WO2019170111A1 - 一种离线管理指令的管理方法和终端 - Google Patents

一种离线管理指令的管理方法和终端 Download PDF

Info

Publication number
WO2019170111A1
WO2019170111A1 PCT/CN2019/077219 CN2019077219W WO2019170111A1 WO 2019170111 A1 WO2019170111 A1 WO 2019170111A1 CN 2019077219 W CN2019077219 W CN 2019077219W WO 2019170111 A1 WO2019170111 A1 WO 2019170111A1
Authority
WO
WIPO (PCT)
Prior art keywords
offline
tee
management
instruction
identifier
Prior art date
Application number
PCT/CN2019/077219
Other languages
English (en)
French (fr)
Inventor
王思善
孙赫
莱蒂宁佩卡
常新苗
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19764790.2A priority Critical patent/EP3737129B1/en
Publication of WO2019170111A1 publication Critical patent/WO2019170111A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment

Definitions

  • the present invention relates to the field of security management, and in particular, to a method and a terminal for managing offline management instructions.
  • REE common execution environment
  • TEE trusted execution environment
  • TEE management framework the International Platform (GP) has released a standard for implementing TEE remote management, which defines the TEE internal security domain (SD)/ Trusted application (TA) management framework and management authority, management instruction data structure, verification and execution requirements.
  • SD TEE internal security domain
  • TA Trusted application
  • the management instructions defined in the TMF are all executed after the authorization is verified.
  • the instruction can be generated to restrict the use of the authorization token by using the constraint parameter.
  • the condition, but the constraint parameter can only solve the authorization verification problem of the offline management instruction in the offline scenario, and cannot prevent the application from using the legitimate offline management instruction to maliciously occupy the TEE resource.
  • the malicious application can use the offline offline installation of TA1, TA2, ...
  • the present invention provides a method and a terminal for managing an offline management command.
  • the TEE of the terminal generates an offline management command according to the offline management parameter carried in the offline management command, and installs or updates the SD or TA according to the offline management policy according to the offline management policy.
  • Management allows TEE to have the ability to proactively defend applications using malicious offline management commands to maliciously occupy TEE resources.
  • a method for managing an offline management instruction may include:
  • the trusted execution environment TEE of the terminal receives an offline management instruction sent by the rich execution environment REE of the terminal, the offline management instruction includes an offline management parameter, and the offline management parameter includes at least one of a usage duration threshold and a usage threshold;
  • the TEE performs an offline management operation corresponding to the offline management instruction, and generates an offline management policy according to the offline management parameter;
  • the TEE deletes the SD or the TA, or the TEE restores the SD or the TA to the pre-update state; wherein the SD or the TA is determined by the TEE according to the offline management command. Installed offline or updated.
  • the TEE of the terminal Based on the provided offline management command management method, the TEE of the terminal generates an offline management policy according to the offline management parameters carried in the offline management command, and determines whether the SD or TA installed or updated according to the offline management instruction is malicious according to the offline management policy.
  • the TEE resource is occupied to make the TEE of the terminal have active defense capability.
  • the offline management instruction includes an offline installation SD instruction or an offline update SD instruction, and the offline management policy is received within a usage threshold or a usage duration threshold. Install the TA command offline.
  • the offline management instruction includes an offline installation TA instruction or an offline update TA instruction
  • the offline management policy is preset within the usage threshold or the usage duration threshold. operating.
  • Management methods in combination with the first aspect, or the first or second possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, before the TEE performs an offline management operation corresponding to the offline management instruction, Management methods also include:
  • the TEE determines whether the identification information of the offline management instruction is included in the first information saved by the TEE, and the first information includes the identification information of the offline management instruction that the TEE refuses to execute.
  • the management method further includes:
  • the TEE adds the identification information of the offline management command to the first information.
  • the identification information includes an identifier of an offline management instruction, a summary of an offline management instruction, and an offline management instruction At least one of an SD identifier or a TA identifier to be managed offline.
  • the TEE performs an offline management operation corresponding to the offline management instruction, including:
  • TEE enhances TEE security by installing TAs offline or offline updating TAs in a preset SD according to offline management instructions.
  • the management method further includes:
  • the TEE updates the association information and marks the SD or the TA as an offline state.
  • the association information includes the correspondence between the SD installed in the TEE and the TA installed in the SD installed in the TEE.
  • the management method further includes:
  • the TEE releases the restriction on the SD or the TA based on the offline management policy.
  • the TEE releases the limitation of the SD or the TA based on the offline management policy, including:
  • the TEE deletes the offline management policy; or the TEE cancels the mark that the SD or the TA is offline; or the TEE modifies the lifecycle state corresponding to the SD or the TA to the executable state.
  • the offline management instruction further includes a target SD logo; the management method also includes:
  • the TEE migrates the TA from the preset SD to the target SD corresponding to the target SD identifier, and deletes the correspondence between the preset SD and the TA in the associated information.
  • the TEE limits the resource access rights of the SD or TA.
  • the management method further include:
  • the TEE displays the first prompt information on the interface of the terminal according to the usage state of the SD.
  • the TEE displays the second prompt information on the interface of the terminal according to the usage state of the TA.
  • the offline management instruction is further The at least one first client application CA identifier is included, and the at least one first CA identifier is an identifier corresponding to the at least one first CA that is authorized to use the offline management instruction; and the trusted execution environment TEE of the terminal receives the rich execution environment REE sent by the terminal.
  • Offline management instructions including:
  • the TEE receives an offline management command sent by the second CA in the REE;
  • the management method further includes:
  • the TEE When the second CA identifier corresponding to the second CA is consistent with any one of the at least one first CA identifier, the TEE performs an offline management operation corresponding to the offline management instruction.
  • the offline management command carries the user CA identifier, and the CA that does not have the usage authority is restricted from obtaining the legal offline management instruction to maliciously occupy the TEE resource.
  • the offline management instruction is an offline deletion instruction; and the TEE determines that the second CA identifier corresponding to the second CA is consistent with any one of the at least one first CA identifier.
  • the management method further includes:
  • the TEE When the first CA corresponding to the at least one first CA identifier except the second CA in the REE does not exist, the TEE performs an offline management operation corresponding to the offline management instruction.
  • the offline management instruction further includes indication information, where the indication information is used to indicate that the synchronous deletion TA is located SD;
  • TEE deletes the TA, including:
  • the TEE When there is no associated TA in the SD where the TA is located, the TEE deletes the TA and the SD where the TA is located.
  • the offline management instruction includes an offline installation TA instruction; performing the After the offline management operation corresponding to the offline management instruction, the following includes:
  • the TEE deletes the TA
  • At least one third CA is a TEE that acquires and records at least one third CA identifier by offline installation of the TA command from the offline installation of the TA or at least one third CA identifier corresponding to at least one third CA identifier.
  • the third CA is a CA that needs to use the TA; wherein the offline installation TA instruction includes at least one first CA identifier, and the at least one first CA identifier is at least one first CA corresponding to being authorized to use the offline installation TA command.
  • Identification; at least one third CA includes at least one first CA identifier.
  • a terminal comprising a trusted execution environment TEE and a rich execution environment REE; the TEE comprising a receiving unit, a transmitting unit and a processing unit.
  • the terminal may perform the method of the first aspect or any of the possible implementations of the first aspect.
  • a terminal comprising a TEE and a rich execution environment REE, the TEE comprising a receiver, a transmitter, a memory and a processor, the receiver, the transmitter, the memory and the processor being connected to each other.
  • the terminal may perform the method of the first aspect or any of the possible implementations of the first aspect.
  • a computer readable storage medium comprising instructions, when executed on a device, causing the device to perform the method of the first aspect or any of the possible implementations of the first aspect.
  • a computer program product or computer program comprising instructions, when executed on a computer, causes the computer to perform the method of the first aspect or any of the possible implementations of the first aspect.
  • a communication apparatus comprising a processor configured to support a method in which the communication apparatus performs the first aspect or any of the possible implementations of the first aspect.
  • the TEE of the terminal Based on the management method and the terminal for providing an offline management command, the TEE of the terminal generates an offline management policy according to the offline management parameter carried in the offline management command, and determines whether the SD or TA installed or updated according to the offline management command is determined according to the offline management policy.
  • the TEE of the terminal has the capability of active defense replay and DoS attack.
  • FIG. 1 is a schematic diagram of a method for deploying offline management instructions according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an offline management method according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a method for managing an offline management instruction according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart diagram of another method for managing offline management instructions according to an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of an internal structure of a TEE according to an embodiment of the present invention.
  • FIG. 6 is a schematic flowchart diagram of another offline management instruction management method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic flowchart diagram of still another method for managing offline management instructions according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic flowchart of still another method for managing an offline management instruction according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of another terminal according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram of a communication device according to an embodiment of the present invention.
  • the terminal includes two coexisting operating environments: REE and TEE.
  • TEE is an operating environment with specific security features relative to REE.
  • the TEE is a security area that exists in the terminal and is separated from the REE.
  • the specific implementation may be a security mode of the main processor or an auxiliary processor isolated from the main processor.
  • TEE is separated from REE, and CA in REE, ensuring that sensitive data is stored, processed, and protected in a trusted environment.
  • TEE provides a secure execution environment for TA, including integrity verification during execution, secure communication with CA in REE, trusted storage, input and output with external secure terminals, key and encryption algorithm management, time management, etc. .
  • the TEE in order to ensure the security of the TEE, the TEE will perform the corresponding remote management commands sent by the external entity OWE, such as authentication and authorization (Authentication) and authentication (Authorization) authentication.
  • OWE is an entity with TEE management function, usually refers to a Trusted Service Manager (TSM).
  • TSM Trusted Service Manager
  • SD is represented in the TEE as a service provider (SP) and/or OWE in the TEE.
  • SP service provider
  • TEE implements the isolation function between different OWEs through SD.
  • the SD is deployed with a key for establishing a secure channel with an external entity or for authenticating token verification. All administrative operations defined in TMF are performed by SD, and an SD is responsible for managing the sub-SDs and TAs associated with it. In the TMF framework, SD is given different permissions when it is created.
  • SD is classified into SD-A (SD-Authorize), SD-P (SD-Process), and SD-T (SD-Target) according to functions.
  • SD-A is an SD with a token verification function
  • SD-P is an SD that receives and executes instructions for management operations
  • SD-T refers to an implementation object of instructions, such as when an instruction indicates that TA1 is installed in SD1, SD1 is SD-T.
  • the SD-A information is in the token, and the SD-P information is related to the transport layer, the security layer, and the service.
  • the offline management command is encrypted, only the correct SD-P can successfully decrypt.
