WO2018129726A1 - 一种授权凭据迁移的方法、终端设备及业务服务器 - Google Patents

一种授权凭据迁移的方法、终端设备及业务服务器 Download PDF

Info

Publication number
WO2018129726A1
WO2018129726A1 PCT/CN2017/071189 CN2017071189W WO2018129726A1 WO 2018129726 A1 WO2018129726 A1 WO 2018129726A1 CN 2017071189 W CN2017071189 W CN 2017071189W WO 2018129726 A1 WO2018129726 A1 WO 2018129726A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
service server
authorization credential
authorization
trusted application
Prior art date
Application number
PCT/CN2017/071189
Other languages
English (en)
French (fr)
Inventor
李辉
李卓斐
王梓
常新苗
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to US16/476,988 priority Critical patent/US11405383B2/en
Priority to EP17891369.5A priority patent/EP3557835B1/en
Priority to PCT/CN2017/071189 priority patent/WO2018129726A1/zh
Priority to CN201780009044.2A priority patent/CN108702357B/zh
Publication of WO2018129726A1 publication Critical patent/WO2018129726A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/34—Network arrangements or protocols for supporting network services or applications involving the movement of software or configuration parameters 
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G06Q20/3674—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes involving authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/385—Payment protocols; Details thereof using an alias or single-use codes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/388—Payment protocols; Details thereof using mutual authentication without cards, e.g. challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a method for authorizing credential migration, a terminal device, and a service server.
  • SE Secure Element
  • USB-KEY bank payment and bank electronic U shield
  • the authorization data of the trusted application needs to be migrated from the old terminal device to the new terminal device.
  • users need to go to the bank counter to sign the visa to apply for the authorization of the trusted application.
  • the banking personnel After verifying the identity of the user, the banking personnel revoke the authorization data of the old terminal device, and then let the user input and upload the paper migration certificate provided by the business personnel on the new terminal device, and verify the migration certificate.
  • the authorization credentials of the trusted application are delivered to the new terminal device. Have to go to the counter to sign, making users and banks time-consuming and laborious.
  • the present application provides a method for authorizing credential migration, a terminal device, and a service server, providing users with self-service migration of application authorization credentials, and improving the security of application authorization credential migration.
  • a method of authorizing credential migration is provided.
  • the first terminal device sends an authorization credential migration request of the trusted application to the service server, where the authorization credential migration request is sent by the first terminal device in a trusted execution environment using a secure channel;
  • the request includes a device identifier of the first terminal device, a security element identifier of the first terminal device, an application identifier of the trusted application, and personal information of the user;
  • the first terminal device is an authorization certificate to be migrated
  • the first terminal device receives a second authorization credential code of the trusted application that is input by the user in the trusted user interface, and the second authorization credential code is displayed by the user in viewing the second terminal device
  • the first authorization credential code is input after the first terminal device sends the second authorization credential code input by the user to the service server, and is used to instruct the service server to perform the first authorization verification;
  • the terminal device receives the authorization credential of the trusted application sent by the service server, and the authorization credential of the trusted application establishes the After the mapping relationship transmitted authorization credentials of a device identifier of the
  • the first terminal device sends an authorization credential migration request of the trusted application to the service server, and receives a second authorization credential code of the trusted application input by the user in the trusted user interface, where the first terminal device sends the user input to the service server.
  • the second authorization credential code is used to indicate that the service server performs the first authorization verification, and the first terminal device receives the authorization of the service server for the trusted application, and the authorization credential of the trusted application is that the service server establishes the device identifier of the first terminal device and Authorized by the mapping of the authorization credentials of the trusted application.
  • the first terminal device moves the request by sending an authorization credential of the trusted application to the service server in the TEE, and sends a second authorization credential code input by the user, so that the service service is performed. After establishing the mapping relationship between the device identifier of the first terminal device and the authorization credential of the trusted application, the authorization of the trusted application is completed, thereby providing self-service application authorization credential migration and improving Security during the process of authorizing credentials.
  • the method before the first terminal device receives the authorization credential of the trusted application sent by the service server, the method further includes: the first The terminal device receives the first verification code sent by the service server and displays it in the trusted user interface; the first terminal device receives the second verification code input by the user in the trusted user interface, the first The terminal device sends a second verification code input by the user to the service server, to instruct the service server to perform second authorization verification.
  • the second verification code can further confirm the identity of the user and improve the security in the process of authorizing the credentials.
  • a method of authorizing credential migration is provided.
  • the second terminal device signs the first data of the trusted application;
  • the first data of the trusted application includes the device identifier of the second terminal device, the secure component identifier of the second terminal device, the application identifier of the trusted application, and the user Personal information;
  • the second terminal device is a device to release the authorization credential;
  • the second terminal device sends an authorization credential release request of the trusted application to the service server, where the authorization credential release request is the second terminal device And sending, by the secure channel, the first channel of the trusted application;
  • the second terminal device receiving the trusted application sent by the service server;
  • the first authorization credential code is displayed in the trusted user interface;
  • the second terminal device receives the deletion request of the trusted application sent by the service server, and deletes the trusted application;
  • the second terminal device sends a delete response message of the trusted application to the service server.
  • a method of authorizing credential migration is provided.
  • the service server receives the authorization credential release request of the trusted application sent by the second terminal device; the authorization credential release request includes the device identifier of the second terminal device, the secure component identifier of the second terminal device, the application identifier of the trusted application, and the user Personal information; the service server confirms that the authentication is passed, generates a first authorization credential code, and sends the first authorization credential code to the second terminal device; the service server receives the second sent by the first terminal device Authorizing the certificate code, and deleting the mapping relationship between the device identifier of the second terminal device and the authorization credential of the trusted application after confirming that the first authorization verification is passed, and sending the trusted application deletion request to the second terminal device The service server receives the deletion response message of the trusted application sent by the second terminal device, and establishes a mapping relationship between the device identifier of the first terminal device and the authorization credential of the trusted application, and The first terminal device sends an authorization credential of the trusted application.
  • the service server confirms that the authentication is passed, and the method includes: determining, by the service server, the first data of the trusted application sent by the second terminal device And the device identifier of the second terminal device and the security element identifier of the second terminal device in the first data of the trusted application are consistent with the stored ones, and if yes, the service server confirms that the identity verification is passed .
  • the service server generates a first authorization credential code, including: the service server cancels the user of the user according to the authorization credential Determining, by the service server, an authorization credential migration request of the first terminal device corresponding to the personal information of the user; the service server generating, according to the device identifier and the random number of the first terminal device in the authorization credential request The first authorization credential code.
  • the service server confirms the first grant
  • the verification of the rights includes: the service server confirms whether the second authorization credential code and the first authorization credential code are consistent, and if yes, the service server confirms that the first authorization verification passes.
  • the service server before the service server deletes the mapping relationship between the device identifier of the second terminal device and the authorization credential of the trusted application, The service server sends a first verification code to the first terminal device; the service server receives a second verification code sent by the first terminal device; the service server according to the first verification code and the The second verification code confirms that the second authorization verification is passed.
  • the service server confirms that the second authorization verification is passed, including: the service server And confirming whether the first verification code and the second verification code are consistent, and if yes, the service server confirms that the second authorization verification is passed.
  • a terminal device is provided.
  • the authorization credential of the trusted application sent by the service server, and the authorization credential of the trusted application is sent after the service server establishes a mapping relationship between the device identifier of the terminal device and the authorization credential of the trusted application. of.
  • the terminal device further includes a display panel
  • the processor is further configured to: when the RF circuit is controlled, receive the information sent by the service server Before the authorization credential of the trusted application is described, controlling the RF circuit to receive the first verification code sent by the service server and controlling the display panel to display in the trusted user interface; controlling the touch panel to receive the user
  • the second verification code input in the trusted user interface controls the RF circuit to send the second verification code input by the user to the service server, to instruct the service server to perform the second authorization verification.
  • a terminal device is provided.
  • a service server is provided.
  • the processor and the communication module are configured to control the communication module to receive an authorization credential release request of the trusted application sent by the second terminal device, where the authorization credential release request includes the device identifier of the second terminal device
  • the security element identifier of the second terminal device, the application identifier of the trusted application, and the personal information of the user is further configured to confirm the identity verification, generate the first authorization credential code, and control the communication module to Transmitting, by the second terminal device, the first authorization credential code; controlling the communication module to receive the second authorization credential code sent by the first terminal device, and deleting the device of the second terminal device after confirming that the first authorization verification is passed And mapping a mapping relationship with the authorization credential of the trusted application, and controlling the communication module to send a deletion request of the trusted application to the second terminal device; and controlling the communication module to receive the Deleting a response message of the trusted application, and establishing a device identifier of the first terminal device and an authorization credential of the trusted application Shot relations, and controls the communication module to the first terminal device transmit
  • the processor is specifically configured to: determine a signature of the first data of the trusted application sent by the second terminal device, and the trusted Whether the device identifier of the second terminal device and the secure component identifier of the second terminal device in the first data of the application are consistent with the stored ones, and if yes, confirming that the identity verification is passed.
  • the processor is specifically configured to: determine, according to the personal information of the user in the authorization credential release request, the personal information of the user And corresponding to the first credential credential request of the first terminal device; and generating the first authorization credential code according to the device identifier and the random number of the first terminal device in the authorization credential request.
  • the processor is specifically configured to: confirm whether the second authorization credential code and the first authorization credential code are consistent, and if yes, confirm The first authorization verification is passed.
  • the processor is further configured to: delete a mapping relationship between a device identifier of the second terminal device and an authorization credential of the trusted application
  • the control module sends a first verification code to the first terminal device, and controls the communication module to receive a second verification code sent by the first terminal device. According to the first verification code and the first Two verification codes confirm that the second authorization verification is passed.
  • the processor is specifically configured to: confirm the first verification code and the Whether the second verification code is consistent, and if so, confirming that the second authorization verification is passed.
  • an embodiment of the present invention further provides a terminal device, where the terminal device includes a functional module for implementing the method in the second aspect.
  • an embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores program code, where the program code includes a method for implementing the first aspect, the second aspect, or the third aspect. Any possible implementation of the instructions.
  • FIG. 1 is a schematic diagram of a system architecture provided by the present application.
  • FIG. 2 is a schematic structural diagram of a service server provided by the present application.
  • FIG. 3 is a schematic structural diagram of a terminal device provided by the present application.
  • FIG. 4 is a schematic flowchart of a method for authorizing credential migration provided by the present application
  • FIG. 5 is a schematic diagram of a display panel of a terminal device according to the present application.
  • FIG. 6 is a schematic diagram of a display interface provided by the present application.
  • FIG. 7 is a schematic structural diagram of a terminal device according to the present application.
  • FIG. 8 is a schematic structural diagram of a terminal device according to the present application.
  • FIG. 1 shows a system architecture to which the present application is applied. Based on the system architecture, a data migration process can be implemented.
  • the system architecture for controlling authorization credential migration provided by the present application includes a service server 101 and two terminal devices 102.
  • the two terminal devices 102 are respectively connected to the service server 101 through the network, and the service server 101 generates new authorization credentials after the authorization credentials of the application are revoked from one of the terminal devices 102, and then is sent to another terminal device 102. .
  • the service server 101 in FIG. 1 may include a processor 1011, a communication module 1012, and a memory 1013.
  • the specific structure is as shown in FIG. 2.
  • the communication module 1012 is configured to connect to the network, communicate with the terminal device 102 through the network, receive downlink data sent by the terminal device 102, or send uplink data to the terminal device 102 to implement communication.
