WO2017201805A1 - 业务执行方法、业务执行装置和终端 - Google Patents

业务执行方法、业务执行装置和终端 Download PDF

Info

Publication number
WO2017201805A1
WO2017201805A1 PCT/CN2016/087532 CN2016087532W WO2017201805A1 WO 2017201805 A1 WO2017201805 A1 WO 2017201805A1 CN 2016087532 W CN2016087532 W CN 2016087532W WO 2017201805 A1 WO2017201805 A1 WO 2017201805A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
operating system
target service
attribute information
target
Prior art date
Application number
PCT/CN2016/087532
Other languages
English (en)
French (fr)
Inventor
邓海丰
左文豪
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2017201805A1 publication Critical patent/WO2017201805A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/06—Terminal devices adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Definitions

  • the present invention relates to the field of terminal technologies, and in particular, to a service execution method, a service execution apparatus, and a terminal.
  • an embedded user identity module (hereinafter referred to as an embed-subscriber Identity Module) is to embed a traditional SIM (Subscriber Identity Module) card directly into a terminal device instead of being independent and movable.
  • SIM Subscriber Identity Module
  • the application of the eSIM card can provide more business choices and package services for the end user.
  • the present invention is based on at least one of the above technical problems, and proposes a new service execution solution, which determines an eSIM card corresponding to a target service and an operating system corresponding to the eSIM card when acquiring a request instruction for executing a target service ( User domain), therefore, based on the access rights of the eSIM card and the operating system, the target service is switched to the corresponding operating system for execution, thereby truly improving the security of the target service and the data security of the user, thereby improving the user's use.
  • a new service execution solution which determines an eSIM card corresponding to a target service and an operating system corresponding to the eSIM card when acquiring a request instruction for executing a target service ( User domain), therefore, based on the access rights of the eSIM card and the operating system, the target service is switched to the corresponding operating system for execution, thereby truly improving the security of the target service and the data security of the user, thereby improving the user's use.
  • a service execution method including: obtaining a request instruction for executing a target service during a running process of the first operating system; and determining whether the target service is based on a specified embedded user identity Identifying the service protocol execution of the module; when determining that the target service is executed based on the service protocol of the specified embedded user identity module, The corresponding relationship between the embedded user identity module and the second operating system is performed by switching the target service from the first operating system to the second operating system.
  • the eSIM card corresponding to the target service and the operating system (user domain) corresponding to the eSIM card are determined when acquiring the request instruction for executing the target service, and therefore, based on the access rights of the eSIM card and the operating system, Switching the target service to the corresponding operating system for execution, thereby truly improving the security of the target service and the data security of the user, and improving the user experience.
  • the target service has a corresponding relationship with the operating system, and the operating system has different data access rights, that is, the data access authority of the target service is restricted by the switching of the operating system, thereby improving the data security of the terminal.
  • the user is prompted to enter the authentication information, for example, the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal, when the authentication information is matched with the preset authentication information, the operating system is switched, and based on the second operation after the switching The system performs the target business.
  • the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal
  • the obtaining the request instruction for executing the target service includes the following steps: determining the attribute information of any service when acquiring the request instruction for any service; determining whether the attribute information is pre-determined The attribute information is matched; when the determination attribute information matches the preset attribute information, the service corresponding to the attribute information is determined to be the target service.
  • the attribute information of the service is determined, thereby determining whether to trigger the switching of the operating system, thereby saving the power consumption of the terminal and improving the data security of the terminal, wherein
  • the attribute information includes the security level of the service, the access rights of the business, and the application to which the service belongs.
  • the method before the obtaining the request instruction for executing the target service, the method further includes: presetting a correspondence between the specified embedded user identity module and the target service.
  • the corresponding embedded user identity recognition module can be quickly determined when the target service is invoked, and then the corresponding operating system is determined.
  • the service corresponding to the request instruction is a non-target service
  • no switching of the operating system is required, and in the non-target service execution process, the terminal Private data for all operating systems is not visible to non-target businesses.
  • the method further includes: determining whether the target service executed in the second operating system is ended; and determining whether the user is to run the environment from the first when determining that the target service executed in the second operating system ends The second operating system switches to the first operating system.
  • the security of the terminal data is further improved by prompting the user whether to perform an operating system handover after the target service ends.
  • the target service includes at least one of a voice service, a short message service, and a multimedia communication service.
  • a service execution apparatus comprising: an obtaining unit, configured to acquire a request instruction for executing a target service during a running process of the first operating system; and a determining unit, configured to determine whether the target service is Performing a service protocol based on the specified embedded user identity module; the switching unit, configured to identify the module according to the specified embedded user identity and the second when determining that the target service is executed based on the service protocol of the specified embedded user identity module
  • the correspondence between the operating systems is performed by switching the target service from the first operating system to the second operating system.
  • the eSIM card corresponding to the target service and the operating system (user domain) corresponding to the eSIM card are determined when acquiring the request instruction for executing the target service, and therefore, based on the access rights of the eSIM card and the operating system, Switching the target service to the corresponding operating system for execution, thereby truly improving the security of the target service and the data security of the user, and improving the user experience.
  • the target service has a corresponding relationship with the operating system, and the operating system has different data access rights, that is, the data access authority of the target service is restricted by the switching of the operating system, thereby improving the data security of the terminal.