  • the authentication of the management command authorization can be implicitly verified by establishing a secure channel with the OWE that generates the command through the security layer protocol specified by the TMF. After the verification is passed, If the SD has the authority corresponding to the management instruction, the SD performs the corresponding management operation. Alternatively, if the management instruction carries the authorization token, and the verification SD (SD-A) indicated in the authorization token is the superior SD of the SD-P, the authentication token is verified using the verification key in the superior SD, and the verification is performed. After the SD-A has the corresponding management authority, the SD-P completes the explicit verification of the authorization of the management instruction and performs the corresponding management operation.
  • SD-P completes the explicit verification of the authorization of the management instruction and performs the corresponding management operation.
  • the offline management command is explicitly authorized by carrying an authorization token.
  • Explicit authorization using an authorization token does not require the SD to communicate with its administrator OWE using the security layer protocol to establish a real-time secure channel for direct communication. It is only necessary to ensure that a legitimate offline management command with an authorization token is sent to the target SD. It can be verified and executed, so in this case, the offline management mode of TEE can be realized, that is, the TEE can be managed offline by legal offline management instructions without real-time interaction with the SD administrator.
  • Adopting offline management has the following benefits:
  • offline management instructions can be sent to various application management servers, or offline management instructions and CA installation packages can be packaged into application data packages for application in CA APK. In the management server.
  • the application data packet including the offline management instruction is obtained from the application management server, and the offline installation TA command is used to directly install the TA to be used by the CA in the process of installing the CA of the terminal REE; or
  • the application data packet including the offline update TA instruction is directly obtained from the application management server, and the TA is updated by the offline update instruction.
  • the SP does not need to generate a separate TA update command for each device or each TEE, enabling rapid deployment of the TA.
  • the OWE authorization is represented by an authorization token because there is no direct direct communication between the target SD and its administrator OWE.
  • TMF reduces the use of offline management instructions by limiting the use of authorization tokens by adding constraint parameters to the authorization token. For example, the conditions for using offline management instructions can be restricted for device ID, model ID, version information, and other vendor-defined constraints. Because the authorization token is to solve the problem of trust or authorization verification in the offline scenario, the current addition of the constraint parameter in the authorization token cannot prevent the replay, DoS attack problem, and can only be determined by the constraint parameters. To limit the use of management instructions, reduce security risks. TEE does not have the active defense capability for replay and DoS attacks.
  • the token constrain encoding may include the contents of Table 1:
  • Constraint Name ITU-X680 Symbol Constraint Label Octet Identifier Value (ConstraintTag Octet Identifier Vales) Constraint Value
  • Constraint Device [PRIVATE1] UUID 0xc1 UUID
  • Constraint device model [PRIVATE2] UUID 0xc2 UUID
  • ConstraintMinVersion [PRIVATE3] INTEGER 0xc3 Minimum Version (Integer)
  • Constraint Maximum Version (ConstraintMaxVersion) [PRIVATE4] INTEGER 0xc4 Maximum Version (Integer)
  • Constraint Parameter Summary (ConstraintParamsDigest) /0xe0 Summary of Command Parameters for Constraint Parameter Summary
  • the embodiment of the invention provides a method and a terminal for managing an offline management instruction, and the TEE of the terminal has the capability of actively defending against replay and DoS attacks.
  • the offline management parameters are set by the management instruction generator (SP-TSM or OWE), and the offline management instructions generated by the OWE are deployed in the application management server through the two forms of FIG.
  • the terminal obtains an offline management instruction from the application management server, the offline management policy is generated according to the offline management parameter in the offline management instruction, and the SD or TA installed or updated according to the offline management instruction is controlled and activated according to the offline management policy. Identify scenes where offline management instructions may be maliciously used.
  • the offline management parameter may be a time parameter or a number of times parameter, for example, the offline management parameter may be at least one of a usage time threshold and a usage time threshold.
  • Offline management instructions can include installing SD, installing TA, updating SD and updating TA, deleting SD, and deleting TA.
  • Terminals mentioned in the embodiments of the present invention may also be referred to as systems, subscriber units, subscriber stations, mobile stations, mobile stations, remote stations, remote terminals, mobile devices, user terminals, mobile terminals, wireless communication devices, User agent, user equipment or user equipment (UE).
  • the terminal can be a cellular phone, a cordless phone, a smart watch, a wearable device, a tablet device, a drone, a vending machine, a sensor device, a session initiation protocol (SIP) phone, a wireless local loop (wireless local Loop, WLL) station, personal digital assistant (PDA), handheld device with wireless communication capabilities, computing device, in-vehicle communication module, smart meter, smart home device or other processing device connected to the wireless modem.
  • SIP session initiation protocol
  • WLL wireless local Loop
  • PDA personal digital assistant
  • FIG. 3 is a schematic flowchart diagram of a method for managing an offline management instruction according to an embodiment of the present invention. As shown in FIG. 3, the management method may include the following steps:
  • the TEE receives an offline management command sent by the REE.
  • the REE of the terminal After obtaining the offline management command from the application server, the REE of the terminal establishes a session with the TEE through the Client API or other communication mode, and sends an offline management instruction to the TEE.
  • the offline management instruction may include, but is not limited to, installing the SD, installing the TA, updating the SD, updating the TA, deleting the SD, and deleting the TA.
  • the offline management instruction includes an offline management parameter, which may be included in a field in the offline management instruction, the field may be an extension field of an existing offline management instruction; or may be an extension field of the authorization token token .
  • the offline management parameter may include at least one of a usage duration threshold and a usage threshold.
  • the TEE performs an offline management operation corresponding to the offline management instruction, and generates an offline management policy according to the offline management parameter.
  • the TEE after receiving the offline management command sent by the REE, the TEE performs integrity, offline authorization verification, and other necessary instruction use condition determinations on the offline management instruction. For example, if the offline management command is to install the TA command offline, the TEE will perform the integrity and offline authorization verification on the offline installation TA command, and then determine whether the TA to be installed already exists in the TEE, and whether the TEE has enough space to install the TA, verifying the legality of the Universal Unique Identifier (UUID). Among them, the UUID is used to identify SD and TA, and the UUID can be constructed using the RFC 4122 standard.
  • UUID Universal Unique Identifier
  • the terminal acquires an offline management instruction, and determines whether to execute the offline management instruction.
  • the offline management command is an offline installation TA command
  • the terminal can determine whether to execute the offline installation TA command in two ways: 1.
  • the REE confirms whether the TA exists through the query interface provided by the TEE, and further determines whether to execute the offline installation TA command; 2.
  • the REE sends the offline installation TA command to the TEE, and the TEE determines whether to execute the offline installation TA command according to the associated information.
  • the process of determining whether to execute the offline installation TA command by the REE through the query interface provided by the TEE may be specifically: first determining whether the TA to be installed exists, and if so, terminating the installation of the TA; if not, further determining the installed TA Whether the corresponding SD exists. If the SD exists, the process of installing the TA offline is performed; if the SD does not exist, the SD is created, and then the TA is installed, wherein the offline management instruction includes an instruction to create the SD.
  • the REE sends the offline installation TA command to the TEE.
  • the process of determining whether the TA to be installed exists in the TEE according to the associated information may be specifically as follows: after the TEE receives the offline installation TA command sent by the REE, according to the offline installation TA command The TA flag determines whether the TA is installed in the TEE. If the TA exists, the installation of the TA is terminated; if not, the SD corresponding to the TA is further determined according to the SD-T identifier in the offline installation TA command. If yes, the offline TA installation instruction is met, and the offline installation of the TA is performed; if the SD does not exist, the SD is created, and then the TA is installed, wherein the offline management instruction includes an instruction to create an SD.
  • the TEE When the authorization verification of the offline management instruction by the TEE is passed and the various conditions for executing the offline management instruction are met, the TEE performs a corresponding offline management operation according to the offline management instruction, and generates an offline management policy according to the offline management parameter in the offline management instruction. .
  • the offline management policy generated by the TEE may be the duration of use.
  • An offline installation TA command to perform TA installation to the SD is received within the threshold or within the usage threshold.
  • the offline management policy generated by the TEE may be the number of times of use. Preset operations are performed within the threshold or within the duration threshold.
  • the preset operation may be a TA online authentication process, that is, a process in which the TA interacts with the OWE and authenticates each other.
  • TA online certification can play the role of two-way authentication between TEE and OWE.
  • the TEE can determine that the offline installed TA does carry specific services and the version meets the OWE business requirements.
  • the OWE can verify the legality of the TEE and the TA through the online authentication process, thereby ensuring that the TA is running on the legal TEE. In the following, you can personalize the configuration of the business.
  • the TA submits the metadata of the TA, and/or the digest of the TA data, and/or the credential information of the TA, and/or the TEE authenticates the signature of the TA-related data to the server, after the server confirms the information,
  • the online authentication of the TA is completed, and the management result of the authentication result and/or the update of the TA state is sent to the TEE.
  • the server can perform the service registration binding before the service can be started.
  • the preset operation can be the online authentication of the TA through the server to meet the service usage conditions, such as the TA version condition and the TEE version condition. Perform the registration binding process of the user to enable the TA to perform services normally after completing the registration binding.
  • the TEE determines that the offline installation of the TA meets the possibility of maliciously occupying the TEE resource. Scene, delete the TA.
  • the preset operations include, but are not limited to, TA online authentication.
  • the preset operation may also be other operations, which are performed according to certain management logic to ensure that the SD or TA installed according to the offline management instruction, or the updated SD or TA is an SD or TA that satisfies the service usage condition, or determine the bearer.
  • Business SD or TA may be used to verify that the SD or TA installed according to the offline management instruction, or the updated SD or TA is an SD or TA that satisfies the service usage condition, or determine the bearer.
  • the TEE may install or update the TA in the preset SD according to an offline management instruction, and the preset SD is an existing SD or a temporarily created SD.
  • the offline management command is an offline installation of the TA command, and when the TEE performs the TA installation by installing the TA command offline, the TEE first installs the TA in the preset SD, and does not install the SD corresponding to the target SD identifier included in the offline management command.
  • the TA is not directly associated with the SD-T indicated in the offline management command. In this way, it is convenient for the TEE to uniformly manage the offline installed TA.
  • the TEE saves the correspondence between the offline installed TA and the SD-T. After the offline installed TA is authenticated online, the TA is "migrated" to the SD-T indicated by the offline management command, that is, the TA and the TA are established. Associated information of SD-T.
  • the TEE updates the associated information, and the SD or TA installed offline according to the offline management instruction or the SD or TA flag that is offline updated according to the offline management instruction Is offline. That is, the TEE can distinguish between SD and TA installed/updated in online and offline manner by marking in the associated information.
  • the marking information may be automatically added by the TEE according to the installation/update method, or may be utilized in the offline management instruction.
  • the parameters are generated. In one embodiment, it may be determined whether the SD/TA is offline installed/updated by saving an offline management policy associated with the SD/TA in the association information.