  • the processor 1011 is a control center of the service server 101 that connects various portions of the entire service server 101 using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 1013, and calling stored in the memory 1013.
  • the data performs various functions and processing data of the business server 101.
  • processor 1011 may include one or more processing units.
  • the terminal device 102 in FIG. 1 may be a device with a Trusted Executive Environment (TEE), for example, a mobile phone with a TEE, a wristband, a tablet, a laptop, a super mobile personal computer (English: Ultra-Mobile) Personal Computer (UMPC), Personal Digital Assistant (PDA) device, in-vehicle device, wearable device, etc., and is not limited to communication terminals.
  • TEE Trusted Executive Environment
  • UMPC Ultra-Mobile Personal Computer
  • PDA Personal Digital Assistant
  • the structure of the terminal device 102 shown in FIG. 3 is merely an example and not a limitation, and the terminal device 102 may further include more or less components than those illustrated, or combine some components. Or different parts arrangement.
  • the secure element 1028 is a separate physical chip that prevents hardware attacks, stores important data, and performs secure calculations.
  • important trusted applications are installed in the secure element 1028, such as various bank payment clients, electronic U shields (USB-KEY) of various banks, and the like.
  • the RF circuit 1021 can be used for receiving and transmitting signals during the transmission and reception of data information or a call, and in particular, after receiving the downlink information sent by the service server 101, the processor 1023 processes the uplink information of the terminal and sends the uplink information of the terminal through the network.
  • the service server 101 is provided to enable communication with the network server 101.
  • RF circuits include, but are not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like.
  • the RF circuit 1021 can also communicate with the network and other devices through wireless communication.
  • the above wireless communication may use any communication standard or protocol, including but not limited to Global System for Mobile communication (GSM), General Packet Radio Service (GPRS), and code division. (English: Code Division Multiple Access, CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), e-mail, short message service (English: Short Messaging Service, SMS), etc.
  • GSM Global System for Mobile communication
  • GPRS General Packet Radio Service
  • code division Code Division Multiple Access
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • SMS Short Messaging Service
  • the memory 1025 can be used to store software programs and modules, and the processor 1023 executes various functional applications and data processing of the mobile phone by running software programs and modules stored in the memory 1025.
  • the memory 1025 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to Data created by the use of the mobile phone (such as audio data, phone book, etc.).
  • memory 1025 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the memory 1025 is located in a Rich Executive Environment (REE) and is independent of the security element 1028 described above for storing non-critical data.
  • REE Rich Executive Environment
  • the input unit 1026 can be configured to receive input numeric or character information and to generate key signals related to user settings and function control of the terminal device 102.
  • the input unit 1026 can include a touch panel 10261, as well as other input devices 10262.
  • the touch panel 10261 also referred to as a touch screen, can collect touch operations on or near the user (such as a user using a finger, a stylus, or the like on the touch panel 10261 or near the touch panel 10261. Operation), and drive the corresponding connecting device according to a preset program.
  • the touch panel 10261 can include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • the processor 1023 is provided and can receive commands from the processor 1023 and execute them.
  • the touch panel 10261 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 130 may further include other input devices 10262.
  • other input devices 10262 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 1027 can be used to display information input by the user or information provided to the user and various menus of the mobile phone.
  • the display unit 1027 can include a display panel 10271. Alternatively, it can be in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.
  • the display panel 10271 is configured.
  • the touch panel 10261 can cover the display panel 10271. When the touch panel 10261 detects a touch operation thereon or nearby, the touch panel 10261 transmits to the processor 1023 to determine the type of the touch event, and then the processor 1023 according to the touch event. The type provides a corresponding visual output on display panel 10271.
  • the visual output external display panel 10271 that can be recognized by the human eye can be used as a display device in the present application for displaying text information or image information.
  • the touch panel 10261 and the display panel 10271 are implemented as two separate components to implement the input and output functions of the terminal device 102, in some embodiments, the touch panel 10261 may be overlaid on the display panel.
  • a touch display screen is formed, and the touch display screen provides a preset display area to the user, thereby implementing the input and output functions of the terminal device 102.
  • the touch display screen includes different display areas, and each display area may include interface elements such as icons of at least one application and/or widget desktop controls.
  • terminal device 102 may also include at least one type of sensor 1024, such as a gravity sensor, a distance sensor, and other sensors.
  • sensor 1024 such as a gravity sensor, a distance sensor, and other sensors.
  • FIG. 3 shows the sensor 1024, it can be understood that it does not belong to the essential configuration of the terminal device 102, and may be omitted as needed within the scope of not changing the essence of the invention.
  • WiFi is a short-range wireless transmission technology
  • the terminal device 102 can help a user to send and receive emails, browse web pages, and access streaming media through the WiFi module 1022, which provides wireless broadband Internet access for users.
  • the processor 1023 is a control center of the terminal device 102 that connects various portions of the entire terminal 10 using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 1025, and recalling stored in the memory 1025. The data, performing various functions and processing data of the terminal 10, thereby performing overall monitoring of the terminal device 102.
  • the processor 1023 may include one or more processing units; preferably, the processor 1023 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like.
  • the modem processor primarily handles wireless communications.
  • the audio circuit 1029 can be used to provide sound input and output to the user. For example, when performing voiceprint recognition, the input of the voiceprint needs to be implemented through the audio circuit 1029.
  • the terminal device 102 also includes a power source (not shown) that supplies power to the various components.
  • the power supply can be logically coupled to the processor 1023 through a power management system to manage functions such as charging, discharging, and power management through the power management system.
  • the terminal device 102 may further include a Bluetooth module, a headphone interface, and the like, and details are not described herein again.
  • the process of authorizing the credential migration needs to be run in the TEE, and the application that needs to migrate the authorization credential is located in the SE, which can prevent malicious attacks by the attacker during the migration of the authorized credential.
  • the present application takes the authorization credentials of the migration bank electronic U shield as an example, through the service server 101 and the terminal device. 102 interactive way to describe the process of authorization credential migration.
  • all information exchange processes are implemented through a secure channel, and all inputs or outputs are implemented through a Trusted User Interface (TUI).
  • the first terminal device is a device to be moved into the authorization credential, that is, a new terminal device, such as a mobile phone.
  • the second terminal device is a device to be de-authorized, that is, an old terminal device, such as a mobile phone or a computer connected to a bank U shield.
  • FIG. 4 shows a flow of a method for authorizing credential migration provided by the present application. The flow is shown in conjunction with FIGS. 1 to 4. The specifics include:
  • Step 401 The first terminal device sends an authorization credential migration request of the trusted application to the service server.
  • the first terminal device When the user installs the bank electronic U shield in the SE1028 of the first terminal device, the first terminal device establishes a secure channel with the service server, and the processor 1023 of the first terminal device can control the RF circuit 1021 or the WiFi module 1022 to serve the service through the secure channel.
  • the server sends an authorization credential request for the trusted application.
  • the first terminal automatically starts the TUI of the TEE to provide a reliable input environment for the user.
  • the authorization credential migration request of the trusted application carries the device identifier of the first terminal device, the SE identifier of the first terminal device, the application identifier of the trusted application, and the personal information of the user.
  • the device identifier may be a group of data used to distinguish other terminal devices, such as a serial number, a name, and the like of the terminal device.
  • the SE identifies a set of data that is different from the SEs in other terminal devices, such as information such as the serial number of the SE.
  • the application identifier of the trusted application is to distinguish the authorization credentials corresponding to the different applications, so that the service server knows which trusted application's authorization credentials are authorized to which terminal device. In this application, the application identifier of the bank electronic U shield is used.
  • the personal information of the user may be information such as the user's ID number, bank account, etc., and the personal information may be input by the user, or may be known by the first terminal device through other trusted applications.
  • the authorization credential migration request of the above trusted application can be set to be valid for a certain period of time. For example, it can be set to be valid within 30 minutes. If the authorization migration process is not completed within 30 minutes, the service server determines that the authorization migration fails, and the user can only re-establish Initiate a request.
  • Step 402 The second terminal device signs the first data of the trusted application, and sends an authorization credential release request of the trusted application to the service server through the secure channel.
  • the user When the user needs to release the authorization credential of the bank electronic U shield in the old terminal device, the user initiates the authorization credential release request on the second terminal device, and the processor 1023 of the second terminal device controls the bank electronic U shield pair in the SE 1028.
  • the first data of the bank's electronic U shield is signed.
  • the first data may include a device identifier of the second terminal device, an SE identifier of the second terminal device, an application identifier of the bank electronic U shield, and personal information of the user.
  • a secure channel is also established between the second terminal device and the service server, and the processor 1023 can control the RF circuit 1021 or the WiFi module 1022 to send an authorization credential release request of the bank electronic U shield to the service server through the secure channel, to request the service server to revoke.
  • the authorization credential of the bank electronic U shield in the second terminal device in other words, the service server no longer authorizes the bank electronic U shield of the second terminal device to use the authorization credential.
  • the secure channel it is possible to prevent the second terminal device from being maliciously attacked during the process of sending the authorization credential release request.
  • the second terminal device needs to perform identity verification on the user when sending the authorization credential release request, for example, prompting the user to perform fingerprint verification or inputting PIN code verification through the TUI interface, or prompting the user to perform voiceprint verification, etc.
  • identity verification for example, prompting the user to perform fingerprint verification or inputting PIN code verification through the TUI interface, or prompting the user to perform voiceprint verification, etc.
  • This application does not limit the technical solution of identity verification, but is merely an example function.
  • Step 403 The service server receives the authorization credential release request of the trusted application sent by the second terminal device, confirms that the identity verification is passed, generates the first authorization credential code, and sends the first authorization credential code to the second terminal device through the secure channel.
  • the processor 1011 of the service server Before the processor 1011 of the service server can control the communication module 1012 to receive the authorization credential release request of the bank electronic U shield sent by the second terminal device, the processor 1011 of the service server further needs to control the communication module 1012 to receive the bank sent by the first terminal device.
  • the authorization credential of the electronic U shield moves in the request, and the control memory 1013 moves the authorization credential of the bank electronic U shield sent by the first terminal device to the request for storage.
  • the processor 1011 of the service server needs to perform identity verification on the second terminal device, specifically, the signature of the first data in determining the authorization credential release request of the bank electronic U shield and the device identifier of the second terminal device in the first data. Whether the SE identifier of the second terminal device and the second terminal device are consistent with the stored ones. If they are consistent, the identity verification is confirmed.
  • the device indicates that the second terminal device is a device trusted by the service server, instead of the authorization credential release request generated by the malicious attack of the attacker, thereby improving the security of the application authorization credential migration.
  • the processor 1011 determines, according to the personal information of the user in the authorization credential release request sent by the second terminal device, the authorization credential relocation request of the first terminal device corresponding to the personal information of the user, that is, The processor 1011 queries the authorization credential migration request sent by the first terminal device corresponding to the personal information of the user stored in the memory 1013. If there is no matching authorization credential to move in the request, the business server rejects the authorization credential migration request. The processor 1011 generates a first authorization credential code according to the device identifier of the first terminal device and the random number generated by the first terminal device in the authorization credential request sent by the first terminal device.
  • the processor 1011 controls the communication module 1012 to send the first authorization credential code to the second terminal device, so that the second terminal device displays the first authorization credential code on the trusted user interface, thereby The user can view the first authorization credential code of the user.
  • Step 404 The second terminal device receives the first authorization credential code sent by the service server and displays the information in the trusted user interface.
  • the processor 1023 of the second terminal device starts the TUI of the TEE after the control RF circuit 1021 or the WiFi module 1022 receives the first authorization credential code sent by the service server, and controls the display panel 10271 to display the first authorization credential code, such as shown in FIG. 5.
  • the display panel 10271 of the second terminal device displays an authorization credential code 12345678 on the TUI interface, and the user can obtain the first authorization credential code through the display panel 10271 of the second terminal device, and the second terminal device displays the first authorization.
  • the voucher code is used to prompt the user to input the first authorization credential code on the first terminal device, so that the service server performs the first authorization verification, and the security of the application authorization credential migration is improved.
  • Step 405 The first terminal device receives the second authorization credential code of the trusted application input by the user in the trusted user interface, and sends the second authorization credential code input by the user to the service server through the secure channel.
  • the first terminal device After the first authorization credential code is viewed on the display panel 10271 of the second terminal device, the user needs to input on the first terminal device.