  • the user is prompted to enter the authentication information, for example, the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal, when the authentication information is matched with the preset authentication information, the operating system is switched, and based on the second operation after the switching The system performs the target business.
  • the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal
  • the method further includes: a determining unit, configured to determine attribute information of any service when acquiring a request instruction for any service;
  • the determining unit is further configured to: determine, when the determining attribute information matches the preset attribute information, the service corresponding to the attribute information is the target service.
  • the attribute information of the service is determined, thereby determining whether to trigger the switching of the operating system, thereby saving the power consumption of the terminal and improving the data security of the terminal, wherein
  • the attribute information includes the security level of the service, the access rights of the business, and the application to which the service belongs.
  • the method further includes: a preset unit, configured to preset a correspondence between the specified embedded user identity module and the target service.
  • the corresponding embedded user identity recognition module can be quickly determined when the target service is invoked, and then the corresponding operating system is determined.
  • the service corresponding to the request instruction is a non-target service
  • the switching of the operating system is not required, and in the non-target service execution process, the private data of all operating systems of the terminal is invisible to the non-target service.
  • the determining unit is further configured to: determine whether the target service executed in the second operating system is ended; the service executing device further includes: a prompting unit, configured to execute in the determining the second operating system At the end of the target business, the user is prompted to switch the operating environment from the second operating system to the first operating system.
  • the security of the terminal data is further improved by prompting the user whether to perform an operating system handover after the target service ends.
  • the target service includes at least one of a voice service, a short message service, and a multimedia communication service.
  • a terminal comprising the service execution apparatus according to any one of the preceding claims, wherein the terminal has the same technical effect as the service execution apparatus of any one of the above technical solutions, No longer.
  • the eSIM card corresponding to the target service and the operating system (user domain) corresponding to the eSIM card are determined, and therefore, based on the access rights of the eSIM card and the operating system, The target service is switched to the corresponding operating system for execution, thereby truly improving the security of the target service and the data security of the user, thereby improving the user experience.
  • FIG. 1 shows a schematic flow chart of a service execution method according to an embodiment of the present invention
  • Figure 2 shows a schematic block diagram of a service execution apparatus in accordance with one embodiment of the present invention
  • Figure 3 shows a schematic block diagram of a terminal in accordance with an embodiment of the present invention
  • FIG. 4 shows a schematic block diagram of a service execution apparatus according to another embodiment of the present invention.
  • FIG. 5 shows a schematic flow chart of a method of performing a service according to another embodiment of the present invention.
  • FIG. 1 shows a schematic flow chart of a method of performing a service according to an embodiment of the present invention.
  • a service execution method includes: Step 102: Acquire a request instruction for executing a target service during a running process of the first operating system; Step 104, determine whether the target service is based on the specified The service protocol execution of the embedded user identity module is performed; step 106, when determining that the target service is executed based on the service protocol of the specified embedded user identity module, according to the correspondence between the specified embedded user identity module and the second operating system The target service is switched from the first operating system to the second operating system.
  • the eSIM card corresponding to the target service and the operating system (user domain) corresponding to the eSIM card are determined when acquiring the request instruction for executing the target service, and therefore, based on the access rights of the eSIM card and the operating system, Switching the target service to the corresponding operating system for execution, thereby truly improving the security of the target service and the data security of the user, and improving the user experience.
  • the target service has a corresponding relationship with the operating system, and the operating system has different data access rights, that is, the data access authority of the target service is restricted by the switching of the operating system, thereby improving the data security of the terminal.
  • the user is prompted to enter the authentication information, for example, the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal, when the authentication information is matched with the preset authentication information, the operating system is switched, and based on the second operation after the switching The system performs the target business.
  • the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal
  • the obtaining the request instruction for executing the target service includes the following steps: determining the attribute information of any service when acquiring the request instruction for any service; determining whether the attribute information is pre-determined The attribute information is matched; when the determination attribute information matches the preset attribute information, the service corresponding to the attribute information is determined to be the target service.
  • the attribute information of the service is determined, thereby determining whether to trigger the switching of the operating system, thereby saving the power consumption of the terminal and improving the data security of the terminal, wherein
  • the attribute information includes the security level of the service, the access rights of the business, and the application to which the service belongs.
  • the method before the obtaining the request instruction for executing the target service, the method further includes: presetting a correspondence between the specified embedded user identity module and the target service.
  • the corresponding embedded user identity recognition module can be quickly determined when the target service is invoked, and then the corresponding operating system is determined.
  • the service corresponding to the request instruction is a non-target service
  • the switching of the operating system is not required, and in the non-target service execution process, the private data of all operating systems of the terminal is invisible to the non-target service.
  • the method further includes: determining whether the target service executed in the second operating system is ended; and determining whether the user is to run the environment from the first when determining that the target service executed in the second operating system ends The second operating system switches to the first operating system.
  • the security of the terminal data is further improved by prompting the user whether to perform an operating system handover after the target service ends.
  • the target service includes at least one of a voice service, a short message service, and a multimedia communication service.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • FIG. 2 shows a schematic block diagram of a service execution apparatus in accordance with one embodiment of the present invention.