  • the marking the SD/TA as offline may be accomplished by setting the lifecycle state of the SD/TA.
  • the TEE sets the lifecycle state of the offline/installed SD/TA to an offline state in response to an indication in the offline management command.
  • OWE switches the lifecycle state of the offline or installed SD/TA to the Active (for SD)/executable (for TA) state through management commands.
  • the offline lifecycle state may be a LOCK/Restricted state in the existing TMF standard and/or an extension thereof, or may be a new lifecycle state for an offline installation scenario, which is not limited herein.
  • the association information includes a lifecycle state, and the association relationship between the SD and the TA, that is, the correspondence between the SD installed in the TEE and the TA installed in the SD installed in the TEE.
  • the association information may also be recorded in the association information, and the correspondence between the SD and the TA.
  • the association information may be presented in a tabular form, and the association information may be a registry of each SD and TA information saved by the TEE.
  • the offline management instruction indicates that the TA is installed to the SD-T, and when the TEE installs the offline installed TA into the preset SD, and updates the associated information, records the TA, the SD-T, the offline management policy, and the preset.
  • the relationship between SD When the CA in the REE initiates a query for the installed TA in the SD-T, it can obtain information about an offline installed TA in the SD, but in the TEE, both the SD-T and the preset SD have the offline.
  • the administrative authority of the TA when the TA completes the online authentication, removes the offline management policy, presets the association relationship between the SD and the TA, and completely transfers the management authority to the SD-T.
  • the TEE determines whether the offline management policy is satisfied according to the usage status of the SD or TA installed by the offline management instruction, or the updated SD or TA.
  • the TEE obtains the usage status of the SD installed offline or offline, and determines whether the offline installation TA command for installing the TA in the SD is received within the usage duration threshold or the usage threshold specified by the offline management policy, if not received, Then delete the SD.
  • the TEE obtains the usage status of the TA installed offline or offline, and determines whether the preset operation is performed within the usage duration threshold or the usage threshold specified by the offline management policy. If the preset operation is not performed, the TA is deleted.
  • the preset operation may be an online authentication operation of the TA.
  • the TEE deletes the SD or TA installed according to the offline installation instruction, or the updated SD or TA, or TEE restores the SD or the TA to the pre-update state.
  • the usage status of the offline installed SD or TA, and the offline updated SD or TA may include the usage status such as the number of times the SD or TA is used/called and the duration of use.
  • the preset operation may be TA online authentication.
  • the TEE detects and records the running status of the offline TA, and determines whether the usage status meets the offline management policy. If the offline TA does not perform online authentication according to the requirements of the offline management policy, that is, the usage status of the TA does not satisfy the offline management policy: if the online authentication is performed within the usage duration threshold or the usage threshold, the TEE performs a deletion operation on the TA. If the offline TA completes the online authentication before the offline management policy specifies the usage status, the online authentication process is used to remove the TA restriction based on the offline management policy, and the online authenticated TA can be regarded as a normal TA.
  • the TEE when the offline management parameter is the usage threshold, the TEE will +1 the counter generated by the offline TA each time it detects that the offline TA is called.
  • the TEE judges the usage of the TA according to the counter.
  • the offline management policy is released.
  • the TEE performs a delete operation on the TA.
  • the TEE detects the running status of the TA according to the installation time recorded during the installation of the offline TA and the trusted clock of the TEE, and the time requirement in the offline management policy, and determines the usage status of the TA. Whether the offline management strategy is met.
  • the management method may further include:
  • the TEE displays the first prompt information on the interface of the terminal according to the recorded usage status of the offline installed or updated SD, and the first prompt information is used to prompt the user to install the TA in the offline installed or updated SD; or
  • the TEE displays the second prompt information on the interface of the terminal according to the usage status of the offline installed or updated TA, and the second prompt information is used to prompt the user to trigger the preset operation.
  • the TEE can generate a notification message on the TEE/REE side interface (UI) by means of an active prompt, prompting the user to initiate an operation to install the TA in the SD, or an online activation operation.
  • UI TEE/REE side interface
  • the offline updated SD is not specified in the offline management policy.
  • the offline installation TA command for installing the TA to the SD within the usage duration threshold or the number of usage durations restores the offline updated SD to the pre-update state; the offline updated TA is not in the offline management policy specified usage duration threshold or When the TA online authentication is performed within the usage time, the offline updated TA is restored to the state before the update.
  • the TA is updated offline.
  • the TEE obtains the new version of the TA
  • the old version of the TA code is not deleted.
  • the old version of the TA code is deleted; or the new version of the TA does not satisfy the offline.
  • the TEE provided by the embodiment of the present invention controls the offline management operation based on the offline management policy.
  • the TEE has the capability of actively preventing the malicious application from occupying the TEE space resource, avoiding the problems of replay and DoS attacks, and improving the utilization rate of the TEE resource. Enhances security in TEE offline scenarios.
  • the management method may further include:
  • the TEE when the TEE is installed according to the offline management instruction, or the updated SD or TA usage status satisfies the offline management policy, the TEE releases the offline-installed SD based on the offline management policy, or the offline installed TA, or offline update.
  • the limits of the TA are not limited to the offline management instruction, or the updated SD or TA usage status satisfies the offline management policy.
  • the TEE releases the limitation of the offline-installed SD, the offline-installed TA, or the offline-updated TA based on the offline management policy, and may include the following situations.
  • the TEE deletes the offline management policy; for example, deleting the SD/TA mark of the offline installation or update marked in the associated information according to the offline management policy.
  • the TEE cancels the SD or TA installed according to the offline management command, or the marked SD or TA is offline. For example, the TEE cancels the flag automatically generated when the SD/TA is installed or updated according to the offline management command.
  • the TEE performs the online authentication result of the TA/SD according to the OWE or responds to the online management instruction sent by the OWE after the TA/SD online authentication, and associates the information with the SD or TA installed according to the offline management instruction, or updates.
  • the offline lifecycle state corresponding to the SD or TA is modified to an executable state. For example, the TEE modifies the SD/TA markup for offline installation or update based on the lifecycle status flag.
  • modifying the offline lifecycle state in the associated information to an executable state may be to switch the lifecycle of the restricted operation to a lifecycle that is operational.
  • the life cycle that can be run normally refers to the normal use, the TEE resource is called normally when the permission is available, and the call of the CA is normally responded.
  • the management method when the TEE performs an offline management operation according to an offline management instruction, such as installing the TA offline and installing the TA in the preset SD, the management method is It can also include:
  • the TEE migrates the offline or offline update TA from the preset SD to the target SD corresponding to the target SD identifier, and deletes the correspondence between the preset SD in the associated information and the TA installed offline or offline.
  • the number only represents a logical implementation, and does not represent all.
  • the S104 and the S105 may be executed at the same time in the embodiment of the present invention, or may be performed separately.
  • the management method may further include:
  • TEE limits the access rights of offline installed SD or TA, or offline updated SD or TA. For example, for a TA installed offline, you can limit the TEE resources that the TA can access before online authentication. This prevents the exploited version of the TA that uses the offline installation to attack the TEE. For example, a TA that restricts offline installation invokes TEE calculations, stores resources, or initiates access to other TA, TEE APIs.
  • the TEE has the capability of restricting or allowing the SD/TA resource access rights of the offline installation or update, and may set the permission information in the offline management instruction to indicate limitation or allow offline installation or update of the SD/
  • the TA performs the resource access permission, or the TEE itself manages the offline or updated SD/TA resource access rights according to the preset logic.
  • the management method may further include:
  • the first information includes identification information of an offline management instruction that the TEE refuses to execute.
  • the first information may also be referred to as a blacklist.
  • the use of offline management commands is restricted by maintaining a blacklist.
  • the identifier information in the offline management instruction may include at least one of an identifier of an offline management instruction, a summary of an offline management instruction, and an identifier of an SD to be offline managed by an offline management instruction or an identifier of a TA, or an offline management identifier
  • Other information for the purpose of the identification is not limited in the embodiment of the present invention.
  • the TEE when the usage status of the SD/TA installed offline or updated does not satisfy the offline management policy, such as SD or TA installed by offline management instructions, or updated SD or TA
  • the TEE adds the identification information of the offline management command to the first information.
  • the TEE can delete the TA1 according to the usage status of the offline TA1 and the offline management policy when the usage status of the TA1 does not satisfy the offline management policy.
  • the TEE records the deleted TA/SD information because the offline management policy is not met, and according to the preset threshold set by the TEE, when the TA1 is repeatedly installed and the usage status does not satisfy the offline management policy, the number of times is deleted.
  • the threshold is set, the TEE recognizes that the offline management command for installing the TA1 may be maliciously used, deletes the offline installed TA, and rejects the offline installation of the TA1 command by adding the offline TA or offline TA installation command to the blacklist. Executed.
  • the offline installed or updated SD/TA may be preferentially deleted.
  • the TEE can delete the offline installation or the offline update TA that satisfies the space cleaning preset condition according to the usage state of the TA marked as offline, and release the storage space.
  • the SD receiving the offline management instruction as long as the SD-A indicated in the token is directly or indirectly associated with it, as long as the authorization token can
  • the verification is performed by the verification key in the SD-A, and after the verification is passed, the SD can execute the management operation indicated in the offline management instruction.
  • SD-2 in FIG. 5 performs the operation of installing the TA into the SD-1.
  • the offline management operation corresponding to the offline management instruction can be executed.
  • the current access control mechanism cannot prevent offline management instructions from being used maliciously in this case. Even if the CA can access the SD/TA through the Client API, as long as a legitimate command can be sent to any SD that is directly or indirectly associated with the SD-A and meets the conditions of use, it can be executed. There are cases where a legitimate offline management command is maliciously used by the CA.
  • the present invention also provides a method for managing an offline management instruction, by binding an offline management instruction to a legitimate user of an offline management instruction, to realize that only a specific offline management instruction is designated or authorized by a CA (legal use) When it is sent to the TEE, it can be executed, further restricting the use conditions of the offline management instruction, thereby reducing the situation that the offline management instruction is acquired by the unauthorized CA and maliciously used.
  • the OWE When generating the offline management command, the OWE adds the identifier of the offline management command user to the offline management command, and binds the offline management command to the relationship of the offline management command user.
  • the OWE can use the identification information of the client A and the client B as an element of the offline installation instruction, so that only the client A or the client B can use the instruction to perform the offline TA installation.
  • the identifier of the user of the offline management command may be a package name of the CA, a certificate of the APK or a certificate hash, an APK public key, and the like, which can uniquely identify the identity of the CA.
  • the offline management instruction user identifier may be used as a parameter of the token or as a parameter of the operation layer offline management instruction, and the identifier of the offline management instruction user may be set in an extension field of the offline management instruction, which is not in the embodiment of the present invention. Make a limit.