  • the first terminal device starts the TUI of the TEE, as shown in FIG. interface.
  • the user inputs the first authorized certificate code viewed in the display interface shown in FIG. 6.
  • the processor 1023 of the first terminal device may control the touch panel 10261 to receive the second authorization credential code input in the TUI, where the second authorization credential code may be consistent with the first authorization credential code sent by the service server to the second terminal device, indicating The user who migrated the authorization credentials and deauthorized credentials is the same user.
  • the second authorization credential code may also be inconsistent with the first authorization credential code sent by the service server to the second terminal device.
  • the user may enter the error, or the malicious authorization credential generated by the attacker after forging the first terminal device. code. Therefore, the processor 1023 of the first terminal device controls the RF circuit 1021 or the WiFi module 1022 to send the second authorization credential code to the service server, so that the service server performs the first authorization verification.
  • Step 406 The service server receives the second authorization credential code sent by the first terminal device, and deletes the mapping relationship between the device identifier of the second terminal device and the authorization credential of the trusted application after confirming that the first authorization verification is passed, to the second terminal.
  • the device sends a delete request for the trusted application.
  • the processor 1011 of the service server controls the communication module 1012 to receive the second authorization credential code sent by the first terminal device, and then the processor 1011 determines that the second authorization credential code and the first authorization credential code previously sent to the second terminal device are If the consistency is the same, the first authorization verification is confirmed, indicating that the user requesting the migration of the authorization credential and the deauthorization credential is the same user, further improving the security during the application authorization credential migration process.
  • the processor 1011 controls the memory 1013 to delete the mapping relationship between the stored device identifier of the second terminal device and the authorization credential of the bank electronic U shield, and controls the communication module 1012 to send the bank electronic device to the second terminal device.
  • the U shield deletion request is used to request the second terminal device to delete the bank electronic U shield and the bank electronic U shield authorization credential in the SE of the second terminal device.
  • the authorization credential is stored in the memory 1013 of the service server generated by the user when the bank electronic U shield is opened. When the bank electronic U shield uses the authorization credential, the service server needs to authorize the bank electronic U shield and issue the license.
  • the authorization credentials is stored in the memory 1013 of the service server generated by the user when the bank electronic U shield is opened.
  • the processor 1011 deletes the mapping relationship between the device identifier of the second terminal device and the authorization credential of the bank electronic U shield, indicating that the right of the bank electronic U shield to use the authorization credential is released, and notifying the second terminal device to delete The bank's electronic U shield prevents access by attackers.
  • Step 407 The second terminal device receives the deletion request of the trusted application sent by the service server, and deletes the trusted application.
  • the processor 1023 of the second terminal device controls the RF circuit 1021 or the WiFi module 1022 to receive the deletion request of the bank electronic U shield sent by the service server, and confirms that the bank electronic U shield and the authorization credential can be deleted, in other words, the second terminal device agrees
  • the business server releases the authorization credentials of the bank's electronic U shield. Only after the authorization credential of the bank electronic U shield of the second terminal device is released, the service server can establish a mapping relationship between the device identifier of the first terminal device and the authorization credential of the bank electronic U shield, and complete the application authorization credential of the user self-service. Migration, without having to go to the bank's counter for application authorization credentials migration, saves users time.
  • Step 408 The second terminal device sends a delete response message of the trusted application to the service server.
  • the second terminal device processor 1023 controls the RF circuit 1021 or the WiFi module 1022 to send a delete response message of the bank electronic U shield to the service server, indicating that the second terminal device has deleted the bank electronic U shield and the authorization credentials installed in the SE,
  • the service server can establish a mapping relationship between the device identifier of the first terminal device and the authorization credential of the bank electronic U shield.
  • Step 409 The service server receives the deletion response message of the trusted application sent by the second terminal device, and establishes a mapping relationship between the device identifier of the first terminal device and the authorization credential of the trusted application, and sends the trusted application to the first terminal device.
  • Authorization credentials The service server receives the deletion response message of the trusted application sent by the second terminal device, and establishes a mapping relationship between the device identifier of the first terminal device and the authorization credential of the trusted application, and sends the trusted application to the first terminal device. Authorization credentials.
  • the processor 1011 After receiving the deletion response message of the bank electronic U shield sent by the second terminal device, the processor 1011 establishes a mapping relationship between the device identifier of the first terminal device and the authorization credential of the bank electronic U shield, and The authorization credential is used to authorize the bank electronic U shield of the first terminal device, and the processor 1011 sends the authorization credential of the bank electronic U shield to the first terminal device, and the authorization credential issued to the first terminal device is a service server.
  • the processor 1011 generates new authorization credentials according to the authorization credentials corresponding to the bank electronic U shield stored in the memory 1013, instead of the authorization credentials in the second terminal device.
  • Step 410 The first terminal device receives the authorization credential of the trusted application sent by the service server.
  • the processor 1023 of the first terminal device controls the RF circuit 1021 or the WiFi module 1022 to receive the authorization credential of the bank electronic U shield delivered by the service server, and completes the authorization of the service server to the trusted application of the first terminal device, thereby enabling the user to complete the self-service. Migration of application authorization credentials.
  • the processor 1011 of the service server controls the communication module 1012 to
  • the first terminal device sends a first verification code, where the first verification code can be a second channel verification code.
  • the first verification code is valid for a set period of time. Used to verify that the user who migrated the authorization credentials and the authorization credentials are the same.
  • the processor 1023 of the first terminal device may further control the RF circuit 1021 to receive the service server to send the first verification code, for prompting the user to be in the TUI of the TEE. Enter the first verification code it sees and start the TUI of the TEE so that the user can enter the verification code.
  • the processor 1023 controls the touch panel 10261 to acquire a second verification code input by the user, and controls the RF circuit 1021 to send the second verification code to the service server, so that the service server performs the second authorization verification.
  • the processor 1011 of the service server controls the communication module 1012 to receive the second verification code, and then confirms whether the first two verification code is consistent with the previously transmitted first verification code. If they are consistent, the processor 1011 confirms that the second authorization verification is passed.
  • the second terminal device is a device connected to the U shield
  • the user needs to log in to the online bank of the bank corresponding to the U shield on the second terminal device to establish a connection with the U shield, and then perform the foregoing steps.
  • the specific application authorization credential migration process has been specifically described in the above embodiments, and details are not described herein.
  • the trusted application in the foregoing embodiment may also migrate some other unauthorized data.
  • the trusted credential application of the first terminal device further includes the trusted application.
  • the service server may determine which migration data needs to be migrated from the second terminal device to the first terminal device according to a preset rule, and deliver the first to the first in the migration process of the authorization credentials.
  • the terminal device In the terminal device.
  • the other steps can be seen in the above embodiments, and will not be described again.
  • the foregoing embodiment shows that the first terminal device sends an authorization credential migration request of the trusted application to the service server, and receives a second authorization credential code of the trusted application input by the user in the trusted user interface, where the first terminal device sends the The service server sends a second authorization credential code input by the user, and is used to indicate that the service server performs the first authorization verification.
  • the first terminal device receives the authorization of the service server for the trusted application, and the authorization credential of the trusted application establishes the first terminal for the service server. Authorized after mapping the device's device ID to the trusted credential's authorization credentials.
  • the first terminal device sends a request for the authorization credential of the trusted application to the service server in the TEE, and sends a second authorization credential code input by the user, so that the service server establishes the first after verifying the first terminal device.
  • the mapping between the device identifier of the terminal device and the authorization credential of the trusted application completes the authorization of the trusted application, thereby providing the user with self-service application authorization credential migration and improving the security in the process of applying the authorization credential.
  • FIG. 7 shows a terminal device 700 provided by the present application, which can perform the steps performed by the first terminal device in the foregoing method embodiment.
  • the RF unit 702, the processing unit 701, and the touch unit 703 are configured to control the RF unit 702 to send an authorization credential migration request of the trusted application to the service server.
  • the authorization credential migration request is sent by the terminal device in a trusted execution environment using a secure channel;
  • the authorization credential migration request includes a device identifier of the terminal device, a security element identifier of the terminal device, and the The application identifier of the application and the personal information of the user;
  • the terminal device is a device to be moved into the authorization credential;
  • the processing unit 701 is further configured to control the touch unit 703 to receive the user input in the trusted user interface.
  • the second authorization credential code of the trusted application, the second authorization credential code is that the user inputs after viewing the first authorization credential code displayed by the second terminal device
  • the processing unit 701 is further configured to control the RF unit 702 to send the second authorization credential code input by the user to the service server, to instruct the service server to perform first authorization verification; and control
  • the RF unit 702 receives the authorization credential of the trusted application sent by the service server, and the authorization credential of the trusted application is used by the service server to establish the device identifier of the terminal device and the authorization of the trusted application. The mapping of the credentials is sent afterwards.
  • the terminal unit 700 further includes a display unit 704.
  • the processing unit 701 is further configured to: before controlling the RF unit 702 to receive the authorization credential of the trusted application sent by the service server, The RF unit 702 receives the first verification code sent by the service server and controls the display panel to display in the trusted user interface; and controls the touch unit 703 to receive the second input by the user in the trusted user interface.
  • the verification code is used to control the RF unit 702 to send the second verification code input by the user to the service server, to instruct the service server to perform the second authorization verification.
  • FIG. 8 shows a terminal device 800 provided by the present application.
  • the terminal device 800 can perform the steps performed by the second terminal device in the foregoing method embodiment.
  • FIG. 9 shows a service server 900 provided by the present application, which can perform the steps performed by the service server in the foregoing method embodiment.
  • the service server includes: a processing unit 901 and a communication unit 902.
  • the processing unit 901 is configured to control the communication unit 902 to receive an authorization credential release request of the trusted application sent by the second terminal device.
  • the authorization credential release request includes a device identifier of the second terminal device, a secure element identifier of the second terminal device, an application identifier of the trusted application, and personal information of the user.
  • the processing unit 901 is further configured to confirm that the identity verification is passed, and generate Determining, by the communication unit 902, the first authorization credential code to the second terminal device; controlling the communication unit 902 to receive the second authorization credential code sent by the first terminal device, and After the first authorization verification is confirmed, the mapping relationship between the device identifier of the second terminal device and the authorization credential of the trusted application is deleted, and the communication unit 902 is controlled to send the delete request of the trusted application to the second terminal device.
  • the processing unit 901 is specifically configured to: determine a signature of the first data of the trusted application sent by the second terminal device, and a device identifier of the second terminal device in the first data of the trusted application And whether the secure element identifier of the second terminal device is consistent with the stored one, and if so, confirms that the identity verification is passed.
  • the processing unit 901 is specifically configured to: release, according to the authorization credential, the user in the request
  • the person information is used to determine an authorization credential migration request of the first terminal device corresponding to the user's personal information; and the device identifier and the random number of the first terminal device in the request for the authorization credential are generated, and the An authorization voucher code.
  • the processing unit 901 is specifically configured to: confirm whether the second authorization credential code and the first authorization credential code are consistent, and if yes, confirm that the first authorization verification is passed.
  • the processing unit 901 is further configured to: after deleting the mapping relationship between the device identifier of the second terminal device and the authorization credential of the trusted application, controlling the communication unit 902 to the first terminal
  • the device sends a first verification code
  • the communication unit 902 is controlled to receive the second verification code sent by the first terminal device
  • the second authorization verification is confirmed to be passed according to the first verification code and the second verification code.
  • the processing unit 901 is specifically configured to: confirm whether the first verification code and the second verification code are consistent, and if yes, confirm that the second authorization verification is passed.
  • the application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Accounting & Taxation (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Finance (AREA)
  • Power Engineering (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种授权凭据迁移的方法、终端设备及业务服务器，该方法包括第一终端设备向业务服务器发送可信应用的授权凭据迁入请求，接收输入的可信应用的第二授权凭证码，第一终端设备向所述业务服务器发送第二授权凭证码，用于指示业务服务器进行授权验证，第一终端设备接收业务服务器发送的可信应用的授权凭据。第一终端设备通过在TEE中向业务服务器发送可信应用的授权凭据迁入请求，并进行发送用户输入的第二授权凭证码，使得业务服务器在通过对第一终端设备验证之后建立该第一终端设备的设备标识与可信应用的授权凭据的映射关系，完成可信应用的授权，从而为用户提供自助的应用授权凭据迁移，并提高了应用授权凭据过程中的安全性。