  • the service execution apparatus 200 includes: an obtaining unit 202, configured to acquire a request instruction for executing a target service during a running process of the first operating system; and a determining unit 204, configured to: Determining whether the target service is executed based on a service protocol of the specified embedded user identity module; the switching unit 206 is configured to determine, according to the specified embedded user identity, that the target service is executed based on the service protocol of the specified embedded user identity module Identifying a correspondence between the module and the second operating system, and performing the target service switching from the first operating system to the second operating system.
  • the eSIM card corresponding to the target service and the operating system (user domain) corresponding to the eSIM card are determined when acquiring the request instruction for executing the target service, and therefore, based on the access rights of the eSIM card and the operating system, Switching the target service to the corresponding operating system for execution, thereby truly improving the security of the target service and the data security of the user, and improving the user experience.
  • the target service has a corresponding relationship with the operating system, and the operating system has different data access rights, that is, the data access authority of the target service is restricted by the switching of the operating system, thereby improving the data security of the terminal.
  • the user is prompted to enter the authentication information, for example, the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal, when the authentication information is matched with the preset authentication information, the operating system is switched, and based on the second operation after the switching The system performs the target business.
  • the authentication information is the fingerprint feature of the user, the iris feature, The ear pattern and the voiceprint feature, or the character information input by the user, or the posture change information of the terminal
  • the method further includes: a determining unit 208, configured to determine attribute information of any service when acquiring a request instruction for any service; the determining unit 204 is further configured to: determine the attribute information Whether it is matched with the preset attribute information; the determining unit 208 is further configured to: when the determining attribute information matches the preset attribute information, determine that the service corresponding to the attribute information is the target service.
  • the attribute information of the service is determined, thereby determining whether to trigger the switching of the operating system, thereby saving the power consumption of the terminal and improving the data security of the terminal, wherein Attribute information includes the security level of the business and the visit of the business. Ask for permissions and applications to which the business belongs.
  • the method further includes: a preset unit 210, configured to preset a correspondence between the specified embedded user identity module and the target service.
  • the corresponding embedded user identity recognition module can be quickly determined when the target service is invoked, and then the corresponding operating system is determined.
  • the service corresponding to the request instruction is a non-target service
  • the switching of the operating system is not required, and in the non-target service execution process, the private data of all operating systems of the terminal is invisible to the non-target service.
  • the determining unit 204 is further configured to: determine whether the target service executed in the second operating system is ended; the service executing device 200 further includes: a prompting unit 212, configured to determine the second operation When the target service executed in the system ends, the user is prompted to switch the operating environment from the second operating system to the first operating system.
  • the security of the terminal data is further improved by prompting the user whether to perform an operating system handover after the target service ends.
  • the target service includes at least one of a voice service, a short message service, and a multimedia communication service.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • FIG. 3 shows a schematic block diagram of a terminal in accordance with an embodiment of the present invention.
  • the terminal 300 according to the embodiment of the present invention includes the service execution device 200 according to any of the above, and therefore, the terminal has the same technical effect as the service execution device 200 of any of the above technical solutions. , will not repeat them here.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • FIG. 4 shows a schematic block diagram of a service execution apparatus in accordance with another embodiment of the present invention.
  • a service execution apparatus 400 includes: a target service that can be requested to be executed, including service 1, service 2, service 3, and service 4, and service 1 corresponds to eSIM1 card execution, eSIM1
  • the card can access the secure user data 408 through the second operating system 404 according to the correspondence relationship, the service 2 is executed corresponding to the eSIM2 card, the service 3 is executed corresponding to the eSIM3 card, the service 4 is executed corresponding to the eSIM4 card, and the eSIM2 card, the eSIM3 card and the eSIM4 card are The correspondence may be accessed by the first operating system 402 to access the secure user data 406.
  • the terminal when the terminal currently runs the first operating system 402, the user requests to perform a service. 1.
  • the eSIM1 is switched into the network and authenticated. After the authentication confirmation is completed, the first operating system 402 is switched to the second operating system 404 to provide the access permission of the service 1 to the secure user data 408.
  • FIG. 5 shows a schematic flow chart of a method of performing a service according to another embodiment of the present invention.
  • a service execution method includes: Step 502: setting a first mapping relationship between an eSIM card and an operating system (user domain); and step 504, setting an eSIM card and a service a mapping relationship, that is, a trigger condition for the eSIM card to perform a service based on an operating system (user domain); step 506, obtaining a request instruction for the user to request any service; and step 508, according to the request instruction, the first mapping relationship, and the second mapping
  • the relationship determines the operating system (user domain) corresponding to the service, and performs the service in the operating system; in step 510, it is determined whether the operation of the service is completed, and if yes, step 512 is performed; if not, step 514 is performed; The user confirms to quit the above operating system and ends; in step 514, the execution of the service continues.
  • the present invention proposes a new service execution method by acquiring a request instruction for executing a target service. Determining the eSIM card corresponding to the target service and the operating system (user domain) corresponding to the eSIM card. Therefore, based on the access rights of the eSIM card and the operating system, the target service is switched to the corresponding operating system, and the true meaning is The security of the target business and the data security of the user are improved, and the user experience is improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种业务执行方法、业务执行装置和终端，其中，业务执行方法包括：在第一操作系统运行过程中，获取执行目标业务的请求指令（102）；判断目标业务是否基于指定的嵌入式用户身份识别模块的服务协议执行（104）；在判定目标业务基于指定的嵌入式用户身份识别模块的服务协议执行时，根据指定的嵌入式用户身份识别模块与第二操作系统的对应关系，将目标业务从第一操作系统切换至第二操作系统中执行（106）。通过上述方法，提高了业务执行过程的安全性，降低了操作系统漏洞的威胁性，提升了用户的使用体验。