  • the OWE After the OWE generates the offline command, it can be placed in the application server in the manner shown in Figure 1. For details, refer to the description in Figure 1. For brevity, the details are not described here.
  • the terminal obtains offline management instructions from the application server when needed.
  • the solution provided by the embodiment of the present invention can be applied to the management method shown in FIG. 3 and FIG. 4, that is, after the TEE receives the offline management command sent by the CA in the REE, and before the TEE performs the offline management operation corresponding to the offline management instruction. .
  • the management method may include the following steps:
  • the TEE receives an offline management instruction sent by the second client application CA in the REE.
  • the offline management instruction includes at least one first CA identifier corresponding to at least one first CA that allows the offline management instruction to be used.
  • the offline management command is sent to the TEE through the client Client API or other communication method.
  • the TEE receives the offline management command sent by the CA in the REE, it acquires the CA identifier of the user CA that established the session with the TEE.
  • the TEE can be extracted through the bottom layer of the system, such as the Linux Kernel layer, or other security technologies to obtain the CA identifier corresponding to the CA that sends the offline management instruction, so as to reduce the risk of the user being spoofed.
  • the bottom layer of the system such as the Linux Kernel layer, or other security technologies to obtain the CA identifier corresponding to the CA that sends the offline management instruction, so as to reduce the risk of the user being spoofed.
  • the TEE verifies whether the second CA identifier corresponding to the second CA is consistent with any of the at least one first CA identifier.
  • the TEE performs an offline management operation corresponding to the offline management instruction.
  • the second CA is CA1
  • at least one first CA identifier included in the offline management instruction has two: an identifier of the CA1 and an identifier of the CA2; after the CA1 in the REE sends an offline management instruction to the TEE, the TEE sends an offline management instruction.
  • the identifier of the CA1 is compared with the identifier of the CA1 that is authorized to use the offline management instruction and the identifier of each CA in the identifier of the CA2 included in the offline management instruction; when the identifier of the CA1 that sends the offline management instruction and the offline management instruction When the ID of the CA1 authorized to use the offline management instruction is consistent, the TEE determines that the CA1 that sends the offline management instruction has the right to use the offline management instruction, and the TEE executes the offline management instruction.
  • the CA identifier can be verified by the universal PKI mechanism, that is, the OWE separately signs the offline management command and the application data package (such as the Android APK, the iOS IPA package), and sends the offline management to the TEE on the REE side.
  • the TEE verifies the offline management instructions and the application packet signer to ensure that they are signed by the same OWE to prove that the OWE authorizes the CA to use the offline management instruction.
  • OWE signs the APK and adds the public key used to verify the signature to the offline management command.
  • the TEE extracts the OWE public key verification OWE to verify the signature of the user application data packet to confirm that the OWE authorizes the CA to use the offline management instruction.
  • the first CA identifier and the second CA identifier may be a name of the CA data packet, a CA data packet certificate, a summary of the CA data packet certificate, a CA data packet issuer public key, or other CA unique identification information. At least one of (such as UUID, etc.), such as CA package name, APK certificate, APK certificate summary, APK issuer public key.
  • the first CA identifier may be included in an offline management parameter, may be included in an offline management parameter, or may be included in an extension field of an offline management instruction, or may be included in a token.
  • the offline management instruction is an offline deletion instruction; after the TEE determines that the second CA identifier corresponding to the second CA is consistent with any one of the at least one first CA identifier, the Management methods also include:
  • the TEE determines that the first CA corresponding to the at least one first CA identifier except the second CA does not exist, the TEE performs an offline management operation corresponding to the offline management instruction; when the TEE determines the second CA in the REE When any one of the first CAs corresponding to the at least one first CA identifier is present, the offline management instruction is rejected.
  • CA1 in the REE sends an offline management command
  • the offline management command includes the identifier of the CA1, the identifier of the CA2, and the identifier of the CA3, indicating that CA1, CA2, and CA3 are authorized to use the offline management instruction, which also implies REE.
  • the three CAs need to use TA (or have a service dependency on the TA); when the TEE determines that only CA1 in CA1, CA2, and CA3 exists in the REE, and there is no CA2 and CA3, the TEE performs an offline management instruction. Management operation; when there is any CA in CA2 or CA3 in addition to CA1 in the REE, that is, there are still CAs in the REE that need to use the TA except CA2, the TEE refuses to execute the offline management instruction.
  • the offline management instruction may also be an offline deletion instruction, including offline deletion of the SD instruction, and offline deletion of the TA instruction.
  • the offline deletion instruction is an offline deletion TA instruction
  • the offline deletion TA instruction may include at least one first CA identifier that the TA identifier of the TA to be deleted is authorized to use the offline management instruction.
  • the TEE After the TA is installed in the offline management command, when the TA command is deleted for deleting the TA, the TEE acquires the CA information in the REE, and the TEE obtains and records at least one third CA identifier from the offline installation TA command or from the offline installation TA. Determining whether at least one third CA corresponding to the at least one third CA identifier of the TA may not exist in the REE; when any third CA still exists, indicating that the CA needs to use the TA, The TA cannot be deleted, that is, the condition for deleting the TA offline is not satisfied, and the operation of deleting the TA is refused.
  • the third CA identifier may be an offline installation TA command for offline installation of the TA, and the CA identifier corresponding to one, two or more CAs authorized to use the offline installation TA command, and offline installation
  • the TA recorded by the TA can be identified by the CA corresponding to the CA used by the specific CA.
  • the at least one third CA identifier may be an identifier of CA1, CA2, and CA5 authorized to use the offline installation TA command, and CA1, CA2 recorded by the TA that can be used by the specific CA1, CA2, CA3, and CA4, CA5. Identification of CA3 and CA4, CA5.
  • the offline deletion TA instruction includes an offline management parameter, where the offline management parameter includes a usage duration threshold, and at least one CA corresponding to the at least one third CA identifier of the TA is allowed to be used.
  • the TEE determines that the minimum duration of the at least one third CA corresponding to the at least one third CA does not exist in the REE exceeds the usage duration threshold, and performs the operation of deleting the TA.
  • the timing of the minimum duration is to start timing when all third CAs do not exist in the REE, that is, when the last third CA in at least one third CA is deleted.
  • the CA sends the offline management instruction to the TEE in advance, the TEE caches the offline management instruction, and can obtain the application change of the CA in the REE; the TEE obtains the CA information or the slave that allows the offline deletion instruction from the offline deletion instruction.
  • the TA acquires information of all the CAs that need to use the TA.
  • the TEE records the event that the CA is deleted, and records the deletion time.
  • the TEE starts timing, when the usage duration threshold is reached, and the time threshold is not installed within the time range of the usage duration threshold.
  • the TEE determines that the deleted CA is completely deleted and is no longer used. At this time, the TEE performs the operation of deleting the TA.
  • At least one third CA identifier is an identifier of CA1, CA2, CA3, CA4, and CA5.
  • the TEE determines whether there are still CA1, CA2, CA3, CA4, and CA5 in the REE.
  • the offline delete TA instruction is executed.
  • the management method may include the following steps:
  • the TEE receives an offline delete command sent by the second CA in the REE.
  • the offline delete instruction includes a TA identity of the TA to be deleted, at least one at least one CA identity authorized to use the offline delete TA command, and an offline management parameter.
  • the offline management parameter may include a usage duration threshold.
  • the TEE determines whether the second CA identifier corresponding to the second CA is consistent with any one of the at least one first CA identifier.
  • the TEE determines whether there is at least one third CA corresponding to the at least one third CA identifier associated with the TA identifier of the TA to be deleted in the REE.
  • At least one third CA is a CA that can use the TA.
  • the at least one third CA identifier is an identifier corresponding to the at least one third CA that is allowed to use the TA according to the offline installation of the TA command or the offline installation of the TA.
  • the TEE records the usage of the CA in the REE, and determines, according to the at least one third CA identifier, whether at least one CA corresponding to the at least one third CA identifier exists in the REE, and each third CA in the at least one third CA does not When there is a REE, S304 is executed, otherwise, the offline delete instruction is rejected.
  • the TEE determines whether the duration of the at least one third CA does not exist in the REE reaches a usage duration threshold.
  • timing is started from the fact that each of the at least one third CA does not exist in the REE, and when the duration of the at least one third CA does not exist in the REE reaches the usage duration threshold, Execute the offline delete instruction, that is, execute S305, otherwise refuse to execute the offline delete instruction.
  • TEE deletes the TA.
  • the offline delete TA command sent by the CA1 in the REE includes the identifiers of the CA1 and CA5 authorized to use the offline delete TA command; after receiving the offline delete TA command sent by the CA1, the TEE determines to send the offline delete. Whether the identifier of the CA1 of the TA command is consistent with the identifier of one of the two CA1s and CA5s authorized to use the offline delete TA command included in the offline delete TA command; when consistent, the TEE determines that at least one third of the TA can be used. Whether the third CA (CA1, CA2, CA3, CA4, and CA5) corresponding to the CA identifier is still in the REE.
  • the TEE determines CA1, CA2, CA3, Whether the duration of CA4 and CA5 not in the REE reaches the usage duration threshold, for example, 1 hour, optionally, when the last one of CA1, CA2, CA3, CA4, and CA5 is not in the REE for 1 hour, the TEE deletes the TA.
  • the offline management instruction further includes indication information, configured to indicate that the SD associated with the TA to be deleted is synchronously deleted, and the SD associated with the TA to be deleted is not after the TA is deleted. After including other TAs, delete the SD.
  • the indication information in the offline management instruction may be a boolean bit added by the instruction.
  • the TEE does not perform an offline deletion operation according to an offline deletion instruction.
  • the TEE when the TEE determines that the CA that is offline to install the TA is deleted, the TEE deletes the TA; or when the TEE determines that the first CA corresponding to the at least one first CA identifier does not exist in the REE, the TEE deletes the TA, where at least one A CA identifier is a CA identifier corresponding to one, two or more CAs authorized to use the offline installation TA command included in the offline installation TA command for offline installation of the TA; or when the TEE determines that at least one third CA does not exist in the REE When the corresponding third CA is identified, the TEE deletes the TA, and at least one third CA identifier is obtained and recorded by the TEE from the offline installation TA command or the offline installed TA.
  • the TEE determines at least one CA according to the change of the CA in the REE and at least one CA identifier corresponding to the at least one CA of the TA installed offline. Whether at least one CA corresponding to a CA identifier still exists in the REE, and when at least one CA corresponding to at least one CA identifier does not exist in the REE, the TEE automatically deletes the TA. For example, the TEE saves at least one first CA identifier in the offline management instruction, that is, CA1, CA2, and CA3 that are authorized to use the offline installation instruction to offlinely install the TA, for example, when the CA1 uses the offline management instruction, the TEE is installed offline. After the TA, the TEE determines whether there are still CA1, CA2, and CA3 in the REE. When there is no CA in CA1, CA2, and CA3 in which the TA is offline, the TA is deleted.