Description

一种授权凭据迁移的方法、终端设备及业务服务器 技术领域
本申请涉及通信技术领域，尤其涉及一种授权凭据迁移的方法、终端设备及业务服务器。
背景技术
安全元件(Secure Element，SE)为终端设备中一种安全芯片，可以防止外部恶意攻击，目前终端设备中比较重要的应用都安装在SE中，比如银行支付、银行电子U盾(USB-KEY)等，这些安装在安全元件中的应用被成为可信应用。在将可信应用进行安装并启用时，还需要获取银行的授权数据，这些授权数据需要用户去银行柜台进行办理。
用户在更换终端设备时，需要将可信应用的授权数据从旧的终端设备中迁移到新的终端设备中。但是，目前用户需要到银行柜台进行面签，以申请可信应用的授权凭据的迁移。银行业务人员在核实用户的身份后，对旧的终端设备的授权数据进行吊销，之后让用户将业务人员提供的纸质的迁移凭证在新的终端设备上输入并上传，经过对迁移凭证的核实后，对新的终端设备下发该可信应用的授权凭据。不得不到柜台面签，使得用户和银行都费时费力。并且用户在输入迁移凭证码时是在终端的富运行环境(Rich Executive Environment，REE)中输入的，该终端设备的REE中易被植入的木马监听，使得外部攻击者将该可信应用的授权数据迁移到恶意终端设备上，造成用户的重大损失。
发明内容
本申请提供一种授权凭据迁移的方法、终端设备及业务服务器，为用户提供自助的应用授权凭据的迁移，并提高应用授权凭据迁移的安全性。
第一方面，提供一种授权凭据迁移的方法。
第一终端设备向业务服务器发送可信应用的授权凭据迁入请求，所述授权凭据迁入请求是所述第一终端设备在可信执行环境中使用安全通道发送的；所述授权凭据迁入请求包括所述第一终端设备的设备标识、所述第一终端设备的安全元件标识、所述可信应用的应用标识和用户的个人信息；所述第一终端设备为待迁入授权凭据的设备；所述第一终端设备接收所述用户在可信用户界面中输入的所述可信应用的第二授权凭证码，所述第二授权凭证码为所述用户在查看第二终端设备显示的第一授权凭证码后输入的；所述第一终端设备向所述业务服务器发送所述用户输入的第二授权凭证码，用于指示所述业务服务器进行第一授权验证；所述第一终端设备接收所述业务服务器发送的所述可信应用的授权凭据，所述可信应用的授权凭据为所述业务服务器建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系之后发送的。
第一终端设备向业务服务器发送可信应用的授权凭据迁入请求，接收用户在可信用户界面中输入的可信应用的第二授权凭证码，第一终端设备向所述业务服务器发送用户输入的第二授权凭证码，用于指示业务服务器进行第一授权验证，第一终端设备接收业务服务器对可信应用的授权，可信应用的授权凭据为业务服务器建立第一终端设备的设备标识与可信应用的授权凭据的映射关系之后授权的。第一终端设备通过在TEE中向业务服务器发送可信应用的授权凭据迁入请求，并进行发送用户输入的第二授权凭证码，使得业务服务 器在通过对第一终端设备验证之后建立该第一终端设备的设备标识与可信应用的授权凭据的映射关系，完成可信应用的授权，从而为用户提供自助的应用授权凭据迁移，并提高了授权凭据过程中的安全性。
结合第一方面，在第一方面的第一种可能的实现方式中，在所述第一终端设备接收所述业务服务器发送的所述可信应用的授权凭据之前，还包括：所述第一终端设备接收所述业务服务器发送的第一验证码并在可信用户界面中进行显示；所述第一终端设备接收所述用户在可信用户界面中输入的第二验证码，所述第一终端设备向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
通过第二验证码可以进一步的实现对用户身份的确认，提高了授权凭据过程中的安全性。
第二方面，提供一种授权凭据迁移的方法。
第二终端设备将可信应用的第一数据进行签名；所述可信应用的第一数据包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述第二终端设备为待解除授权凭据的设备；所述第二终端设备向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除请求是所述第二终端设备在可信执行环境中使用安全通道发送的；所述授权凭据解除中包括所述签名后的可信应用的第一数据；所述第二终端设备接收所述业务服务器发送的所述可信应用的第一授权凭证码并在可信用户界面中进行显示；所述第二终端设备接收所述业务服务器发送的所述可信应用的删除请求，并将所述可信应用删除；所述第二终端设备向所述业务服务器发送所述可信应用的删除响应消息。
第三方面，提供一种授权凭据迁移的方法。
业务服务器接收第二终端设备发送的可信应用的授权凭据解除请求；所述授权凭据解除请求包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述业务服务器确认身份验证通过，生成第一授权凭证码，并向所述第二终端设备发送所述第一授权凭证码；所述业务服务器接收第一终端设备发送的第二授权凭证码，并在确认第一授权验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系，向第二终端设备发送所述可信应用的删除请求；所述业务服务器接收所述第二终端设备发送的所述可信应用的删除响应消息，并建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并向所述第一终端设备发送所述可信应用的授权凭据。
结合第三方面，在第三方面的第一种可能的实现方式中，所述业务服务器确认身份验证通过，包括：所述业务服务器确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则所述业务服务器确认所述身份验证通过。
结合第三方面，在第三方面的第二种可能的实现方式中，所述业务服务器生成第一授权凭证码，包括：所述业务服务器根据所述授权凭据解除请求中的所述用户的个人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；所述业务服务器根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
结合第三方面，在第三方面的第三种可能的实现方式中，所述业务服务器确认第一授 权验证通过，包括：所述业务服务器确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则所述业务服务器确认所述第一授权验证通过。
结合第三方面，在第三方面的第四种可能的实现方式中，在所述业务服务器删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系之前，还包括：所述业务服务器向所述第一终端设备发送第一验证码；所述业务服务器接收所述第一终端设备发送的第二验证码；所述业务服务器根据所述第一验证码和所述第二验证码，确认第二授权验证通过。
结合第三方面或第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，所述业务服务器确认所述第二授权验证通过，包括：所述业务服务器确认所述第一验证码和所述第二验证码是否一致，若是，则所述业务服务器确认所述第二授权验证通过。
第四方面，提供一种终端设备。
包括：射频(英文：Radio Frequency，RF)电路、处理器和触摸面板；所述处理器，用于控制所述RF电路向业务服务器发送可信应用的授权凭据迁入请求，所述授权凭据迁入请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据迁入请求包括所述终端设备的设备标识、所述终端设备的安全元件标识、所述可信应用的应用标识和用户的个人信息；所述终端设备为待迁入授权凭据的设备；所述处理器，还用于控制所述触摸面板接收所述用户在可信用户界面中输入的所述可信应用的第二授权凭证码，所述第二授权凭证码为所述用户在查看第二终端设备显示的第一授权凭证码后输入的；所述处理器，还用于控制所述RF电路向所述业务服务器发送所述用户输入的第二授权凭证码，用于指示所述业务服务器进行第一授权验证；以及控制所述RF电路接收所述业务服务器发送的所述可信应用的授权凭据，所述可信应用的授权凭据为所述业务服务器建立所述终端设备的设备标识与所述可信应用的授权凭据的映射关系之后发送的。
结合第四方面，在第四方面的第一种可能的实现方式中，所述终端设备还包括显示面板；所述处理器还用于：在控制所述RF电路接收所述业务服务器发送的所述可信应用的授权凭据之前，控制所述RF电路接收所述业务服务器发送的第一验证码并控制所述显示面板在可信用户界面中进行显示；控制所述触摸面板接收所述用户在可信用户界面中输入的第二验证码，控制所述RF电路向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
第五方面，提供一种终端设备。
包括：RF电路、处理器和显示面板；所述处理器，用于将可信应用的第一数据进行签名；所述可信应用的第一数据包括终端设备的设备标识、终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述终端设备为待解除授权凭据的设备；所述处理器，还用于控制所述RF电路向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据解除中包括所述签名后的可信应用的第一数据；控制所述RF电路接收所述业务服务器发送的所述可信应用的第一授权凭证码并控制所述显示面板在可信用户界面中进行显示；控制所述RF电路接收所述业务服务器发送的所述可信应用的删除请求，并将所述可信应用删除；控制所述RF电路向所述业务服务器发送所述可信应用的删除响应消息。
第六方面，提供一种业务服务器。
包括：处理器和通信模块；所述处理器，用于控制所述通信模块接收第二终端设备发送的可信应用的授权凭据解除请求；所述授权凭据解除请求包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述处理器，还用于确认身份验证通过，生成第一授权凭证码，并控制所述通信模块向所述第二终端设备发送所述第一授权凭证码；控制所述通信模块接收第一终端设备发送的第二授权凭证码，并在确认第一授权验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系，控制所述通信模块向第二终端设备发送所述可信应用的删除请求；控制所述通信模块接收所述第二终端设备发送的所述可信应用的删除响应消息，并建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并控制所述通信模块向所述第一终端设备发送所述可信应用的授权凭据。
结合第六方面，在第六方面的第一种可能的实现方式中，所述处理器具体用于：确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则确认所述身份验证通过。
结合第六方面，在第六方面的第二种可能的实现方式中，所述处理器具体用于：根据所述授权凭据解除请求中的所述用户的个人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
结合第六方面，在第六方面的第三种可能的实现方式中，所述处理器具体用于：确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则确认所述第一授权验证通过。
结合第六方面，在第六方面的第四种可能的实现方式中，所述处理器还用于：在删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系之前，控制所述通信模块向所述第一终端设备发送第一验证码；控制所述通信模块接收所述第一终端设备发送的第二验证码；根据所述第一验证码和所述第二验证码，确认第二授权验证通过。
结合第六方面或第六方面的第四种可能的实现方式中，在第六方面的第五种可能的实现方式中，所述处理器具体用于：确认所述第一验证码和所述第二验证码是否一致，若是，则确认所述第二授权验证通过。
第七方面，本发明实施例提供一种终端设备，所述终端设备包括用于实现第一方面所述的方法的功能模块。
第八方面，本发明实施例还提供一种终端设备，所述终端设备包括用于实现第二方面所述的方法的功能模块。
第九方面，本发明实施例还提供一种业务服务器，所述业务服务器包括用于实现第三方面所述的方法的功能模块。
第十方面，本发明实施例还提供一种计算机存储介质，所述计算机存储介质上存储有程序代码，所述程序代码包括用于实现所述第一方面、第二方面或第三方面的方法的任意可能的实现方式的指令。
附图说明
图1为本申请提供的一种系统架构的示意图；
图2为本申请提供的一种业务服务器的结构示意图；
图3为本申请提供的一种终端设备的结构示意图；
图4为本申请提供的一种授权凭据迁移的方法的流程示意图；
图5为本申请提供的一种终端设备的显示面板的示意图；
图6为本申请提供的一种显示界面的示意图；
图7为本申请提供的一种终端设备的结构示意图；
图8为本申请提供的一种终端设备的结构示意图；
图9为本申请提供的一种业务服务器的结构示意图。
具体实施方式
下面将结合本申请中的附图，对本申请中的技术方案进行清楚、完整地描述。
图1示出了本申请所适用的一种系统架构，基于该系统架构可实现数据迁移的流程，本申请提供的控制授权凭据迁移的系统架构中包括业务服务器101和两个终端设备102。两个终端设备102分别通过网络与业务服务器101连接，实现了业务服务器101在将应用的授权凭据从其中一个终端设备102吊销之后，生成新的授权凭据，然后下发到另一个终端设备102中。