Description

业务执行方法、业务执行装置和终端 技术领域
本发明涉及终端技术领域，具体而言，涉及一种业务执行方法、一种业务执行装置和一种终端。
背景技术
在相关技术中，嵌入式用户身份识别模块(后文简称eSIM卡，embed-Subscriber Identity Module)的概念是将传统SIM(Subscriber Identity Module)卡直接嵌入到终端设备中，而不是作为独立的可移除零部件设于终端中，eSIM卡的应用可以提供终端用户更多的业务选择和套餐服务。
但是，对于多操作系统的终端来说，多操作系统对于eSIM卡的通用开放特性可能导致终端数据的泄漏，甚至对终端用户的财产造成威胁。
因此，如何设计一种新的业务执行方案，以提高终端的数据安全成为亟待解决的技术问题。
发明内容
本发明正是基于上述技术问题至少之一，提出了一种新的业务执行方案，通过在获取执行目标业务的请求指令时，确定目标业务对应的eSIM卡，以及上述eSIM卡对应的操作系统(用户域)，因此，基于eSIM卡与操作系统的访问权限，将目标业务切换至对应的操作系统中执行，进而真正意义上提高了目标业务的安全性和用户的数据安全，提升了用户的使用体验。
有鉴于此，根据本发明的第一方面，提出了一种业务执行方法，包括：在第一操作系统运行过程中，获取执行目标业务的请求指令；判断目标业务是否基于指定的嵌入式用户身份识别模块的服务协议执行；在判定目标业务基于指定的嵌入式用户身份识别模块的服务协议执行时，根据指 定的嵌入式用户身份识别模块与第二操作系统的对应关系，将目标业务从第一操作系统切换至第二操作系统中执行。
在该技术方案中，通过在获取执行目标业务的请求指令时，确定目标业务对应的eSIM卡，以及上述eSIM卡对应的操作系统(用户域)，因此，基于eSIM卡与操作系统的访问权限，将目标业务切换至对应的操作系统中执行，进而真正意义上提高了目标业务的安全性和用户的数据安全，提升了用户的使用体验。
其中，目标业务与操作系统存在对应关系，而操作系统具备不同的数据访问权限，也即通过操作系统的切换对目标业务的数据访问权限进行了限制，从而提高了终端的数据安全。
具体地，在进行操作系统切换的过程中，如第一操作系统的安全级别低于第二操作系统的安全级别，提示用户录入鉴权信息，例如鉴权信息为用户的指纹特征、虹膜特征、耳纹特征和声纹特征，或用户输入的字符信息，或终端的姿态变化信息，在判定鉴权信息与预设鉴权信息匹配时，进行操作系统的切换，并基于切换后的第二操作系统执行目标业务。
在上述任一项技术方案中，优选地，获取执行目标业务的请求指令，具体包括以下步骤：在获取针对任一业务的请求指令时，确定任一业务的属性信息；判断属性信息是否与预设属性信息匹配；在判定属性信息与预设属性信息匹配时，确定属性信息对应的业务为目标业务。
在该技术方案中，通过在获取任一业务的请求指令时，确定业务的属性信息，进而判断是否触发对操作系统的切换，节约了终端功耗的同时，提高了终端的数据安全，其中，属性信息包括业务的安全级别、业务的访问权限和业务所属的应用程序等。
在上述任一项技术方案中，优选地，在获取执行目标业务的请求指令前，还包括：预设指定的嵌入式用户身份识别模块与目标业务的对应关系。
在该技术方案中，通过预设指定的嵌入式用户身份识别模块与目标业务的对应关系，可以在目标业务被调用时，快速确定对应的嵌入式用户身份识别模块，进而确定对应的操作系统。在请求指令对应的业务为非目标业务时，不需要进行操作系统的切换，而在非目标业务执行过程中，终端 所有操作系统的私密数据对非目标业务是不可见的。
在上述任一项技术方案中，优选地，还包括：判断第二操作系统中执行的目标业务是否结束；在判定第二操作系统中执行的目标业务结束时，提示用户是否将运行环境自第二操作系统切换至第一操作系统。
在该技术方案中，通过在目标业务结束后，提示用户是否进行操作系统地切换，进一步地提高了终端数据的安全性。
在上述任一项技术方案中，优选地，目标业务包括语音业务、短信业务和多媒体通信业务中的至少一种。
根据本发明的第二方面，还提出了一种业务执行装置，包括：获取单元，用于在第一操作系统运行过程中，获取执行目标业务的请求指令；判断单元，用于判断目标业务是否基于指定的嵌入式用户身份识别模块的服务协议执行；切换单元，用于在判定目标业务基于指定的嵌入式用户身份识别模块的服务协议执行时，根据指定的嵌入式用户身份识别模块与第二操作系统的对应关系，将目标业务从第一操作系统切换至第二操作系统中执行。
在该技术方案中，通过在获取执行目标业务的请求指令时，确定目标业务对应的eSIM卡，以及上述eSIM卡对应的操作系统(用户域)，因此，基于eSIM卡与操作系统的访问权限，将目标业务切换至对应的操作系统中执行，进而真正意义上提高了目标业务的安全性和用户的数据安全，提升了用户的使用体验。
其中，目标业务与操作系统存在对应关系，而操作系统具备不同的数据访问权限，也即通过操作系统的切换对目标业务的数据访问权限进行了限制，从而提高了终端的数据安全。
具体地，在进行操作系统切换的过程中，如第一操作系统的安全级别低于第二操作系统的安全级别，提示用户录入鉴权信息，例如鉴权信息为用户的指纹特征、虹膜特征、耳纹特征和声纹特征，或用户输入的字符信息，或终端的姿态变化信息，在判定鉴权信息与预设鉴权信息匹配时，进行操作系统的切换，并基于切换后的第二操作系统执行目标业务。