  • the offline deletion instruction may further be a delete SD instruction, where the SD deletion instruction may include an SD identifier of the SD to be deleted and at least one first CA identifier.
  • the TEE stores association information including a correspondence relationship between the TA identifier and the SD.
  • the management method may include the following steps:
  • the TEE receives an offline deletion instruction sent by the second CA in the REE.
  • the offline deletion instruction includes an SD identifier of the SD to be deleted, and is authorized to use at least one first CA identifier corresponding to the at least one first CA of the offline deletion instruction.
  • the offline deletion instruction may further include an offline management parameter, and the offline management parameter may include a usage duration threshold.
  • the TEE determines whether the second CA identifier corresponding to the second CA is consistent with any one of the at least one first CA identifier.
  • the TEE determines, according to the association information, whether the SD identifier corresponding to the SD to be deleted is included in the TEE.
  • the TEE determines, according to the association information, whether the SD identifier of the SD to be deleted has a TA or SD identifier associated with the SD identifier.
  • the TEE determines whether the duration of the TA installation instruction that the SD to be deleted does not receive the usage duration threshold.
  • the TEE determines whether the duration from the installation to the non-received TA installation instruction reaches the usage duration threshold from the SD to be deleted, and the duration of the TA installation instruction is not reached when the SD to be deleted reaches the usage duration threshold, and is to be deleted. If no other TA is installed in the SD, and there is no TA or SD associated with it, then S406 is performed; otherwise, the offline deletion operation of the offline deletion instruction is rejected.
  • the offline delete SD command sent by the CA1 in the REE includes the identifiers of the CA1 and CA5 authorized to use the offline delete SD; after receiving the offline delete TA command sent by the CA1, the TEE determines to send the offline delete TA. Whether the identifier of the commanded CA1 is consistent with the identifier of one of the two CA1s and CA5s that are authorized to use the offline delete SD command, and the TEE determines whether the offline delete is included in the TEE according to the association information.
  • the associated TA may include TA1, TA2, and TA3.
  • the TEE determines that the offline installation TA of the TA is offlinely installed in the SD. Whether the duration of the instruction satisfies the usage duration threshold, that is, optionally, the SD is deleted when the duration from the offline installation of the SD to the determined duration is equal to the usage duration threshold.
  • the related information is information of the correspondence between the SD and the TA saved by the TEE.
  • FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the terminal includes a trusted execution environment TEE and a rich execution environment REE; the TEE includes a receiving unit 510 and a processing unit 520.
  • the receiving unit 510 is configured to receive an offline management instruction sent by the rich execution environment REE of the terminal, where the offline management instruction includes an offline management parameter, where the offline management parameter includes at least one of a usage duration threshold and a usage threshold;
  • the processing unit 520 is configured to perform an offline management operation corresponding to the offline management instruction, and generate an offline management policy according to the offline management parameter;
  • the processing unit 520 deletes the SD or the TA, or restores the SD or TA to the pre-update state; wherein the SD or TA is managed by the TEE according to offline Instructions are installed or updated offline.
  • the offline management instruction includes an offline installation SD instruction or an offline update SD instruction
  • the offline management policy is to receive an offline installation TA instruction within a usage threshold or a usage duration threshold.
  • the offline management instruction includes an offline installation TA instruction or an offline update TA instruction
  • the offline management policy is to perform a preset operation within a usage threshold or a usage duration threshold.
  • the processing unit 520 is further configured to determine whether the identifier information of the offline management instruction is included in the first information saved by the TEE, where the first information includes an offline management instruction that the TEE refuses to execute. Identification information.
  • the processing unit 520 when the number of times the SD or TA is deleted by the TEE reaches a preset threshold, the processing unit 520 is further configured to add the identifier information of the offline management instruction to the first information.
  • the identifier information includes an identifier of an offline management instruction, a summary of the offline management instruction, and at least one of an SD identifier or a TA identifier to be offline managed by the offline management instruction.
  • the processing unit 520 performs an offline management operation corresponding to the offline management instruction, including:
  • the processing unit 520 installs the TA offline or offline updates the TA within the preset SD according to the offline management instruction.
  • the processing unit 520 is further configured to update the association information, and mark the SD or TA as an offline state; wherein the association information includes the SD installed in the TEE and the SD installed in the TEE. Correspondence of TA installed inside.
  • the processing unit 520 releases the restriction on the SD or the TA based on the offline management policy.
  • the processing unit 520 releases the limitation of the SD or the TA based on the offline management policy, including:
  • the processing unit 520 deletes the offline management policy; or the processing unit 520 cancels the flag that the SD or the TA is in the offline state; or the processing unit 520 modifies the lifecycle state corresponding to the SD or the TA to the executable state.
  • the offline management instruction further includes a target SD identifier
  • the processing unit 520 migrates the TA from the preset SD to the target SD corresponding to the target SD identifier, and deletes the correspondence between the preset SD and the TA in the association information.
  • the processing unit 520 is further configured to limit resource access rights of the SD or the TA before the usage status of the SD or the TA satisfies the offline management policy.
  • the processing unit 520 is further configured to display the first prompt information on the interface of the terminal according to the usage state of the SD; or
  • the processing unit 520 is further configured to display the second prompt information on the interface of the terminal according to the usage state of the TA.
  • the offline management instruction further includes at least one first client application CA identifier, and the at least one first CA identifier is an identifier corresponding to the at least one first CA that allows the offline management instruction to be used;
  • the receiving unit 510 is configured to receive an offline management instruction sent by the rich execution environment REE of the terminal, including:
  • the receiving unit 510 receives an offline management instruction sent by the second CA in the REE;
  • the processing unit 520 is further configured to: before the processing unit 520 performs the offline management operation corresponding to the offline management instruction, when determining the second CA identifier corresponding to the second CA and any one of the at least one first CA identifier When consistent, the processing unit 520 performs an offline management operation corresponding to the offline management instruction.
  • the offline management instruction is an offline deletion instruction
  • the processing unit 520 is further configured to: determine, by the processing unit, any one of the second CA identifier corresponding to the second CA and the at least one first CA identifier. After a CA identifier is consistent, when it is determined that the first CA corresponding to the at least one first CA identifier except the second CA in the REE does not exist, the offline management instruction is executed.
  • the offline management instruction further includes indication information, where the indication information is used to indicate that the SD where the TA is located is synchronously deleted;
  • the processing unit 520 deletes the TA, including:
  • the processing unit 520 deletes the TA and the SD where the TA is located.
  • the offline management instruction includes offline installation of the TA instruction
  • the processing unit 520 is further configured to: after the processing unit 520 performs the offline management operation corresponding to the offline management instruction, when determining that the third CA corresponding to the at least one third CA identifier does not exist in the REE, the processing unit 520 deletes the TA;
  • the at least one third CA identifier is corresponding to the at least one third CA identifier, and the at least one third CA identifier corresponding to the TEE is obtained by offline installation of the TA instruction from the offline installation or at least one third CA identifier obtained from the TA installed offline.
  • At least one third CA is a CA that needs to use the TA; wherein the offline installation TA instruction includes at least one first CA identifier, and the at least one first CA identifier is at least one first authorized to use the offline installation TA command The identifier corresponding to the CA; the at least one first CA identifier is included in the at least one third CA.
  • the terminal provided by the embodiment of the present invention further includes a storage unit 530 for storing instructions and data, and the processing unit 520 is configured to invoke an instruction in the storage unit 530 and perform a corresponding operation.
  • the terminal further includes a sending unit 540, configured to perform data transmission with other devices.
  • each functional unit in the terminal can be implemented by the steps performed by the terminal in the embodiment shown in FIG. 3 to FIG. 8. Therefore, the specific working process of the terminal provided by the embodiment of the present invention is not Retelling.
  • the embodiment of the present invention further provides a terminal.
  • the terminal includes a receiver 610, a processor 620, a memory 630, and a transmitter 640.
  • the receiver, the transmitter, the processor, and the memory are connected to each other. Completing the communication with each other, the terminal has a method of performing the operations performed by the terminals in FIGS. 3 to 8.
  • the terminal is used to perform the following operations:
  • the receiver 610 is configured to receive an offline management instruction sent by the rich execution environment REE of the terminal, where the offline management instruction includes an offline management parameter, where the offline management parameter includes at least one of a usage duration threshold and a usage threshold;
  • the processor 620 is configured to perform an offline management operation corresponding to the offline management instruction, and generate an offline management policy according to the offline management parameter;
  • the processor deletes the SD or the TA, or the processor 620 restores the SD or the TA to the pre-update state; wherein the SD or the TA is determined by the TEE Offline management instructions are installed or updated offline.
  • the offline management instruction includes an offline installation SD instruction or an offline update SD instruction
  • the offline management policy is to receive an offline installation TA instruction within a usage threshold or a usage duration threshold.
  • the offline management instruction includes an offline installation TA instruction or an offline update TA instruction
  • the offline management policy is to perform a preset operation within a usage threshold or a usage duration threshold.
  • the processor 620 is further configured to determine whether the identifier information of the offline management instruction is included in the first information saved by the TEE, where the first information includes an offline management instruction that the TEE refuses to execute. Identification information.
  • the processor 620 when the number of times the SD or the TA is deleted by the TEE reaches a preset threshold, the processor 620 is further configured to add the identifier information included in the offline management instruction to the first information.
  • the identifier information includes an identifier of an offline management instruction, a summary of the offline management instruction, and at least one of an SD identifier or a TA identifier to be offline managed by the offline management instruction.
  • the processor 620 performs an offline management operation corresponding to the offline management instruction, including:
  • the processor 620 installs the TA offline or offline updates the TA within the preset SD according to the offline management instruction.
  • the processor 620 is further configured to update the association information, and mark the SD or the TA as an offline state.
  • the association information includes a correspondence between the SD installed in the TEE and the TA installed in the SD installed in the TEE.
  • the processor 620 when the usage status of the SD or the TA satisfies the offline management policy, releases the restriction on the SD or the TA based on the offline management policy.
  • the processor 620 releases the limitation of the SD or the TA based on the offline management policy, including:
  • the processor 620 deletes the offline management policy; or the processor 620 cancels the flag that the SD or TA is offline; or the processor 620 modifies the lifecycle state corresponding to the SD or TA to an executable state.
  • the offline management instruction further includes a target SD identifier
  • the processor 620 migrates the TA from the preset SD to the target SD corresponding to the target SD identifier, and deletes the correspondence between the preset SD and the TA in the association information.
  • the processor 620 is further configured to limit resource access rights of the SD or the TA before the usage status of the SD or the TA satisfies the offline management policy.
  • the processor 620 is further configured to display the first prompt information on the interface of the terminal according to the usage state of the SD; or
  • the processor 620 is further configured to display the second prompt information on the interface of the terminal according to the usage state of the TA.