图1中的业务服务器101可以包括处理器1011、通信模块1012和存储器1013，具体结构如图2所示。
通信模块1012用于连接网络，通过网络与终端设备102进行通信，接收终端设备102发送的下行数据或向终端设备102发送上行数据，实现通信。
处理器1011是业务服务器101的控制中心，利用各种接口和线路连接整个业务服务器101的各个部分，通过运行或执行存储在存储器1013内的软件程序/或模块，以及调用存储在存储器1013内的数据，执行业务服务器101的各种功能和处理数据。可选地，处理器1011可以包括一个或多个处理单元。
存储器1013可用于存储软件程序以及模块，处理器1011通过运行存储在存储器1013的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。存储器1013可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机的使用所创建的数据(如音频数据、电话本等)等。此外，存储器1013可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
图1中的终端设备102可以为具有可信运行环境(Trusted Executive Environment，TEE)的设备，例如，具有TEE的手机、手环、平板电脑、笔记本电脑、超级移动个人计算机(英文：Ultra-Mobile Personal Computer，UMPC)、个人数字助理(英文：Personal Digital Assistant，PDA)设备、车载设备、可穿戴设备等，而不仅限于通信终端。
如图3所示，终端设备102可以包括射频(英文：Radio Frequency，RF)电路1021、WiFi模块1022、处理器1023、传感器1024、存储器1025、输入单元1026、显示单元1027、安全元件(Secure Element，SE)1028、音频电路1029。
其中，本领域技术人员可以理解，图3中示出的终端设备102的结构仅为示例而非限定，终端设备102还可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
安全元件1028为一种独立的物理芯片，可以防止硬件攻击，用于存储重要数据，进行安全计算。在本申请中，安全元件1028中安装有重要的可信应用，比如，各家银行支付客户端、各家银行的电子U盾(USB-KEY)等。
RF电路1021可用于在收发数据信息或通话过程中，信号的接收和发送，特别地，将业务服务器101发送的下行信息接收后，给处理器1023处理；另外，将终端的上行信息经过网络发送给该业务服务器101，从而实现了与该网络服务器101的通信。通常，RF电路包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(英文：Low Noise Amplifier，LNA)、双工器等。此外，RF电路1021还可以通过无线通信与网络和其他设备通信。上述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(英文：Global System for Mobile communication，GSM)、通用分组无线服务(英文：General Packet Radio Service，GPRS)、码分多址(英文：Code Division Multiple Access，CDMA)、宽带码分多址(英文：Wideband Code Division Multiple Access，WCDMA)、长期演进(英文：Long Term Evolution，LTE)、电子邮件、短消息服务(英文：Short Messaging Service，SMS)等。
其中，存储器1025可用于存储软件程序以及模块，处理器1023通过运行存储在存储器1025的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。存储器1025可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机的使用所创建的数据(如音频数据、电话本等)等。此外，存储器1025可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。该存储器1025位于富运行环境(Rich Executive Environment，REE)与上述安全元件1028相互独立，用于存储一下非重要数据。
输入单元1026可用于接收输入的数字或字符信息，以及产生与终端设备102的用户设置以及功能控制有关的键信号。具体地，输入单元1026可包括触控面板10261、以及其他输入设备10262。触控面板10261，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触控面板10261上或在触控面板10261附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板10261可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器1023，并能接收处理器1023发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板10261。在本申请中，除了触控面板10261，输入单元130还可以包括其他输入设备10262。具体地，其他输入设备10262可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
其中，显示单元1027可用于显示由用户输入的信息或提供给用户的信息以及手机的各种菜单。显示单元1027可包括显示面板10271，可选的，可以采用液晶显示单元(LCD，Liquid Crystal Display)、有机发光二极管(OLED，Organic Light-Emitting Diode)等形式 来配置显示面板10271。进一步的，触控面板10261可覆盖显示面板10271，当触控面板10261检测到在其上或附近的触摸操作后，传送给处理器1023以确定触摸事件的类型，随后处理器1023根据触摸事件的类型在显示面板10271上提供相应的视觉输出。
其中，该人眼能够识别的该视觉输出外显示面板10271可以作为本申请中的显示设备，用来显示文本信息或图像信息。虽然在图3中，触控面板10261与显示面板10271是作为两个独立的部件来实现终端设备102的输入和输出功能，但是在某些实施例中，可以将触控面板10261覆盖在显示面板10271上，形成触摸显示屏，触摸显示屏提供给用户预设的显示区域，从而实现终端设备102的输入和输出功能。在本申请中，该触摸显示屏包括不同的显示区域，每一个显示区域可以包含至少一个应用程序的图标和/或widget桌面控件等界面元素。
另外，终端设备102还可包括至少一种传感器1024，比如重力传感器、距离传感器、以及其他传感器。虽然图3示出了传感器1024，但是可以理解的是，其并不属于终端设备102的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
WiFi属于短距离无线传输技术，终端设备102通过WiFi模块1022可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。
处理器1023是终端设备102的控制中心，利用各种接口和线路连接整个终端10的各个部分，通过运行或执行存储在存储器1025内的软件程序和/或模块，以及调用存储在存储器1025内的数据，执行终端10的各种功能和处理数据，从而对终端设备102进行整体监控。可选的，处理器1023可包括一个或多个处理单元；优选的，处理器1023可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。
可以理解的是，上述调制解调处理器也可以不集成到处理器1023中。
音频电路1029可以用于为用户提供声音输入输出，比如在进行声纹识别时，需要通过音频电路1029来实现声纹的输入。
终端设备102还包括给各个部件供电的电源(图中未画出)。
可选地，电源可以通过电源管理系统与处理器1023逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。尽管未示出，终端设备102还可以包括蓝牙模块、耳机接口等，在此不再赘述。
在本申请中，授权凭据迁移的过程需要运行在TEE中，且需要迁移授权凭据的应用位于SE中，可以防止在授权凭据迁移的过程中被攻击者恶意攻击。
需要说明的是，图2中所示的业务服务器101和图3中所示的终端设备102所包含的结构仅是一种示例，本申请对此不做限定。
以下，为了便于理解和记忆，结合图1、图2和图3中业务服务器101和终端设备102的具体结构，本申请以迁移银行电子U盾的授权凭据为例，通过业务服务器101和终端设备102交互的方式来描述授权凭据迁移的流程。在本申请中，所有的信息交互的流程都是通过安全通道实现的，所有的输入或输出都是通过可信用户界面(Trusted User Interface，TUI)实现的。第一终端设备为待迁入授权凭据的设备，即为新的终端设备，比如手机。第二终端设备为待解除授权凭据的设备，即为旧的终端设备，比如手机或连接有银行U盾的电脑等。
图4示出了本申请提供的一种授权凭据迁移的方法的流程，结合图1至4所示，该流 程具体包括：
步骤401，第一终端设备向业务服务器发送可信应用的授权凭据迁入请求。
用户在第一终端设备的SE1028中安装银行电子U盾时，第一终端设备与业务服务器建立安全通道，第一终端设备的处理器1023可以控制RF电路1021或WiFi模块1022通过该安全通道向业务服务器发送可信应用的授权凭据迁入请求。用户在申请银行电子U盾的授权凭据被授权时，第一终端自动启动TEE的TUI，为用户提供可靠的输入环境。
上述可信应用的授权凭据迁入请求中携带有该第一终端设备的设备标识、第一终端设备的SE标识、可信应用的应用标识和用户的个人信息。设备标识可以为用于区别其它终端设备的一组数据，比如可以为终端设备的序列号、名称等信息。SE标识为区别于其它终端设备中的SE的一组数据，比如可以为SE的序列号等信息。可信应用的应用标识是为了区别不同应用所对应的授权凭据，以供业务服务器知道将哪个可信应用的授权凭据授权到哪个终端设备中，本申请中为银行电子U盾的应用标识。该用户的个人信息可以为用户的身份证号码、银行账户等信息，该个人信息可以用户输入的，也可是第一终端设备通过其它可信应用获知的。上述可信应用的授权凭据迁入请求可以设置在一定时期内有效，比如，可以设置30分钟内有效，超过30分钟授权迁移过程没有完成，则业务服务器判定本次授权迁移失败，用户只能重新发起请求。
步骤402，第二终端设备将可信应用的第一数据进行签名，通过安全通道向业务服务器发送可信应用的授权凭据解除请求。
用户在需要将旧的终端设备中银行电子U盾的授权凭据解除时，在第二终端设备上发起授权凭据解除申请，此时第二终端设备的处理器1023控制SE1028中的银行电子U盾对银行电子U盾的第一数据进行签名。该第一数据可以包括第二终端设备的设备标识、第二终端设备的SE标识、银行电子U盾的应用标识和用户的个人信息。第二终端设备与业务服务器之间也建立有安全通道，处理器1023可以控制RF电路1021或WiFi模块1022通过该安全通道向业务服务器发送银行电子U盾的授权凭据解除请求，以请求业务服务器吊销第二终端设备中银行电子U盾的授权凭据，换而言之，业务服务器不再授权第二终端设备的银行电子U盾使用该授权凭据。通过安全通道可以避免第二终端设备发送授权凭据解除请求的过程中被恶意攻击。
可选地，第二终端设备在发送授权凭据解除请求时，还需要对用户进行身份验证，比如，通过TUI界面提示用户进行指纹验证或者输入PIN码验证，还可以是提示用户进行声纹验证等，从而确认用户身份的合法性。本申请对身份验证的技术方案不做限定，仅是示例作用。
步骤403，业务服务器接收第二终端设备发送的可信应用的授权凭据解除请求，确认身份验证通过，生成第一授权凭证码，并通过安全通道向第二终端设备发送第一授权凭证码。
在业务服务器的处理器1011可以控制通信模块1012接收第二终端设备发送的银行电子U盾的授权凭据解除请求之前，业务服务器的处理器1011还需控制通信模块1012接收第一终端设备发送的银行电子U盾的授权凭据迁入请求，并控制存储器1013将该第一终端设备发送的银行电子U盾的授权凭据迁入请求进行存储。
业务服务器的处理器1011需要对第二终端设备进行身份验证，具体为确定银行电子U盾的授权凭据解除请求中的第一数据的签名以及该第一数据中的第二终端设备的设备标 识和第二终端设备的SE标识是否与已存储的一致，若一致，确认身份验证通过。表明该第二终端设备为业务服务器信任的设备，而不是攻击者恶意攻击产生的授权凭据解除请求，提高了应用授权凭据迁移的安全性。
在身份验证通过之后，处理器1011根据第二终端设备发送的授权凭据解除请求中的用户的个人信息确定该用户的个人信息所对应的第一终端设备的授权凭据解迁入请求，也就是说，处理器1011查询存储器1013中存储的用户的个人信息所对应的第一终端设备发送的授权凭据迁入请求。若没有匹配的授权凭据迁入请求，则业务服务器拒绝此授权凭据迁出请求。处理器1011根据所查询到的第一终端设备发送的授权凭据迁入请求中的该第一终端设备的设备标识和自身生成的随机数，生成第一授权凭证码。该第一授权凭证码可以为一组数字，由第一终端设备的设备标识和随机数通过一定的算法计算后生成的。比如使用哈希运算消息认证码(Hash-based Message Authentication Code，HMAC)对这两个数进行计算，生成一组数字，以供第二终端设备显示。本申请对生成第一授权凭证码的算法不做限定，仅是示例作用。
