CN114244758B (zh) | 安卓平台的网络诊断方法、存储介质、电子设备及系统 | |
| CN112383617B (zh) | 进行长连接的方法、装置、终端设备以及介质 | |
| WO2022027528A1 (zh) | 应用程序接口调用方法及其装置、系统 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 15857227 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 32PN | Ep: public notification in the ep bulletin as address of the adressee cannot be established |
Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 29/08/2017) |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 15857227 Country of ref document: EP Kind code of ref document: A1 |