  • the offline management instruction further includes at least one first client application CA identifier, and the at least one first CA identifier is an identifier corresponding to the at least one first CA that allows the offline management instruction to be used;
  • the receiver 610 is configured to receive an offline management instruction sent by the rich execution environment REE of the terminal, including:
  • the receiver 610 receives an offline management instruction sent by the second CA in the REE;
  • the processor 620 is further configured to: when the processor 620 performs the offline management operation corresponding to the offline management instruction, when determining that the second CA identifier corresponding to the second CA is consistent with any one of the at least one first CA identifier The processor 620 performs an offline management operation corresponding to the offline management instruction.
  • the offline management instruction is an offline deletion instruction
  • the processor 620 is further configured to: at the processor 620, determine any one of the second CA identifier corresponding to the second CA and the at least one first CA identifier. After the first CA identifier is consistent, when it is determined that the first CA corresponding to the at least one first CA identifier except the second CA in the REE does not exist, the offline management instruction is executed.
  • the offline management instruction further includes indication information, where the indication information is used to indicate that the SD where the TA is located is synchronously deleted;
  • the processor 620 deletes the TA, including:
  • the processor 620 deletes the TA and the SD where the TA is located.
  • the offline management instruction includes offline installation of the TA instruction; the processor 620 is further configured to: after the processor 620 performs the offline management operation corresponding to the offline management instruction, when determining that the REE is not When there is at least one third CA corresponding to the third CA identifier, the processor 620 deletes the TA;
  • the at least one third CA identifier is corresponding to the at least one third CA identifier, and the at least one third CA identifier corresponding to the TEE is obtained by offline installation of the TA instruction from the offline installation or at least one third CA identifier obtained from the TA installed offline.
  • At least one third CA is a CA that needs to use the TA; wherein the offline installation TA instruction includes at least one first CA identifier, and the at least one first CA identifier is at least one first authorized to use the offline installation TA command The identifier corresponding to the CA; the at least one first CA identifier is included in the at least one third CA.
  • the terminal provided by the embodiment of the present invention further includes a memory 630 for storing instructions and data, and the processor 620 is configured to invoke an instruction in the memory 630 and perform a corresponding operation.
  • the terminal further includes a transmitter 640 for performing data transmission with other devices.
  • each functional device in the terminal can be implemented by the steps performed by the terminal in the embodiment shown in FIG. 3 to FIG. 8. Therefore, the specific working process of the terminal provided by the embodiment of the present invention is not Retelling.
  • the terminal provided by the embodiment of the present invention may be a mobile phone.
  • the processor is the control center of the mobile phone, and connects various parts of the entire mobile phone by using various interfaces and lines, and executes each mobile phone by running or executing software programs and/or modules stored in the memory, and calling data stored in the memory. The function and processing of data to monitor the phone as a whole.
  • the processor may be a central processing unit (CPU), a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or a field programmable gate array (field). Programmable gate array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof.
  • the processor may implement or perform various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor can also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the processor can include one or more processor units.
  • the processor may further integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, an application, and the like, and the modem processor mainly processes the wireless communication. It can be understood that the above modem processor may not be integrated into the processor.
  • the memory can be used to store software programs and modules, and the processor executes various functional applications and data processing of the mobile phone by running software programs and modules stored in the memory.
  • the memory may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the storage data area may be stored according to Data created by the use of the mobile phone (such as audio data, phone book, etc.).
  • the memory may include volatile memory such as non-volatile volatile random access memory (NVRAM), phase change random access memory (PRAM), and magnetoresistive random access memory ( Magetoresistive RAM, MRAM), etc.; memory 620 may also include non-volatile memory, such as at least one disk storage device, electrically erasable programmable read-only memory (EEPROM), flash memory device, such as NOR flash memory or NAND flash memory, semiconductor devices such as Solid State Disk (SSD).
  • EEPROM electrically erasable programmable read-only memory
  • flash memory device such as NOR flash memory or NAND flash memory
  • SSD Solid State Disk
  • the memory may also include a combination of the above types of memories.
  • FIG. 11 is a schematic diagram of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus 1100 may be a chip, and the chip includes a processing unit and a communication unit.
  • the processing unit may be a processor 1110, which may be various types of processors as described above.
  • the communication unit may for example be an input/output interface 1120, a pin or a circuit, etc., which may comprise or be connected to a system bus.
  • the communication device further includes a storage unit, and the storage unit may be a memory 1130 inside the chip, such as a register, a cache, a random access memory (RAM), an EEPROM, or a FLASH.