在得到第一授权凭证码之后，处理器1011控制通信模块1012向第二终端设备发送该第一授权凭证码，以使第二终端设备在可信用户界面显示该第一授权凭证码，从而使得用户可以查看到该用户的第一授权凭证码。
步骤404，第二终端设备接收业务服务器发送的第一授权凭证码并在可信用户界面中进行显示。
第二终端设备的处理器1023在控制RF电路1021或WiFi模块1022接收业务服务器发送的第一授权凭证码之后，启动TEE的TUI，控制显示面板10271显示该第一授权凭证码，比如图5所示的第二终端设备的显示面板10271，TUI界面上显示了授权凭证码12345678，用户通过第二终端设备的显示面板10271可以获知该第一授权凭证码，该第二终端设备显示该第一授权凭证码，用于提示用户在第一终端设备上输入该第一授权凭证码，以使业务服务器进行第一授权验证，提高应用授权凭据迁移的安全性。
步骤405，第一终端设备接收用户在可信用户界面中输入的可信应用的第二授权凭证码，通过安全通道向业务服务器发送用户输入的第二授权凭证码。
用户在第二终端设备的显示面板10271上查看到的第一授权凭证码之后，需要在第一终端设备上进行输入，此时，第一终端设备启动TEE的TUI，如图6所示的显示界面。用户在图6所示的显示界面中输入查看到的第一授权凭证码。第一终端设备的处理器1023可以控制触摸面板10261接收在TUI中输入的第二授权凭证码，该第二授权凭证码可能与业务服务器向第二终端设备发送的第一授权凭证码一致，表明进行迁入授权凭据和解除授权凭据的用户为同一用户。该第二授权凭证码也可能与业务服务器向第二终端设备发送的第一授权凭证码不一致，此时有可能是用户输入错误，也有可能是攻击者伪造第一终端设备后产生的恶意授权凭证码。因此，第一终端设备的处理器1023控制RF电路1021或WiFi模块1022向业务服务器发送该第二授权凭证码，以使业务服务器进行第一授权验证。
步骤406，业务服务器接收第一终端设备发送的第二授权凭证码，并在确认第一授权验证通过后删除第二终端设备的设备标识与可信应用的授权凭据的映射关系，向第二终端设备发送可信应用的删除请求。
业务服务器的处理器1011控制通信模块1012接收第一终端设备发送的第二授权凭证码，然后处理器1011确定第二授权凭证码与之前发送给第二终端设备的第一授权凭证码是 否一致，若一致，则确认第一授权验证通过，表明请求迁入授权凭据和解除授权凭据的用户为同一用户，进一步的提高了应用授权凭据迁移过程中的安全性。
处理器1011在确认第一验证通过之后，控制存储器1013删除已存储的第二终端设备的设备标识与银行电子U盾的授权凭据的映射关系，并控制通信模块1012向第二终端设备发送银行电子U盾的删除请求，用于请求第二终端设备在该第二终端设备的SE中删除该银行电子U盾以及该银行电子U盾的授权凭据。该授权凭据是用户在进行银行电子U盾开户时生成的存储在业务服务器的存储器1013中，银行电子U盾在使用该授权凭据时，需要业务服务器对该银行电子U盾进行授权，并下发该授权凭据。处理器1011在删除第二终端设备的设备标识与银行电子U盾的授权凭据的映射关系，表明在解除第二终端设备中银行电子U盾使用该授权凭据的权利，并通知第二终端设备删除该银行电子U盾，防止被攻击者获取。
步骤407，第二终端设备接收业务服务器发送的可信应用的删除请求，并将可信应用删除。
第二终端设备的处理器1023控制RF电路1021或WiFi模块1022接收业务服务器发送的银行电子U盾的删除请求，并确认该银行电子U盾以及授权凭据可以被删除，换言之，第二终端设备同意业务服务器解除该银行电子U盾的授权凭据。只有解除了对第二终端设备的银行电子U盾的授权凭据，才能使得业务服务器可以建立第一终端设备的设备标识与银行电子U盾的授权凭据的映射关系，完成用户自助的应用授权凭据的迁移，而不必到银行的柜台进行应用授权凭据的迁移，节省了用户的时间。
步骤408，第二终端设备向业务服务器发送可信应用的删除响应消息。
第二终端设备处理器1023控制RF电路1021或WiFi模块1022向业务服务器发送银行电子U盾的删除响应消息，表明第二终端设备已经将其SE中安装的银行电子U盾以及授权凭据删除，以使得的业务服务器可以建立第一终端设备的设备标识与银行电子U盾的授权凭据的映射关系。
步骤409，业务服务器接收第二终端设备发送的可信应用的删除响应消息，并建立第一终端设备的设备标识与可信应用的授权凭据的映射关系，并向第一终端设备发送可信应用授权凭据。
业务服务器的处理器1011在接收到第二终端设备发送的银行电子U盾的删除响应消息之后，该处理器1011建立第一终端设备的设备标识与银行电子U盾的授权凭据的映射关系，并将授权凭据授权该第一终端设备的银行电子U盾使用，该处理器1011向第一终端设备下发该银行电子U盾的授权凭据，该向第一终端设备下发的授权凭据为业务服务器的处理器1011根据存储器1013中存储给该银行电子U盾对应的授权凭据，生成的新的授权凭据，而不是第二终端设备中的授权凭据。
步骤410，第一终端设备接收业务服务器发送的可信应用的授权凭据。
第一终端设备的处理器1023控制RF电路1021或WiFi模块1022接收业务服务器下发的银行电子U盾的授权凭据，完成业务服务器对第一终端设备的可信应用的授权，从而使得用户自助完成了应用授权凭据的迁移。
为了进一步的加强应用授权凭据迁移过程中的安全性，在业务服务器的处理器1011向删除第二终端设备的设备标识与可信应用的授权凭据的映射关系之前，处理器1011控制通信模块1012向第一终端设备发送第一验证码，该第一验证码可以为第二渠道验证码， 比如短信验证码。该第一验证码在设定时期内有效。用于验证迁入授权凭据和解除授权凭据的用户是否一致。
在第一终端设备接收到业务服务器对可信应用的授权之前，该第一终端设备的处理器1023还可以控制RF电路1021接收业务服务器发送第一验证码，用于提示用户在TEE的TUI中输入其看到的第一验证码，并启动TEE的TUI，使得用户可以输入验证码。处理器1023控制触摸面板10261获取用户输入的第二验证码，并控制RF电路1021将该第二验证码发送给业务服务器，以使业务服务器进行第二授权验证。
业务服务器的处理器1011控制通信模块1012接收上述第二验证码，然后确认该第一二验证码与之前发送的第一验证码是否一致，若一致，则处理器1011确认第二授权验证通过。
可选地，上述第二终端设备为连接有U盾的设备时，需要用户在第二终端设备上登录该U盾所对应的银行的网上银行与该U盾建立连接之后，再进行上述步骤，具体的应用授权凭据迁移的流程已在上述实施例中具体描述，不再赘述。
可选地，上述实施例中的可信应用在迁移授权凭据的过程中，还可能会迁移一些其它非授权数据，此时，第一终端设备的授权凭据迁入请求中还包括该可信应用的数据迁移列表，用来表示需要迁移的数据。业务服务器在收到该迁移列表后，可以按照预设的规则，决定哪些迁移数据需要从第二终端设备中迁移到第一终端设备中，在授权凭据的迁移过程中，一起下发到第一终端设备中。在授权凭据迁移的过程中，其它步骤可见上述实施例，不再赘述。
上述实施例表明，第一终端设备向业务服务器发送可信应用的授权凭据迁入请求，接收用户在可信用户界面中输入的可信应用的第二授权凭证码，第一终端设备向所述业务服务器发送用户输入的第二授权凭证码，用于指示业务服务器进行第一授权验证，第一终端设备接收业务服务器对可信应用的授权，可信应用的授权凭据为业务服务器建立第一终端设备的设备标识与可信应用的授权凭据的映射关系之后授权的。第一终端设备通过在TEE中向业务服务器发送可信应用的授权凭据迁入请求，并进行发送用户输入的第二授权凭证码，使得业务服务器在通过对第一终端设备验证之后建立该第一终端设备的设备标识与可信应用的授权凭据的映射关系，完成可信应用的授权，从而为用户提供自助的应用授权凭据迁移，并提高了应用授权凭据过程中的安全性。
以上是结合图1至图6详细描述了本申请提供的授权凭据迁移的方法的流程，下面结合图7至图9描述本发明实施例提供的终端和管理服务器，上述方法实施例所描述的技术同样适用于以下装置实施例。
图7示出了本申请提供的一种终端设备700，该终端设备700可以执行上述方法实施例中第一终端设备所执行的步骤。
如图7所示，包括：RF单元702、处理单元701和触摸单元703；所述处理单元701，用于控制所述RF单元702向业务服务器发送可信应用的授权凭据迁入请求，所述授权凭据迁入请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据迁入请求包括所述终端设备的设备标识、所述终端设备的安全元件标识、所述可信应用的应用标识和用户的个人信息；所述终端设备为待迁入授权凭据的设备；所述处理单元701，还用于控制所述触摸单元703接收所述用户在可信用户界面中输入的所述可信应用的第二授权凭证码，所述第二授权凭证码为所述用户在查看第二终端设备显示的第一授权凭证码后输 入的；所述处理单元701，还用于控制所述RF单元702向所述业务服务器发送所述用户输入的第二授权凭证码，用于指示所述业务服务器进行第一授权验证；以及控制所述RF单元702接收所述业务服务器发送的所述可信应用的授权凭据，所述可信应用的授权凭据为所述业务服务器建立所述终端设备的设备标识与所述可信应用的授权凭据的映射关系之后发送的。
可选地，所述终端单元700还包括显示单元704；所述处理单元701还用于：在控制所述RF单元702接收所述业务服务器发送的所述可信应用的授权凭据之前，控制所述RF单元702接收所述业务服务器发送的第一验证码并控制所述显示面板在可信用户界面中进行显示；控制所述触摸单元703接收所述用户在可信用户界面中输入的第二验证码，控制所述RF单元702向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
图8示出了本申请提供的一种终端设备800，该终端设备800可以执行上述方法实施例中第二终端设备所执行的步骤。
如图8所示，包括：RF单元802、处理单元801和显示单元803；所述处理单元801，用于将可信应用的第一数据进行签名；所述可信应用的第一数据包括终端设备的设备标识、终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述终端设备为待解除授权凭据的设备；所述处理单元801，还用于控制所述RF单元802向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据解除中包括所述签名后的可信应用的第一数据；控制所述RF单元802接收所述业务服务器发送的所述可信应用的第一授权凭证码并控制所述显示单元803在可信用户界面中进行显示；控制所述RF单元802接收所述业务服务器发送的所述可信应用的删除请求，并将所述可信应用删除；控制所述RF单元802向所述业务服务器发送所述可信应用的删除响应消息。
图9示出了本申请提供的一种业务服务器900，该业务服务器900可以执行上述方法实施例中的业务服务器所执行的步骤。
如图9所示，该业务服务器包括：处理单元901和通信单元902；所述处理单元901，用于控制所述通信单元902接收第二终端设备发送的可信应用的授权凭据解除请求；所述授权凭据解除请求包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述处理单元901，还用于确认身份验证通过，生成第一授权凭证码，并控制所述通信单元902向所述第二终端设备发送所述第一授权凭证码；控制所述通信单元902接收第一终端设备发送的第二授权凭证码，并在确认第一授权验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系，控制所述通信单元902向第二终端设备发送所述可信应用的删除请求；控制所述通信单元902接收所述第二终端设备发送的所述可信应用的删除响应消息，并建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并控制所述通信单元902向所述第一终端设备发送所述可信应用的授权凭据。
可选地，所述处理单元901具体用于：确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则确认所述身份验证通过。
可选地，所述处理单元901具体用于：根据所述授权凭据解除请求中的所述用户的个 人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
可选地，所述处理单元901具体用于：确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则确认所述第一授权验证通过。
可选地，所述处理单元901还用于：在删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系之前，控制所述通信单元902向所述第一终端设备发送第一验证码；控制所述通信单元902接收所述第一终端设备发送的第二验证码；根据所述第一验证码和所述第二验证码，确认第二授权验证通过。
可选地，所述处理单元901具体用于：确认所述第一验证码和所述第二验证码是否一致，若是，则确认所述第二授权验证通过。
本领域内的技术人员应明白，本申请可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (45)