在上述任一项技术方案中，优选地，还包括：确定单元，用于在获取针对任一业务的请求指令时，确定任一业务的属性信息；判断单元还用 于：判断属性信息是否与预设属性信息匹配；确定单元还用于：在判定属性信息与预设属性信息匹配时，确定属性信息对应的业务为目标业务。
在该技术方案中，通过在获取任一业务的请求指令时，确定业务的属性信息，进而判断是否触发对操作系统的切换，节约了终端功耗的同时，提高了终端的数据安全，其中，属性信息包括业务的安全级别、业务的访问权限和业务所属的应用程序等。
在上述任一项技术方案中，优选地，还包括：预设单元，用于预设指定的嵌入式用户身份识别模块与目标业务的对应关系。
在该技术方案中，通过预设指定的嵌入式用户身份识别模块与目标业务的对应关系，可以在目标业务被调用时，快速确定对应的嵌入式用户身份识别模块，进而确定对应的操作系统。在请求指令对应的业务为非目标业务时，不需要进行操作系统的切换，而在非目标业务执行过程中，终端所有操作系统的私密数据对非目标业务是不可见的。
在上述任一项技术方案中，优选地，判断单元还用于：判断第二操作系统中执行的目标业务是否结束；业务执行装置还包括：提示单元，用于在判定第二操作系统中执行的目标业务结束时，提示用户是否将运行环境自第二操作系统切换至第一操作系统。
在该技术方案中，通过在目标业务结束后，提示用户是否进行操作系统地切换，进一步地提高了终端数据的安全性。
在上述任一项技术方案中，优选地，目标业务包括语音业务、短信业务和多媒体通信业务中的至少一种。
根据本发明的第三方面，还提出了一种终端，包括如上述任一项的业务执行装置，因此，该终端具有和上述技术方案中任一项的业务执行装置相同的技术效果，在此不再赘述。
通过以上技术方案，通过在获取执行目标业务的请求指令时，确定目标业务对应的eSIM卡，以及上述eSIM卡对应的操作系统(用户域)，因此，基于eSIM卡与操作系统的访问权限，将目标业务切换至对应的操作系统中执行，进而真正意义上提高了目标业务的安全性和用户的数据安全，提升了用户的使用体验。
附图说明
图1示出了根据本发明的一个实施例的业务执行方法的示意流程图；
图2示出了根据本发明的一个实施例的业务执行装置的示意框图；
图3示出了根据本发明的实施例的终端的示意框图；
图4示出了根据本发明的另一个实施例的业务执行装置的示意框图；
图5示出了根据本发明的另一个实施例的业务执行方法的示意流程图。
具体实施方式
为了能够更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用第三方不同于在此描述的第三方方式来实施，因此，本发明的保护范围并不受下面公开的具体实施例的限制。
图1示出了根据本发明的一个实施例的业务执行方法的示意流程图。
如图1所示，根据本发明的一个实施例的业务执行方法，包括：步骤102，在第一操作系统运行过程中，获取执行目标业务的请求指令；步骤104，判断目标业务是否基于指定的嵌入式用户身份识别模块的服务协议执行；步骤106，在判定目标业务基于指定的嵌入式用户身份识别模块的服务协议执行时，根据指定的嵌入式用户身份识别模块与第二操作系统的对应关系，将目标业务从第一操作系统切换至第二操作系统中执行。
在该技术方案中，通过在获取执行目标业务的请求指令时，确定目标业务对应的eSIM卡，以及上述eSIM卡对应的操作系统(用户域)，因此，基于eSIM卡与操作系统的访问权限，将目标业务切换至对应的操作系统中执行，进而真正意义上提高了目标业务的安全性和用户的数据安全，提升了用户的使用体验。
其中，目标业务与操作系统存在对应关系，而操作系统具备不同的数据访问权限，也即通过操作系统的切换对目标业务的数据访问权限进行了限制，从而提高了终端的数据安全。
具体地，在进行操作系统切换的过程中，如第一操作系统的安全级别低于第二操作系统的安全级别，提示用户录入鉴权信息，例如鉴权信息为用户的指纹特征、虹膜特征、耳纹特征和声纹特征，或用户输入的字符信息，或终端的姿态变化信息，在判定鉴权信息与预设鉴权信息匹配时，进行操作系统的切换，并基于切换后的第二操作系统执行目标业务。
在上述任一项技术方案中，优选地，获取执行目标业务的请求指令，具体包括以下步骤：在获取针对任一业务的请求指令时，确定任一业务的属性信息；判断属性信息是否与预设属性信息匹配；在判定属性信息与预设属性信息匹配时，确定属性信息对应的业务为目标业务。
在该技术方案中，通过在获取任一业务的请求指令时，确定业务的属性信息，进而判断是否触发对操作系统的切换，节约了终端功耗的同时，提高了终端的数据安全，其中，属性信息包括业务的安全级别、业务的访问权限和业务所属的应用程序等。
在上述任一项技术方案中，优选地，在获取执行目标业务的请求指令前，还包括：预设指定的嵌入式用户身份识别模块与目标业务的对应关系。
在该技术方案中，通过预设指定的嵌入式用户身份识别模块与目标业务的对应关系，可以在目标业务被调用时，快速确定对应的嵌入式用户身份识别模块，进而确定对应的操作系统。在请求指令对应的业务为非目标业务时，不需要进行操作系统的切换，而在非目标业务执行过程中，终端所有操作系统的私密数据对非目标业务是不可见的。
在上述任一项技术方案中，优选地，还包括：判断第二操作系统中执行的目标业务是否结束；在判定第二操作系统中执行的目标业务结束时，提示用户是否将运行环境自第二操作系统切换至第一操作系统。
在该技术方案中，通过在目标业务结束后，提示用户是否进行操作系统地切换，进一步地提高了终端数据的安全性。
在上述任一项技术方案中，优选地，目标业务包括语音业务、短信业务和多媒体通信业务中的至少一种。
下面结合图2至图5对根据本发明的实施例的业务执行方案进行具体说明。