  • the memory unit may also be a memory external to the chip, which may be various types of memory as described above.
  • the processor is coupled to the memory, and the processor can execute instructions stored in the memory to cause the communication device to perform the method performed by the terminal of Figures 3-8 above.
  • Embodiments of the present invention also provide a computer readable storage medium comprising instructions that, when executed on a device, cause the device to perform the methods as illustrated in Figures 3-8.
  • Embodiments of the present invention also provide a computer program product or computer program comprising instructions that, when executed on a computer, cause the computer to perform the methods as illustrated in Figures 3-8.
  • the embodiment of the present invention further provides a system, which may include the terminal described in FIG. 3 to FIG. 8 and an OWE, a service provider server.
  • the present invention may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable medium to another computer readable medium, for example, the computer instructions can be wired from a website site, computer, server or data center (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg infrared, wireless, microwave, etc.) to another website site, computer, server or data center.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state hard disk) or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)

Abstract

本发明实施例提供了一种离线管理指令的管理方法和终端，该管理方法包括：终端的TEE接收终端的REE发送的离线管理指令，离线管理指令包括离线管理参数，离线管理参数包括使用时长阈值和或使用次数阈值中的至少一种；TEE执行离线管理指令对应的离线管理操作，并根据离线管理参数生成离线管理策略；当安全域SD或可信应用TA的使用状态不满足离线管理策略时，TEE删除SD或TA，或者TEE将SD或TA还原到更新前的状态；其中，SD或TA是由TEE根据离线管理指令离线安装或更新的。终端基于离线管理策略判断REE对SD或TA的离线管理是否符合恶意占用TEE资源的情况，使终端的TEE具有主动防御能力。

Description

一种离线管理指令的管理方法和终端
本申请要求于2018年03月07日提交中国专利局、申请号为201810188418.8、申请名称为“一种离线管理指令的管理方法和终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及安全管理领域，尤其涉及一种离线管理指令的管理方法和终端。
背景技术
随着电子产品的发展，以及用户对数据安全性的需求，目前在硬件的支持下，许多终端可以同时存在两个执行环境，一个是普通执行环境，或者称之为富执行环境(rich execution environment，REE)，普通执行环境泛指不具备特定安全功能的运行环境；另一个是可信执行环境(trusted execution environment，TEE)，TEE具有安全功能，能够满足用户的一定安全需求，同时可以实现与REE相隔离的运行机制。
在TEE管理架构(TEE management framework，TMF)下，国际平台组织(Global Platform，GP)发布了用于实现TEE远程管理的标准，该标准中定义了对TEE内部安全域(security domain，SD)/可信应用(trusted application，TA)的管理框架和管理权限，管理指令的数据结构、验证与执行要求等。在TMF中定义的管理指令都是要验证授权后才能被执行，在通过使用授权令牌(authorization token)进行授权的过程中，指令生成时可以通过约束(constraint)参数来限制授权令牌的使用条件，但是约束参数仅能解决离线场景下离线管理指令的授权验证问题，并不能防止应用利用合法的离线管理指令恶意占用TEE资源的问题，例如恶意应用可以使用离线安装TA1、TA2…的合法离线管理指令，恶意向TEE安装不会被使用的TA(或是说REE侧没有对该TA存在业务依赖关系的CA)。也就是说，在TEE离线管理场景下，对于多个不同的能通过授权验证的离线管理指令，TEE仅能够被动执行，不具备对离线管理指令的使用是否可信的识别能力。换句话讲，就是TEE具有验证离线管理指令是否合法，并执行合法的离线管理指令，但不具有识别离线管理指令的使用行为是否合法的能力。
发明内容
本发明提供了一种离线管理指令的管理方法和终端，终端的TEE根据离线管理指令中携带的离线管理参数生成离线管理指令，并根据离线管理策略对根据离线管理指令安装或更新的SD或TA进行管理，使TEE具备了主动防御应用使用合法的离线管理指令恶意占用TEE资源的能力。
第一方面，提供了一种离线管理指令的管理方法，该管理方法可以包括：
终端的可信执行环境TEE接收终端的富执行环境REE发送的离线管理指令，离线管理指令包括离线管理参数，离线管理参数包括使用时长阈值和或使用次数阈值中的 至少一种；
TEE执行离线管理指令对应的离线管理操作，并根据离线管理参数生成离线管理策略；
当安全域SD或可信应用TA的使用状态不满足离线管理策略时，TEE删除SD或TA，或者TEE将SD或TA还原到更新前的状态；其中，SD或TA是由TEE根据离线管理指令离线安装或更新的。
基于提供的一种离线管理指令的管理方法，终端的TEE根据离线管理指令中携带的离线管理参数生成离线管理策略，并根据离线管理策略判断根据离线管理指令安装或更新的SD或TA是否符合恶意占用TEE资源的情况，使终端的TEE具有主动防御能力。
结合第一方面，在第一方面的第一种可能实现的实施例中，离线管理指令包括离线安装SD指令或离线更新SD指令，离线管理策略为在使用次数阈值内或使用时长阈值内接收到离线安装TA指令。
结合第一方面，在第一方面的第二种可能实现的方式中，离线管理指令包括离线安装TA指令或离线更新TA指令，离线管理策略为在使用次数阈值内或使用时长阈值内进行预设操作。
结合第一方面，或者第一方面的第一种或第二种可能实现的方式，在第一方面的第三种可能实现的方式中，在TEE执行离线管理指令对应的离线管理操作之前，该管理方法还包括：
TEE确定离线管理指令的标识信息是否包含在TEE保存的第一信息中，第一信息中包括TEE拒绝执行的离线管理指令的标识信息。
结合第一方面，在第一方面的第三种可能实现的方式中，该管理方法还包括：
当SD或TA被TEE删除的次数达到预设阈值时，TEE将离线管理指令的标识信息添加至第一信息。
结合第一方面的第三种或者第四种可能实现的方式，在第一方面的第五种可能实现的方式中，标识信息包括离线管理指令的标识，离线管理指令的摘要，以及离线管理指令所要离线管理的SD标识或TA标识中的至少一项。
结合第一方面，在第一方面的第六种可能实现的方式中，TEE执行离线管理指令对应的离线管理操作，包括：
TEE根据离线管理指令在预设SD内离线安装TA或离线更新TA，增强了TEE安全性。
结合第一方面，或者第一方面的第一种至第六种可能实现的方式中的任一可能实现的方式中，在TEE执行离线管理指令对应的离线管理操作之后，该管理方法还包括：
TEE更新关联信息，并将SD或TA标记为离线状态；其中，关联信息包括TEE中安装的SD与TEE中安装的SD内安装的TA的对应关系。
结合第一方面，或者第一方面的第一种至第七种可能实现的方式中的任一可能实现的方式，在第一方面的第八种可能实现的方式，该管理方法还包括：
当SD或TA的使用状态满足离线管理策略时，TEE解除基于离线管理策略对SD或的TA的限制。
结合第一方面的第八种可能实现的方式，在第一方面的第九种可能实现的方式中，TEE解除基于离线管理策略对SD或TA的限制，包括：
TEE删除离线管理策略；或者TEE取消SD或TA处于离线状态的标记；或者TEE将SD或TA对应的生命周期状态修改为可执行状态。
结合第一方面，或者第一方面的第一种至第九种可能实现的方式中的任一可能实现的方式，在第一方面的第十种可能实现的方式中，离线管理指令还包括目标SD标识；该管理方法还包括：
当TA的使用状态满足离线管理策略时，TEE将TA从预设SD迁移到目标SD标识对应的目标SD内，并删除关联信息中预设SD与TA的对应关系。
结合第一方面，或者第一方面的第一种至第十种可能实现的方式中的任一可能实现的方式，在第一方面的第十一种可能实现的方式中，在SD或TA的使用状态满足离线管理策略之前，TEE对SD或TA的资源访问权限进行限制。
结合第一方面，或者第一方面的第一种至第十一种可能实现的方式中的任一可能实现的方式，在第一方面的第十二种可能实现的方式中，该管理方法还包括：
TEE根据SD的使用状态在终端的界面上显示第一提示信息；或者，
TEE根据TA的使用状态在终端的界面上显示第二提示信息。
结合第一方面，或者第一方面的第一种至第十二种可能实现的方式中的任一可能实现的方式，在第一方面的第十三种可能实现的方式中，离线管理指令还包括至少一个第一客户端应用CA标识，至少一个第一CA标识为被授权使用离线管理指令的至少一个第一CA对应的标识；终端的可信执行环境TEE接收终端的富执行环境REE发送的离线管理指令，包括：
TEE接收REE中第二CA发送的离线管理指令；
在TEE执行离线管理指令对应的离线管理操作之前，该管理方法还包括：
当第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致时，TEE执行离线管理指令对应的离线管理操作。
采用该离线管理指令的管理方法，在离线管理指令携带使用者CA标识，限制了不具有使用权限的CA获取合法离线管理指令恶意占用TEE资源。
结合第一方面的第十三种可能实现的方式，离线管理指令为离线删除指令；在TEE确定第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致之后，该管理方法还包括：
当REE中除第二CA之外的至少一个第一CA标识对应的第一CA都不存在时，TEE执行离线管理指令对应的离线管理操作。
结合第一方面或者第一方面的上述任一可能实现的方式，在第一方面的第十五种可能实现的方式中，离线管理指令还包括指示信息，指示信息用于指示同步删除TA所在的SD；
TEE删除所述TA，包括：
当所述TA所在的SD内不存在关联的TA时，TEE删除所述TA以及所述TA所在的SD。
结合第一方面或者第一方面的上述任一可能实现的方式，在第一方面的第十六种 可能实现的方式中，所述离线管理指令包括离线安装TA指令；在所述TEE执行所述离线管理指令对应的离线管理操作之后，包括：
当REE中不存在至少一个第三CA标识对应的第三CA时，TEE删除所述TA；
其中，至少一个第三CA为TEE通过从离线安装所述TA的离线安装TA指令或从离线安装的所述TA中获取并记录至少一个第三CA标识，至少一个第三CA标识对应的至少一个第三CA为REE需要使用所述TA的CA；其中，离线安装TA指令中包括至少一个第一CA标识，至少一个第一CA标识为被授权使用离线安装TA指令的至少一个第一CA对应的标识；至少一个第三CA中包括至少一个第一CA标识。
第二方面，提供了一种终端，该终端包括可信执行环境TEE和富执行环境REE；该TEE包括接收单元、发送单元和处理单元。所述终端可以执行第一方面或第一方面的任一可能实现的方式中的方法。
第三方面，提供了一种终端，该终端包括包括TEE和富执行环境REE，TEE包括接收器、发送器、存储器和处理器，所述接收器、发送器、存储器和处理器相互连接。所述终端可以执行第一方面或第一方面的任一可能实现的方式中的方法。
第四方面，提供了一种计算机可读存储介质，包括指令，当其在设备上运行时，使得该设备执行第一方面或第一方面的任一可能实现的方式中的方法。
第五方面，提供了一种包含指令的计算机程序产品或计算机程序，当所述指令在计算机上运行时，使得计算机执行第一方面或第一方面的任一可能实现的方式中的方法。
第六方面，提供了一种通信装置，包括处理器，处理器被配置为支持通信装置执行第一方面或第一方面的任一可能实现的方式中的方法。
基于提供的一种离线管理指令的管理方法和终端，终端的TEE根据离线管理指令中携带的离线管理参数生成离线管理策略，并根据离线管理策略判断根据离线管理指令安装或更新的SD或TA是否符合恶意占用TEE资源的情况，使终端的TEE具有主动防御重放、DoS攻击等能力。
附图说明
图1为本发明实施例提供的一种离线管理指令部署的方式示意图；
图2为本发明实施例提供的一种离线管理方法的流程示意图；
图3为本发明实施例提供的一种离线管理指令的管理方法的流程示意图；
图4为本发明实施例提供的另一种离线管理指令的管理方法的流程示意图；
图5为本发明实施例提供的一种TEE内部结构示意图；
图6为本发明实施例提供的另一种离线管理指令的管理方法的流程示意图；
图7为本发明实施例提供的又一种离线管理指令的管理方法的流程示意图；
图8为本发明实施例提供的再一种离线管理指令的管理方法的流程示意图；
图9为本发明实施例提供的一种终端结构示意图；
图10为本发明实施例提供的另一种终端结构示意图
图11为本发明实施例提供的一种通信装置示意图。
具体实施方式