  1. 一种授权凭据迁移的方法，其特征在于，包括：
    第一终端设备向业务服务器发送可信应用的授权凭据迁入请求，所述授权凭据迁入请求是所述第一终端设备在可信执行环境中使用安全通道发送的；所述授权凭据迁入请求包括所述第一终端设备的设备标识、所述第一终端设备的安全元件标识、所述可信应用的应用标识和用户的个人信息；所述第一终端设备为待迁入授权凭据的设备；
    所述第一终端设备接收所述用户在可信用户界面中输入的所述可信应用的第二授权凭证码，所述第二授权凭证码为所述用户在查看第二终端设备显示的第一授权凭证码后输入的；
    所述第一终端设备向所述业务服务器发送所述用户输入的第二授权凭证码，用于指示所述业务服务器进行第一授权验证；
    所述第一终端设备接收所述业务服务器发送的所述可信应用的授权凭据，所述可信应用的授权凭据为所述业务服务器建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系之后发送的。
  2. 如权利要求1所述的方法，其特征在于，在所述第一终端设备接收所述业务服务器发送的所述可信应用的授权凭据之前，还包括：
    所述第一终端设备接收所述业务服务器发送的第一验证码并在可信用户界面中进行显示；
    所述第一终端设备接收所述用户在可信用户界面中输入的第二验证码；
    所述第一终端设备向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
  3. 一种授权凭据迁移的方法，其特征在于，包括：
    第二终端设备将可信应用的第一数据进行签名；所述可信应用的第一数据包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述第二终端设备为待解除授权凭据的设备；
    所述第二终端设备向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除请求是所述第二终端设备在可信执行环境中使用安全通道发送的；所述授权凭据解除中包括所述签名后的可信应用的第一数据；
    所述第二终端设备接收所述业务服务器发送的所述可信应用的第一授权凭证码并在可信用户界面中进行显示；
    所述第二终端设备接收所述业务服务器发送的所述可信应用的删除请求，并将所述可信应用删除；
    所述第二终端设备向所述业务服务器发送所述可信应用的删除响应消息。
  4. 一种授权凭据迁移的方法，其特征在于，包括：
    业务服务器接收第二终端设备发送的可信应用的授权凭据解除请求；所述授权凭据解除请求包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；
    所述业务服务器确认身份验证通过，生成第一授权凭证码，并向所述第二终端设备发送所述第一授权凭证码；
    所述业务服务器接收第一终端设备发送的第二授权凭证码，并在确认第一授权验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系，向第二终端设备发送所述可信应用的删除请求；
    所述业务服务器接收所述第二终端设备发送的所述可信应用的删除响应消息，并建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并向所述第一终端设备发送所述可信应用的授权凭据。
  5. 如权利要求4所述的方法，其特征在于，所述业务服务器确认身份验证通过，包括：
    所述业务服务器确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则所述业务服务器确认所述身份验证通过。
  6. 如权利要求4所述的方法，其特征在于，所述业务服务器生成第一授权凭证码，包括：
    所述业务服务器根据所述授权凭据解除请求中的所述用户的个人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；
    所述业务服务器根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
  7. 如权利要求4所述的方法，其特征在于，所述业务服务器确认第一授权验证通过，包括：
    所述业务服务器确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则所述业务服务器确认所述第一授权验证通过。
  8. 如权利要求4所述的方法，其特征在于，在所述业务服务器删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系之前，还包括：
    所述业务服务器向所述第一终端设备发送第一验证码；
    所述业务服务器接收所述第一终端设备发送的第二验证码；
    所述业务服务器根据所述第一验证码和所述第二验证码，确认第二授权验证通过。
  9. 如权利要求8所述的方法，其特征在于，所述业务服务器确认所述第二授权验证通过，包括：
    所述业务服务器确认所述第一验证码和所述第二验证码是否一致，若是，则所述业务服务器确认所述第二授权验证通过。
  10. 一种终端设备，其特征在于，包括：射频RF电路、处理器和触摸面板；
    所述处理器，用于控制所述RF电路向业务服务器发送可信应用的授权凭据迁入请求，所述授权凭据迁入请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据迁入请求包括所述终端设备的设备标识、所述终端设备的安全元件标识、所述可信应用的应用标识和用户的个人信息；所述终端设备为待迁入授权凭据的设备；
    所述处理器，还用于控制所述触摸面板接收所述用户在可信用户界面中输入的所述可信应用的第二授权凭证码，所述第二授权凭证码为所述用户在查看第二终端设备显示的第一授权凭证码后输入的；
    所述处理器，还用于控制所述RF电路向所述业务服务器发送所述用户输入的第二授权凭证码，用于指示所述业务服务器进行第一授权验证；以及控制所述RF电路接收所述 业务服务器发送的所述可信应用的授权凭据，所述可信应用的授权凭据为所述业务服务器建立所述终端设备的设备标识与所述可信应用的授权凭据的映射关系之后发送的。
  11. 如权利要求10所述的终端设备，其特征在于，所述终端设备还包括显示面板；
    所述处理器还用于：
    在控制所述RF电路接收所述业务服务器发送的所述可信应用的授权凭据之前，控制所述RF电路接收所述业务服务器发送的第一验证码并控制所述显示面板在可信用户界面中进行显示；
    控制所述触摸面板接收所述用户在可信用户界面中输入的第二验证码；
    控制所述RF电路向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
  12. 一种终端设备，其特征在于，包括：射频RF电路、处理器和显示面板；
    所述处理器，用于将可信应用的第一数据进行签名；所述可信应用的第一数据包括终端设备的设备标识、终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述终端设备为待解除授权凭据的设备；
    所述处理器，还用于控制所述RF电路向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据解除中包括所述签名后的可信应用的第一数据；控制所述RF电路接收所述业务服务器发送的所述可信应用的第一授权凭证码并控制所述显示面板在可信用户界面中进行显示；控制所述RF电路接收所述业务服务器发送的所述可信应用的删除请求，并将所述可信应用删除；控制所述RF电路向所述业务服务器发送所述可信应用的删除响应消息。
  13. 一种业务服务器，其特征在于，包括：处理器和通信模块；
    所述处理器，用于控制所述通信模块接收第二终端设备发送的可信应用的授权凭据解除请求；所述授权凭据解除请求包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；
    所述处理器，还用于确认身份验证通过，生成第一授权凭证码，并控制所述通信模块向所述第二终端设备发送所述第一授权凭证码；控制所述通信模块接收第一终端设备发送的第二授权凭证码，并在确认第一授权验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系，控制所述通信模块向第二终端设备发送所述可信应用的删除请求；控制所述通信模块接收所述第二终端设备发送的所述可信应用的删除响应消息，并建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并控制所述通信模块向所述第一终端设备发送所述可信应用的授权凭据。
  14. 如权利要求13所述的业务服务器，其特征在于，所述处理器具体用于：
    确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则确认所述身份验证通过。
  15. 如权利要求13所述的业务服务器，其特征在于，所述处理器具体用于：
    根据所述授权凭据解除请求中的所述用户的个人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；
    根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
  16. 如权利要求13所述的业务服务器，其特征在于，所述处理器具体用于：
    确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则确认所述第一授权验证通过。
  17. 如权利要求13所述的业务服务器，其特征在于，所述处理器还用于：
    在删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系之前，控制所述通信模块向所述第一终端设备发送第一验证码；
    控制所述通信模块接收所述第一终端设备发送的第二验证码；
    根据所述第一验证码和所述第二验证码，确认第二授权验证通过。
  18. 如权利要求17所述的方法，其特征在于，所述处理器具体用于：
    确认所述第一验证码和所述第二验证码是否一致，若是，则确认所述第二授权验证通过。
  19. 一种终端设备，其特征在于，包括：射频RF单元、处理单元和触摸单元；
    所述处理单元，用于控制所述RF单元向业务服务器发送可信应用的授权凭据迁入请求，所述授权凭据迁入请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据迁入请求包括所述终端设备的设备标识、所述终端设备的安全元件标识、所述可信应用的应用标识和用户的个人信息；所述终端设备为待迁入授权凭据的设备；
    所述处理单元，还用于控制所述触摸单元接收所述用户在可信用户界面中输入的所述可信应用的第二授权凭证码，所述第二授权凭证码为所述用户在查看第二终端设备显示的第一授权凭证码后输入的；
    所述处理单元，还用于控制所述RF单元向所述业务服务器发送所述用户输入的第二授权凭证码，用于指示所述业务服务器进行第一授权验证；以及控制所述RF电路接收所述业务服务器发送的所述可信应用的授权凭据，所述可信应用的授权凭据为所述业务服务器建立所述终端设备的设备标识与所述可信应用的授权凭据的映射关系之后发送的。
  20. 如权利要求19所述的终端设备，其特征在于，所述终端设备还包括显示单元；
    所述处理单元还用于：
    在控制所述RF单元接收所述业务服务器发送的所述可信应用的授权凭据之前，控制所述RF单元接收所述业务服务器发送的第一验证码并控制所述显示面板在可信用户界面中进行显示；
    控制所述触摸单元接收所述用户在可信用户界面中输入的第二验证码；
    控制所述RF单元向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
  21. 一种终端设备，其特征在于，包括：射频RF单元、处理单元和显示单元；
    所述处理单元，用于将可信应用的第一数据进行签名；所述可信应用的第一数据包括终端设备的设备标识、终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；所述终端设备为待解除授权凭据的设备；
    所述处理单元，还用于控制所述RF单元向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除请求是所述终端设备在可信执行环境中使用安全通道发送的；所述授权凭据解除中包括所述签名后的可信应用的第一数据；控制所述RF单元接收所述业务服务器发送的所述可信应用的第一授权凭证码并控制所述显示面板在可信用户界面中进行显示；控制所述RF单元接收所述业务服务器发送的所述可信应用的删除请求，并将 所述可信应用删除；控制所述RF单元向所述业务服务器发送所述可信应用的删除响应消息。
  22. 一种业务服务器，其特征在于，包括：处理单元和通信单元；
    所述处理单元，用于控制所述通信单元接收第二终端设备发送的可信应用的授权凭据解除请求；所述授权凭据解除请求包括第二终端设备的设备标识、第二终端设备的安全元件标识、可信应用的应用标识和用户的个人信息；
    所述处理单元，还用于确认身份验证通过，生成第一授权凭证码，并控制所述通信单元向所述第二终端设备发送所述第一授权凭证码；控制所述通信单元接收第一终端设备发送的第二授权凭证码，并在确认第一授权验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系，控制所述通信单元向第二终端设备发送所述可信应用的删除请求；控制所述通信单元接收所述第二终端设备发送的所述可信应用的删除响应消息，并建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并控制所述通信单元向所述第一终端设备发送所述可信应用的授权凭据。
  23. 如权利要求22所述的业务服务器，其特征在于，所述处理单元具体用于：
    确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则确认所述身份验证通过。
  24. 如权利要求22所述的业务服务器，其特征在于，所述处理单元具体用于：
    根据所述授权凭据解除请求中的所述用户的个人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；
    根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
  25. 如权利要求22所述的业务服务器，其特征在于，所述处理单元具体用于：
    确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则确认所述第一授权验证通过。
  26. 如权利要求22所述的业务服务器，其特征在于，所述处理单元还用于：
    在删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系之前，控制所述通信模块向所述第一终端设备发送第一验证码；
    控制所述通信单元接收所述第一终端设备发送的第二验证码；
    根据所述第一验证码和所述第二验证码，确认第二授权验证通过。
  27. 如权利要求26所述的业务服务器，其特征在于，所述处理单元具体用于：
    确认所述第一验证码和所述第二验证码是否一致，若是，则确认所述第二授权验证通过。
  28. 一种授权凭据迁移的方法，其特征在于，包括：
    第一终端设备向业务服务器发送可信应用的授权凭据迁入请求；
    所述第一终端设备接收输入的所述可信应用的第二授权凭证码，所述第二授权凭证码与第二终端设备显示的第一授权凭证码一致；
    所述第一终端设备向所述业务服务器发送所述第二授权凭证码，用于指示所述业务服务器进行授权验证；
    所述第一终端设备接收所述业务服务器发送的所述可信应用的授权凭据。
  29. 如权利要求28所述的方法，其特征在于，在所述第一终端设备接收所述业务服务器发送的所述可信应用的授权凭据之前，还包括：
    所述第一终端设备接收所述业务服务器发送的第一验证码并在可信用户界面中进行显示；
    所述第一终端设备接收所述用户在可信用户界面中输入的第二验证码；
    所述第一终端设备向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
  30. 一种授权凭据迁移的方法，其特征在于，包括：
    第二终端设备将可信应用的第一数据进行签名；所述第二终端设备为待解除授权凭据的设备；
    所述第二终端设备向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除中包括所述签名后的可信应用的第一数据；
    所述第二终端设备接收所述业务服务器发送的所述可信应用的第一授权凭证码并在可信用户界面中进行显示。
  31. 一种授权凭据迁移的方法，其特征在于，包括：
    业务服务器接收第二终端设备发送的可信应用的授权凭据解除请求；
    所述业务服务器确认身份验证通过，生成第一授权凭证码，并向所述第二终端设备发送所述第一授权凭证码；
    所述业务服务器接收第一终端设备发送的第二授权凭证码，并在对所述第二授权凭证码验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系；
    所述业务服务器建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并向所述第一终端设备发送所述可信应用的授权凭据。
  32. 如权利要求31所述的方法，其特征在于，所述授权凭据解除请求包括所述第二终端的设备标识、第二终端设备的安全元件标识；
    所述业务服务器确认身份验证通过，包括：
    所述业务服务器确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则所述业务服务器确认所述身份验证通过。
  33. 如权利要求31所述的方法，其特征在于，所述授权凭据解除请求包括用户的个人信息；
    所述业务服务器生成第一授权凭证码，包括：
    所述业务服务器根据所述用户的个人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；
    所述业务服务器根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
  34. 如权利要求31所述的方法，其特征在于，所述业务服务器对所述第二授权凭证码验证通过，包括：
    所述业务服务器确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则所述业务服务器对所述第二授权凭证码验证通过。
  35. 如权利要求31所述的方法，其特征在于，在所述业务服务器删除所述第二终端 设备的设备标识与所述可信应用的授权凭据的映射关系之前，还包括：
    所述业务服务器向所述第一终端设备发送第一验证码；
    所述业务服务器接收所述第一终端设备发送的第二验证码；
    所述业务服务器对所述第二验证码验证通过。
  36. 如权利要求35所述的方法，其特征在于，所述业务服务器对所述第二验证码验证通过，包括：
    所述业务服务器确认所述第一验证码和所述第二验证码是否一致，若是，则所述业务服务器对所述第二验证码验证通过。
  37. 一种终端设备，其特征在于，包括：射频RF单元、处理单元和触摸单元；
    所述处理单元，用于控制所述RF单元向业务服务器发送可信应用的授权凭据迁入请求；
    所述处理单元，还用于控制所述触摸单元接收输入的所述可信应用的第二授权凭证码，所述第二授权凭证码与第二终端设备显示的第一授权凭证码一致；
    所述处理单元，还用于控制所述RF单元向所述业务服务器发送所述第二授权凭证码，用于指示所述业务服务器进行授权验证；以及控制所述RF电路接收所述业务服务器发送的所述可信应用的授权凭据。
  38. 如权利要求37所述的终端设备，其特征在于，所述终端设备还包括显示单元；
    所述处理单元还用于：
    在控制所述RF单元接收所述业务服务器发送的所述可信应用的授权凭据之前，控制所述RF单元接收所述业务服务器发送的第一验证码并控制所述显示面板在可信用户界面中进行显示；
    控制所述触摸单元接收所述用户在可信用户界面中输入的第二验证码；
    控制所述RF单元向所述业务服务器发送所述用户输入的第二验证码，用于指示所述业务服务器进行第二授权验证。
  39. 一种终端设备，其特征在于，包括：射频RF单元、处理单元和显示单元；
    所述处理单元，用于将可信应用的第一数据进行签名；所述终端设备为待解除授权凭据的设备；
    所述处理单元，还用于控制所述RF单元向业务服务器发送可信应用的授权凭据解除请求，所述授权凭据解除中包括所述签名后的可信应用的第一数据；控制所述RF单元接收所述业务服务器发送的所述可信应用的第一授权凭证码并控制所述显示面板在可信用户界面中进行显示。
  40. 一种业务服务器，其特征在于，包括：处理单元和通信单元；
    所述处理单元，用于控制所述通信单元接收第二终端设备发送的可信应用的授权凭据解除请求；
    所述处理单元，还用于确认身份验证通过，生成第一授权凭证码，并控制所述通信单元向所述第二终端设备发送所述第一授权凭证码；控制所述通信单元接收第一终端设备发送的第二授权凭证码，并在对所述第二授权凭证码验证通过后删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系；建立所述第一终端设备的设备标识与所述可信应用的授权凭据的映射关系，并控制所述通信单元向所述第一终端设备发送所述可信应用的授权凭据。
  41. 如权利要求40所述的业务服务器，其特征在于，所述授权凭据解除请求包括所述第二终端的设备标识、第二终端设备的安全元件标识；
    所述处理单元具体用于：
    确定所述第二终端设备发送的可信应用的第一数据的签名以及所述可信应用的第一数据中的第二终端设备的设备标识和第二终端设备的安全元件标识是否与已存储的一致，若是，则确认所述身份验证通过。
  42. 如权利要求40所述的业务服务器，其特征在于，所述授权凭据解除请求包括用户的个人信息；
    所述处理单元具体用于：
    根据所述用户的个人信息确定所述用户的个人信息所对应的第一终端设备的授权凭据迁入请求；
    根据所述授权凭据迁入请求中的所述第一终端设备的设备标识和随机数，生成所述第一授权凭证码。
  43. 如权利要求40所述的业务服务器，其特征在于，所述处理单元具体用于：
    确认所述第二授权凭证码和所述第一授权凭证码是否一致，若是，则对所述第二授权凭证码验证通过。
  44. 如权利要求40所述的业务服务器，其特征在于，所述处理单元还用于：
    在删除所述第二终端设备的设备标识与所述可信应用的授权凭据的映射关系之前，控制所述通信模块向所述第一终端设备发送第一验证码；
    控制所述通信单元接收所述第一终端设备发送的第二验证码；
    对所述第二验证码验证通过。
  45. 如权利要求41所述的业务服务器，其特征在于，所述处理单元具体用于：
    确认所述第一验证码和所述第二验证码是否一致，若是，则对所述第二验证码验证通过。
PCT/CN2017/071189 2017-01-13 2017-01-13 一种授权凭据迁移的方法、终端设备及业务服务器 WO2018129726A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
US16/476,988 US11405383B2 (en) 2017-01-13 2017-01-13 Authorization credential migration method, terminal device, and service server
EP17891369.5A EP3557835B1 (en) 2017-01-13 2017-01-13 Authorization credential migration method, terminal device and service server
PCT/CN2017/071189 WO2018129726A1 (zh) 2017-01-13 2017-01-13 一种授权凭据迁移的方法、终端设备及业务服务器
CN201780009044.2A CN108702357B (zh) 2017-01-13 2017-01-13 一种授权凭据迁移的方法、终端设备及业务服务器