实施例一：
图2示出了根据本发明的一个实施例的业务执行装置的示意框图。
如图2所示，根据本发明的一个实施例的业务执行装置200，包括：获取单元202，用于在第一操作系统运行过程中，获取执行目标业务的请求指令；判断单元204，用于判断目标业务是否基于指定的嵌入式用户身份识别模块的服务协议执行；切换单元206，用于在判定目标业务基于指定的嵌入式用户身份识别模块的服务协议执行时，根据指定的嵌入式用户身份识别模块与第二操作系统的对应关系，将目标业务从第一操作系统切换至第二操作系统中执行。
在该技术方案中，通过在获取执行目标业务的请求指令时，确定目标业务对应的eSIM卡，以及上述eSIM卡对应的操作系统(用户域)，因此，基于eSIM卡与操作系统的访问权限，将目标业务切换至对应的操作系统中执行，进而真正意义上提高了目标业务的安全性和用户的数据安全，提升了用户的使用体验。
其中，目标业务与操作系统存在对应关系，而操作系统具备不同的数据访问权限，也即通过操作系统的切换对目标业务的数据访问权限进行了限制，从而提高了终端的数据安全。
具体地，在进行操作系统切换的过程中，如第一操作系统的安全级别低于第二操作系统的安全级别，提示用户录入鉴权信息，例如鉴权信息为用户的指纹特征、虹膜特征、耳纹特征和声纹特征，或用户输入的字符信息，或终端的姿态变化信息，在判定鉴权信息与预设鉴权信息匹配时，进行操作系统的切换，并基于切换后的第二操作系统执行目标业务。
在上述任一项技术方案中，优选地，还包括：确定单元208，用于在获取针对任一业务的请求指令时，确定任一业务的属性信息；判断单元204还用于：判断属性信息是否与预设属性信息匹配；确定单元208还用于：在判定属性信息与预设属性信息匹配时，确定属性信息对应的业务为目标业务。
在该技术方案中，通过在获取任一业务的请求指令时，确定业务的属性信息，进而判断是否触发对操作系统的切换，节约了终端功耗的同时，提高了终端的数据安全，其中，属性信息包括业务的安全级别、业务的访 问权限和业务所属的应用程序等。
在上述任一项技术方案中，优选地，还包括：预设单元210，用于预设指定的嵌入式用户身份识别模块与目标业务的对应关系。
在该技术方案中，通过预设指定的嵌入式用户身份识别模块与目标业务的对应关系，可以在目标业务被调用时，快速确定对应的嵌入式用户身份识别模块，进而确定对应的操作系统。在请求指令对应的业务为非目标业务时，不需要进行操作系统的切换，而在非目标业务执行过程中，终端所有操作系统的私密数据对非目标业务是不可见的。
在上述任一项技术方案中，优选地，判断单元204还用于：判断第二操作系统中执行的目标业务是否结束；业务执行装置200还包括：提示单元212，用于在判定第二操作系统中执行的目标业务结束时，提示用户是否将运行环境自第二操作系统切换至第一操作系统。
在该技术方案中，通过在目标业务结束后，提示用户是否进行操作系统地切换，进一步地提高了终端数据的安全性。
在上述任一项技术方案中，优选地，目标业务包括语音业务、短信业务和多媒体通信业务中的至少一种。
实施例二：
图3示出了根据本发明的实施例的终端的示意框图。
如图3所示，根据本发明的实施例的终端300，包括如上述任一项的业务执行装置200，因此，该终端具有和上述技术方案中任一项的业务执行装置200相同的技术效果，在此不再赘述。
实施例三：
图4示出了根据本发明的另一个实施例的业务执行装置的示意框图。
如图4所示，根据本发明的另一个实施例的业务执行装置400，包括：可请求执行的目标业务包括业务1、业务2、业务3和业务4，业务1对应于eSIM1卡执行，eSIM1卡根据对应关系可通过第二操作系统404访问安全用户数据408，业务2对应于eSIM2卡执行，业务3对应于eSIM3卡执行，业务4对应于eSIM4卡执行，eSIM2卡、eSIM3卡和eSIM4卡根据对应关系可通过第一操作系统402访问安全用户数据406。
具体地，当终端当前运行第一操作系统402时，用户请求执行业务 1，则切换eSIM1卡入网并进行鉴权操作，在完成鉴权确认后，从第一操作系统402切换至第二操作系统404，提供业务1对安全用户数据408的访问权限。
图5示出了根据本发明的另一个实施例的业务执行方法的示意流程图。
如图5所示，根据本发明的另一个实施例的业务执行方法，包括：步骤502，设置eSIM卡与操作系统(用户域)的第一映射关系；步骤504，设置eSIM卡与业务的第二映射关系，也即eSIM卡基于操作系统(用户域)执行业务的触发条件；步骤506，获取用户请求进行任一业务的请求指令；步骤508，根据请求指令、第一映射关系和第二映射关系确定业务对应的操作系统(用户域)，并在上述操作系统内执行业务；步骤510，判断业务的操作是否完成，若是，则执行步骤512，若否，则执行步骤514，；步骤512，用户确认退出上述操作系统，并结束；步骤514，继续执行业务。
以上结合附图详细说明了本发明的技术方案，考虑到相关技术中如何提高终端的数据安全的技术问题，本发明提出了一种新的业务执行方法，通过在获取执行目标业务的请求指令时，确定目标业务对应的eSIM卡，以及上述eSIM卡对应的操作系统(用户域)，因此，基于eSIM卡与操作系统的访问权限，将目标业务切换至对应的操作系统中执行，进而真正意义上提高了目标业务的安全性和用户的数据安全，提升了用户的使用体验。
以上仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (11)