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/071189 WO2018129726A1 (zh) 2017-01-13 2017-01-13 一种授权凭据迁移的方法、终端设备及业务服务器

Publications (1)

Publication Number Publication Date
WO2018129726A1 true WO2018129726A1 (zh) 2018-07-19

Family

ID=62839242

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/071189 WO2018129726A1 (zh) 2017-01-13 2017-01-13 一种授权凭据迁移的方法、终端设备及业务服务器

Country Status (4)

Country Link
US (1) US11405383B2 (zh)
EP (1) EP3557835B1 (zh)
CN (1) CN108702357B (zh)
WO (1) WO2018129726A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110399714A (zh) * 2019-04-10 2019-11-01 中国银联股份有限公司 用于验证终端的可信用户界面真实性的方法及其系统
CN110855426A (zh) * 2019-11-08 2020-02-28 北京握奇智能科技有限公司 一种用于软件使用授权的方法
CN117056976A (zh) * 2023-08-22 2023-11-14 哈尔滨商业大学 一种财务数据处理方法、装置及系统

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11055721B2 (en) * 2013-10-30 2021-07-06 Tencent Technology (Shenzhen) Company Limited Method, device and system for information verification
CN111191213B (zh) * 2018-11-14 2023-11-10 华为终端有限公司 一种删除安全业务的方法及电子设备
US10389708B1 (en) * 2019-01-03 2019-08-20 Capital One Services, Llc Secure authentication of a user associated with communication with a service representative
CN113673000B (zh) * 2020-03-25 2024-03-08 支付宝(杭州)信息技术有限公司 Tee中可信程序的操作方法及装置
CN111898101A (zh) * 2020-06-23 2020-11-06 海南新软软件有限公司 一种应用的安全设备验证方法及装置
WO2022119387A1 (en) * 2020-12-03 2022-06-09 Samsung Electronics Co., Ltd. Method, electronic device and server for performing user authentication
CN113268742B (zh) * 2021-04-07 2022-05-24 支付宝(杭州)信息技术有限公司 数据授权方法、装置及电子设备
CN116631071A (zh) * 2023-07-19 2023-08-22 倍施特科技(集团)股份有限公司 一种票务用多模式自助终端控制方法及自助终端

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101206741A (zh) * 2006-12-19 2008-06-25 韩国虚拟支付有限公司 移动安全结账处理系统及方法
CN101212291A (zh) * 2006-12-28 2008-07-02 中国移动通信集团公司 数字证书分发方法及服务器
US20140099933A1 (en) * 2012-10-08 2014-04-10 Apple Inc. Network access credential migration
CN104038477A (zh) * 2014-05-19 2014-09-10 杨尧任 基于服务网络系统的文件传送方法
CN104603743A (zh) * 2012-06-27 2015-05-06 J2全球有限公司 促进网络登录

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE7920475U1 (de) * 1979-07-18 1979-11-08 P.A. Rentrop, Hubbert & Wagner Fahrzeugaustattungen Gmbh & Co Kg, 3060 Stadthagen Hoehenverstellbare kopfstuetze eines kraftfahrzeugsitzes
US7496768B2 (en) * 2003-10-24 2009-02-24 Microsoft Corporation Providing secure input and output to a trusted agent in a system with a high-assurance execution environment
US20120239936A1 (en) * 2009-12-18 2012-09-20 Nokia Corporation Credential transfer
US9258296B2 (en) * 2010-07-29 2016-02-09 Nirmal Juthani System and method for generating a strong multi factor personalized server key from a simple user password
EP2461613A1 (en) * 2010-12-06 2012-06-06 Gemalto SA Methods and system for handling UICC data
US8621168B2 (en) * 2010-12-17 2013-12-31 Google Inc. Partitioning the namespace of a contactless smart card
EP2941697A1 (de) * 2013-01-03 2015-11-11 Giesecke & Devrient GmbH Verfahren zum laden einer aus mehreren komponenten bestehenden applikation in ein aus mehreren komponenten bestehenden gerätes
US9537661B2 (en) * 2014-02-28 2017-01-03 Verizon Patent And Licensing Inc. Password-less authentication service
CN105591672A (zh) 2015-04-30 2016-05-18 中国银联股份有限公司 基于nfc的通信方法和装置
US10735436B1 (en) * 2020-02-05 2020-08-04 Cyberark Software Ltd. Dynamic display capture to verify encoded visual codes and network address information

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101206741A (zh) * 2006-12-19 2008-06-25 韩国虚拟支付有限公司 移动安全结账处理系统及方法
CN101212291A (zh) * 2006-12-28 2008-07-02 中国移动通信集团公司 数字证书分发方法及服务器
CN104603743A (zh) * 2012-06-27 2015-05-06 J2全球有限公司 促进网络登录
US20140099933A1 (en) * 2012-10-08 2014-04-10 Apple Inc. Network access credential migration
CN104038477A (zh) * 2014-05-19 2014-09-10 杨尧任 基于服务网络系统的文件传送方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3557835A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110399714A (zh) * 2019-04-10 2019-11-01 中国银联股份有限公司 用于验证终端的可信用户界面真实性的方法及其系统
CN110399714B (zh) * 2019-04-10 2023-08-08 中国银联股份有限公司 用于验证终端的可信用户界面真实性的方法及其系统
CN110855426A (zh) * 2019-11-08 2020-02-28 北京握奇智能科技有限公司 一种用于软件使用授权的方法
CN110855426B (zh) * 2019-11-08 2023-04-18 北京握奇智能科技有限公司 一种用于软件使用授权的方法
CN117056976A (zh) * 2023-08-22 2023-11-14 哈尔滨商业大学 一种财务数据处理方法、装置及系统
CN117056976B (zh) * 2023-08-22 2024-03-08 哈尔滨商业大学 一种财务数据处理方法、装置及系统

Also Published As

Publication number Publication date
EP3557835A4 (en) 2019-12-11
CN108702357A (zh) 2018-10-23
EP3557835B1 (en) 2021-09-01
CN108702357B (zh) 2021-01-05
US11405383B2 (en) 2022-08-02
EP3557835A1 (en) 2019-10-23
US20190356653A1 (en) 2019-11-21

Similar Documents

Publication Publication Date Title
WO2018129726A1 (zh) 一种授权凭据迁移的方法、终端设备及业务服务器
CN109600223B (zh) 验证方法、激活方法、装置、设备及存储介质
EP3704613B1 (en) Provisioning trusted execution environment(s) based on chain of trust including platform
US11341498B2 (en) Method and device for end-user verification of an electronic transaction
US20210336780A1 (en) Key updating method, apparatus, and system
US10097350B2 (en) Privacy enhanced key management for a web service provider using a converged security engine
EP3235216B1 (en) Security and permission architecture in a multi-tenant computing system
US11488234B2 (en) Method, apparatus, and system for processing order information
CN111066284B (zh) 一种业务证书管理方法、终端及服务器
WO2017084288A1 (zh) 身份验证方法及装置
EP3704614B1 (en) Provisioning trusted execution environment based on chain of trust including platform
US20160301530A1 (en) Sensitive operation verification method, apparatus, and system
CN107451813B (zh) 支付方法、支付设备和支付服务器
WO2017113119A1 (zh) 一种关联应用程序和生物特征的方法、装置以及移动终端
CN110795737A (zh) 对电子身份证的业务适用范围进行升级的方法和终端设备
CN115001841A (zh) 一种身份认证方法、装置及存储介质
TW201826158A (zh) 顯示資料的方法、裝置和終端
CN108737341B (zh) 业务处理方法、终端及服务器
KR20170073843A (ko) 보안실행환경 온라인본인확인 시스템 및 방법
CN103971057A (zh) 一种移动通信智能终端的可信路径实现方法及系统
CN117240475A (zh) 一种智能门锁的通信方法、系统、设备及介质
EP3093790A1 (en) Method for real time protection against unsolicited access to authentication information known by a legitimate end-user

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17891369

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017891369

Country of ref document: EP

Effective date: 20190715