  1. 一种业务执行方法，其特征在于，包括：
    在第一操作系统运行过程中，获取执行目标业务的请求指令；
    判断所述目标业务是否基于指定的嵌入式用户身份识别模块的服务协议执行；
    在判定所述目标业务基于所述指定的嵌入式用户身份识别模块的服务协议执行时，根据所述指定的嵌入式用户身份识别模块与第二操作系统的对应关系，将所述目标业务从所述第一操作系统切换至所述第二操作系统中执行。
  2. 根据权利要求1所述的业务执行方法，其特征在于，所述获取执行目标业务的请求指令，具体包括以下步骤：
    在获取针对任一业务的请求指令时，确定所述任一业务的属性信息；
    判断所述属性信息是否与预设属性信息匹配；
    在判定所述属性信息与所述预设属性信息匹配时，确定所述属性信息对应的业务为所述目标业务。
  3. 根据权利要求1所述的业务执行方法，其特征在于，在所述获取执行目标业务的请求指令前，还包括：
    预设所述指定的嵌入式用户身份识别模块与所述目标业务的对应关系。
  4. 根据权利要求1至3中任一项所述的业务执行方法，其特征在于，还包括：
    判断所述第二操作系统中执行的目标业务是否结束；
    在判定所述第二操作系统中执行的目标业务结束时，提示用户是否将运行环境自所述第二操作系统切换至所述第一操作系统。
  5. 根据权利要求1至3中任一项所述的业务执行方法，其特征在于，所述目标业务包括语音业务、短信业务和多媒体通信业务中的至少一种。
  6. 一种业务执行装置，其特征在于，包括：
    获取单元，用于在第一操作系统运行过程中，获取执行目标业务的请 求指令；
    判断单元，用于判断所述目标业务是否基于指定的嵌入式用户身份识别模块的服务协议执行；
    切换单元，用于在判定所述目标业务基于所述指定的嵌入式用户身份识别模块的服务协议执行时，根据所述指定的嵌入式用户身份识别模块与第二操作系统的对应关系，将所述目标业务从所述第一操作系统切换至所述第二操作系统中执行。
  7. 根据权利要求6所述的业务执行装置，其特征在于，还包括：
    确定单元，用于在获取针对任一业务的请求指令时，确定所述任一业务的属性信息；
    所述判断单元还用于：判断所述属性信息是否与预设属性信息匹配；
    所述确定单元还用于：在判定所述属性信息与所述预设属性信息匹配时，确定所述属性信息对应的业务为所述目标业务。
  8. 根据权利要求6所述的业务执行装置，其特征在于，还包括：
    预设单元，用于预设所述指定的嵌入式用户身份识别模块与所述目标业务的对应关系。
  9. 根据权利要求6至8中任一项所述的业务执行装置，其特征在于，
    所述判断单元还用于：判断所述第二操作系统中执行的目标业务是否结束；
    所述业务执行装置还包括：
    提示单元，用于在判定所述第二操作系统中执行的目标业务结束时，提示用户是否将运行环境自所述第二操作系统切换至所述第一操作系统。
  10. 根据权利要求6至8中任一项所述的业务执行装置，其特征在于，所述目标业务包括语音业务、短信业务和多媒体通信业务中的至少一种。
  11. 一种终端，其特征在于，包括：如权利要求6至10中任一项所述的业务执行装置。
PCT/CN2016/087532 2016-05-26 2016-06-28 业务执行方法、业务执行装置和终端 WO2017201805A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610365157.3A CN106096344A (zh) 2016-05-26 2016-05-26 业务执行方法、业务执行装置和终端
CN201610365157.3 2016-05-26

Publications (1)

Publication Number Publication Date
WO2017201805A1 true WO2017201805A1 (zh) 2017-11-30

Family

ID=57229399

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/087532 WO2017201805A1 (zh) 2016-05-26 2016-06-28 业务执行方法、业务执行装置和终端

Country Status (2)

Country Link
CN (1) CN106096344A (zh)
WO (1) WO2017201805A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117062075A (zh) * 2023-08-30 2023-11-14 中移互联网有限公司 专网安全认证方法、装置及系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107909330B (zh) * 2017-08-31 2020-10-09 平安科技（深圳）有限公司 工作流数据处理方法、装置、存储介质和计算机设备
CN110780926B (zh) * 2018-07-30 2022-11-15 中兴通讯股份有限公司 一种操作系统的切换方法、终端和计算机存储介质
CN116243996B (zh) * 2023-05-12 2023-08-08 苏州浪潮智能科技有限公司 业务的运行切换方法、装置、存储介质及电子装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102893642A (zh) * 2010-02-24 2013-01-23 高通股份有限公司 用于对多个无线网络中的参与进行管理的方法和系统
US20140329502A1 (en) * 2011-09-05 2014-11-06 Kt Corporation Certification method using an embedded uicc certificate, provisioning and mno changing methods using the certification method, embedded uicc therefor, mno system, and recording medium
CN104159329A (zh) * 2014-09-03 2014-11-19 谭卫 一种移动终端及其使用方法
CN104507181A (zh) * 2014-12-12 2015-04-08 宇龙计算机通信科技(深圳)有限公司 一种双卡双待通话方法、装置及终端
CN105022969A (zh) * 2014-04-04 2015-11-04 苹果公司 电子用户识别模块(eSIM)类型参数的防篡改
US20160007188A1 (en) * 2014-09-17 2016-01-07 Simless, Inc. Apparatuses, methods and systems for implementing a trusted subscription management platform

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105450828A (zh) * 2014-06-30 2016-03-30 展讯通信（深圳）有限公司 多卡移动终端中执行业务的方法
CN104463025B (zh) * 2014-12-19 2018-04-10 宇龙计算机通信科技(深圳)有限公司 系统切换方法、系统切换装置和终端
CN105072257B (zh) * 2015-07-16 2018-09-04 深圳前海达闼云端智能科技有限公司 一种双卡双系统终端及其来电处理方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102893642A (zh) * 2010-02-24 2013-01-23 高通股份有限公司 用于对多个无线网络中的参与进行管理的方法和系统
US20140329502A1 (en) * 2011-09-05 2014-11-06 Kt Corporation Certification method using an embedded uicc certificate, provisioning and mno changing methods using the certification method, embedded uicc therefor, mno system, and recording medium
CN105022969A (zh) * 2014-04-04 2015-11-04 苹果公司 电子用户识别模块(eSIM)类型参数的防篡改
CN104159329A (zh) * 2014-09-03 2014-11-19 谭卫 一种移动终端及其使用方法
US20160007188A1 (en) * 2014-09-17 2016-01-07 Simless, Inc. Apparatuses, methods and systems for implementing a trusted subscription management platform
CN104507181A (zh) * 2014-12-12 2015-04-08 宇龙计算机通信科技(深圳)有限公司 一种双卡双待通话方法、装置及终端

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117062075A (zh) * 2023-08-30 2023-11-14 中移互联网有限公司 专网安全认证方法、装置及系统

Also Published As

Publication number Publication date
CN106096344A (zh) 2016-11-09

Similar Documents

Publication Publication Date Title
US11736292B2 (en) Access token management method, terminal, and server
US10425818B2 (en) Enforcing service policies in embedded UICCs
KR101904338B1 (ko) 모바일 디바이스에서의 사용자 인증 및 인간 의도 검증을 위한 방법 및 장치
US11063928B2 (en) System and method for transferring device identifying information
US8474017B2 (en) Identity management and single sign-on in a heterogeneous composite service scenario
US20140013108A1 (en) On-Demand Identity Attribute Verification and Certification For Services
KR20160097323A (ko) Nfc 인증 메커니즘
WO2017054292A1 (zh) 一种虚拟sim卡服务授权方法、终端、服务器以及系统
WO2017201805A1 (zh) 业务执行方法、业务执行装置和终端
CN103401880B (zh) 一种工业控制网络自动登录的系统及方法
RU2017120215A (ru) Многофункциональная идентификация виртуального вычислительного узла
US9787678B2 (en) Multifactor authentication for mail server access
CN107005605A (zh) 服务授权中的设备标识
CN107766717B (zh) 一种访问控制方法、装置及系统
KR20160121775A (ko) 모바일 단말과 IoT기기간 제3자 보안인증 시스템 및 방법
WO2017076216A1 (zh) 服务器、移动终端、网络实名认证系统及方法
WO2017084569A1 (zh) 在智能终端中获取登陆凭证的方法、智能终端以及操作系统
WO2019056971A1 (zh) 一种鉴权方法及设备
WO2016115759A1 (zh) 一种登录网站的方法以及其服务器、客户端和外设
KR20190130206A (ko) 분실 보안이 강화된 IoT기기 제3자 보안인증 시스템 및 방법
US20160285843A1 (en) System and method for scoping a user identity assertion to collaborative devices
WO2017101571A1 (zh) 一种用户身份认证方法、装置及其系统
CN113901429A (zh) 多租户系统的访问方法及装置
CN107005409B (zh) 身份到安全元件内的引入
CN104660586B (zh) 访问数据网络上服务的用户账户的认证方法和装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16902793

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16902793

Country of ref document: EP

Kind code of ref document: A1