在本发明实施例中，终端包括两个共存的运行环境：REE和TEE。REE中运行客户端应用(client application，CA)，TEE中运行TA。TEE是相对REE具备特定安全功能的运行环境。TEE是存在于终端内与REE相分离的安全区域，具体实现可以是主处理器的一种安全模式，也可以是与主处理器相隔离的协助处理器。TEE与REE，以及REE中的CA分离，确保各种敏感数据在一个可信环境中被存储、处理和被保护。TEE为TA提供了一个安全的执行环境，包括执行过程中完整性验证，与REE中CA的安全通信，可信存储、与外界安全终端的输入与输出、密钥和加密算法管理、时间管理等。
在TMF下，为了保证TEE的安全性，TEE对外部实体OWE发送的各种远程管理指令，如对创建SD、安装TA指令进行鉴别(Authentication)和授权(Authorization)验证后，才会执行相应的管理操作。其中，OWE是具有TEE管理功能的实体，通常是指一个可信服务管理服务器(Trusted Service Manager，TSM)。
SD在TEE的远程管理中作为服务提供商(service provider，SP)和/或OWE在TEE中的代表。TEE通过SD实现不同OWE之间的隔离功能，SD中被部署了用于与外部实体之间建立安全通道或是进行授权令牌验证的密钥。TMF中定义的所有的管理操作(administration operation)都由SD执行，一个SD负责管理与它关联的子SD和TA。在TMF框架中，SD在创建时就被赋予了不同的权限。
在TMF中将SD按照功能，分为SD-A(SD-Authorize)，SD-P(SD-Process)，SD-T(SD-Target)。SD-A是具备token验证功能的SD；SD-P是接收并执行指令，进行管理操作的SD；SD-T是指指令的实施对象，如当一条指令指示在SD1中安装TA1，则SD1是SD-T。SD-A信息在token中，SD-P信息与传输层、安全层以及业务相关。在加密场景下，如果对离线管理指令进行了加密，那么只有正确的SD-P才能成功进行解密。
当一个SD(SD-P)接收到一条远程管理指令时，对于管理指令授权的验证，可以通过TMF规定的安全层协议，与生成指令的OWE建立安全通道来隐式的验证，验证通过后，如果SD具备管理指令相对应的权限，则SD执行相应的管理操作。或者，如果管理指令中携带了授权令牌，且授权令牌中指示的验证SD(SD-A)是SD-P的上级SD，则在使用上级SD内的验证密钥验证授权令牌，验证通过且SD-A具备相应管理权限后，SD-P完成对管理指令授权的显式验证，并执行相应的管理操作。
在TEE的离线管理场景下，离线管理指令就是通过携带授权令牌来显式授权。使用授权令牌进行显式授权，不需要SD与其管理者OWE之间使用安全层协议建立实时的安全通道进行直接通信，只需要保证有附带授权令牌的合法离线管理指令被发送到目标SD即可被验证与执行，所以这种情况下就可以实现对TEE的离线管理模式，即不需要直接和SD管理者实时交互即可通过合法的离线管理指令对TEE进行离线管理。采用离线管理存在以下好处：
1、便于SP对TA的快速部署，比如如图1所示，可以将离线管理指令发送到各种应用管理服务器，或者将离线管理指令与CA安装包打包成应用数据包放置在CA APK的应用管理服务器中。
例如当终端的REE需要安装CA时，从应用管理服务器获取包含离线管理指令的应 用数据包，在终端的REE安装CA的过程中直接使用离线安装TA指令对CA需要使用的TA进行离线安装；或者在终端需要更新TA时，直接从应用管理服务器获取包含离线更新TA指令的应用数据包，并通过离线更新指令对TA进行更新。SP无需为每台设备或每个TEE生成单独的TA更新指令，实现了TA的快速部署。
2、无需在线去SP或TEE issuer的TSM申请创建SD、安装TA，减轻服务器侧的负载。
3、对于用户来讲，无需在终端使用时临时去下载TA，减少了临时下载的等待时间，也不会出现下载过程中由于通信传输中断或通信传输错误而重新下载的情况。
在使用授权令牌进行显式授权时，因为不存在目标SD与其管理者OWE直接的直接通信，OWE授权由授权令牌来体现。TMF通过在授权令牌中增加约束参数来限制授权令牌的使用条件，以此来减少对离线管理指令的过度使用。比如，可以针对设备标识(device ID)，产品型号(model ID)，版本信息以及其他一些厂商自定义的约束条件来对离线管理指令的使用条件进行限制。因为授权令牌是为了解决离线场景下的信任或授权验证的问题，所以目前在授权令牌中增加约束参数还不能防止重放，DoS攻击(DoS attack)的问题，只能通过约束参数尽可能的去限制管理指令的使用条件，减少安全隐患。TEE不具备对重放、DoS攻击的主动防御能力，依然会被一些应用(CA)恶意获取合法的离线管理指令，并发送到TEE进行使用(如安装“僵尸应用”)，占用TEE资源影响TEE的正常使用。其中，僵尸应用是只指TEE内一些不必要的，不会被CA使用的应用。
在编码过程中，令牌约束(token constrain)的编码可以包括表1的内容：
表1
标签(Tag) 长度(Length)    八字节值(Value Octets)     Preseence
约束标签(ConstraintTag) L 令牌约束值M
其中，在令牌约束值(token constraint value)中可以包括表2所示的内容：
表2
约束名称 ITU-X680 符号约束标签八位字节的标识符值 (ConstraintTag Octet Identifier Vales) 约束值
约束设备(ConstraintDeviceID)    [PRIVATE1] UUID 0xc1 UUID
约束设备型号(ConstraintModelID) [PRIVATE2] UUID 0xc2 UUID
约束最小版本(ConstraintMinVersion) [PRIVATE3] INTEGER 0xc3 最小版本(整数)
约束最大版本(ConstraintMaxVersion) [PRIVATE4] INTEGER 0xc4 最大版本(整数)
约束参数摘要(ConstraintParamsDigest) /0xe0 命令参数的摘要为约束参数摘要
预留空间(Reserved for future use) 任何私有类基本类型的标签号的范围[6-30]；
任何私有类构建类型的标签号的范围[1-30] [0xc5-0xde]
[0xe1-0xfe] 预留
专有扩展(proprietary extensions)   具体提供商指定
本发明实施例提供了一种离线管理指令的管理方法和终端，该终端的TEE具有主动防御重放、DoS攻击的能力。如图2所示，通过管理指令生成者(SP-TSM或OWE)设置离线管理参数，并通过OWE生成离线管理指令通过图1的两种形式部署在应用管理服务器。当终端从应用管理服务器获取到离线管理指令时，根据离线管理指令中的离线管理参数生成离线管理策略，并在后续基于离线管理策略对根据离线管理指令安装或更新的SD或TA进行管控，主动对离线管理指令可能被恶意使用的场景进行识别。
在本发明实施例中，离线管理参数可以为时间参数或者次数参数，例如离线管理参数可以为使用时间阈值和使用次数阈值中的至少一种。离线管理指令可以包括安装SD、安装TA，更新SD和更新TA，删除SD和删除TA等。
在本发明实施例中提到的终端(terminal)也可以称为系统、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、移动终端、无线通信设备、用户代理、用户装置或用户设备(user equipment，UE)。例如，终端可以是蜂窝电话、无绳电话、智能手表，可穿戴设备，平板设备，无人机，售货机，传感器设备，会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助手(personal digital assistant，PDA)、具备无线通信功能的手持设备、计算设备、车载通信模块、智能电表、智能家庭设备或连接到无线调制解调器的其它处理设备。
下面结合附图3至8对本发明实施例的技术方案进行描述。
图3为本发明实施例提供的一种离线管理指令的管理方法的流程示意图。如图3所示，该管理方法可以包括以下步骤：
S101，TEE接收REE发送的离线管理指令。
终端的REE从应用服务器获取到离线管理指令后，通过Client API或其他通讯方式与TEE建立会话，并向TEE发送离线管理指令。可选地，在本发明实施例中，该离线管理指令可以包括但不限于安装SD，安装TA，更新SD，更新TA，删除SD和删除TA。
离线管理指令中包括离线管理参数，该离线管理参数可以包含在离线管理指令中的一个字段中，该字段可以为一个现有离线管理指令的一个扩展字段；或者可以作为授权令牌token的扩展字段。该离线管理参数可以包括使用时长阈值和使用次数阈值中的至少一种。
S102，TEE执行离线管理指令对应的离线管理操作，并根据离线管理参数生成离线管理策略。
在本发明的一个实施例中，TEE接收到REE发送的离线管理指令后，对离线管理指令进行完整性、离线授权验证，以及其他必要的指令使用条件的判断。比如该离线管理指令为离线安装TA指令，则TEE对该离线安装TA指令进行完整性、离线授权验证后，还会判断所要安装的TA是否已经存在于TEE中，TEE是否有足够的空间安装该TA，验证统一识别标识(Universal Unique Identifier，UUID)的合法性。其中，UUID是用来标识SD和TA的，UUID可以使用RFC 4122标准来构造。
在本发明实施例中，终端获取到离线管理指令，判断是否执行该离线管理指令。 例如该离线管理指令为离线安装TA指令，终端判断是否执行该离线安装TA指令可以有两种方式：1、REE通过TEE提供的查询接口确认TA是否存在，进而判断是否执行该离线安装TA指令；2、REE将离线安装TA指令发送给TEE，TEE根据关联信息判断是否执行该离线安装TA指令。
REE通过TEE提供的查询接口判断是否执行该离线安装TA指令的过程可以具体为：先确定所要安装的TA是否存在，若存在，则终止TA的安装；若不存在，则进一步判断所以安装的TA对应的SD是否存在。若SD存在，则执行离线安装TA的过程；若SD不存在，则创建SD，再安装TA，其中，该离线管理指令中包含了创建SD的指令。
REE将离线安装TA指令发送给TEE，TEE根据关联信息判断所要安装的TA是否已经存在于TEE中的过程可以具体为：TEE接收到REE发送的离线安装TA指令后，根据离线安装TA指令中的TA标识，判断TEE内是否安装了所述TA。若TA存在，则终止TA的安装；若不存在，则进一步根据离线安装TA指令中的SD-T标识，判断TA对应的SD是否存在。若存在，满足离线TA安装指令的使用条件，执行离线安装TA的过程；若SD不存在，则创建SD，再安装TA，其中，该离线管理指令中包含了创建SD的指令。
当TEE对离线管理指令的授权验证通过，且满足执行该离线管理指令的各种条件时，TEE根据离线管理指令执行相应的离线管理操作，并根据离线管理指令中的离线管理参数生成离线管理策略。
在本发明的一个实施例中，当离线管理指令为包括离线安装SD指令或离线更新SD指令，离线管理参数可以为使用时间阈值或者使用次数阈值时，TEE生成的离线管理策略可以为在使用时长阈值内或者在使用次数阈值内接收到向所述SD进行TA安装的离线安装TA指令。
在本发明的另一实施例中，当离线管理指令为离线安装TA指令或离线更新TA指令，离线管理参数可以为使用时间阈值或者使用次数阈值时，TEE生成的离线管理策略可以为在使用次数阈值内或使用时长阈值内进行预设操作。
在本发明的一个实施例中，预设操作可以为TA在线认证过程，即TA通过与OWE进行交互并互相认证的过程。TA在线认证可以起到TEE与OWE双向认证的效果。TEE通过在线认证，可以确定离线安装的TA的确是要承载具体业务，且版本符合OWE的业务要求；而OWE通过在线认证过程可以验证TEE和TA的合法性，进而确保TA是运行在合法的TEE中，后续可以对其进行业务的个人化配置。
在一个实施例中，TA提交TA的元数据、和/或TA数据的摘要，和/或TA的凭证信息，和/或TEE对TA相关数据的签名到服务器进行认证，服务器在信息确认后，完成对TA的在线认证，并向TEE发送认证结果和/或更新TA状态的管理指令。比如，某TA在安装后，在服务器进行用户注册绑定后才能开展业务，则预设操作可以是TA通过服务器的在线验证，满足业务的使用条件，如TA版本条件和TEE版本条件后，服务器执行用户的注册绑定过程，使TA在完成注册绑定后正常开展业务。对于被离线安装的TA，如果未在离线管理策略中规定的使用时间阈值或使用次数阈值内进行该TA验证与注册绑定过程，则TEE判断对该TA的离线安装满足可能恶意占用TEE资源的场景，删除该TA。
在本发明实施例中，预设操作包括但不限于TA在线认证。预设操作还可以为其他 的操作，该操作按照一定的管理逻辑执行可以保证根据离线管理指令安装的SD或TA，或者更新的SD或者TA为满足业务使用条件的SD或TA，或者为确定承载业务的SD或TA。
可选地，在本发明的一个实施例中，TEE可以根据离线管理指令在预设SD内安装或更新TA，预设SD为已存在的SD或者临时创建的SD。例如，离线管理指令为离线安装TA指令，TEE通过离线安装TA指令进行TA安装时，TEE将该TA先安装在预设SD中，而不安装在离线管理指令中包括的目标SD标识对应的SD-T内，即不直接将该TA与离线管理指令中指示的SD-T进行关联。通过这种方式，便于TEE对离线安装的TA进行统一管理。TEE保存该离线安装的TA和SD-T的对应关系，当后续该离线安装的TA经过在线认证后，再将该TA“迁移”到离线管理指令指示的SD-T中，即建立该TA和SD-T的关联信息。
在本发明的一个实施例中，在TEE根据离线管理指令执行离线管理操作之后，TEE更新关联信息，并将根据离线管理指令离线安装的SD或TA或者根据离线管理指令离线更新的SD或TA标记为离线状态。即，TEE可以通过在关联信息中标记的方式，区分以在线和离线方式安装/更新的SD或TA，标记信息可以是TEE根据安装/更新方式不同自动添加的，也可以是利用离线管理指令中的参数生成的。在一个实施例中，可以通过在关联信息中保存与SD/TA关联的离线管理策略确定所述SD/TA是否属于离线安装/更新的。在一个实施例中，所述将SD/TA标记为离线状态可以通过设置SD/TA的生命周期状(lifecycle state)实现。所述TEE响应于离线管理指令中的指示，将离线安装/更新后的SD/TA的生命周期状态设置为离线状态。当执行过在线认证后，OWE通过管理指令将离线安装或更新的SD/TA的生命周期状态切换到激活(Active，针对SD)/可执行(executable，针对TA)状态。所述离线的生命周期状态，可以是现有TMF标准中的LOCK/Restricted状态和/或对其的扩展，也可以是针对离线安装场景新增的生命周期状态，本发明在此不做限定。
其中，关联信息中包括生命周期状态，SD与TA的关联关系，即TEE中安装的SD与TEE中安装的SD内安装的TA的对应关系。在本发明实施例中，关联信息中还可以记录离线管理策略、SD与TA的对应关系。可选地，在本发明实施例中，关联信息可以以表格形式呈现其信息，关联信息可以是TEE保存的，记录的各SD、TA信息的注册表。
在一个实施例中，离线管理指令指示将TA安装到SD-T，当TEE将离线安装的TA安装到预设SD中，更新关联信息时，记录TA、SD-T、离线管理策略、预设SD之间的关联关系。当REE中的CA发起对SD-T内已安装TA的查询时，可以获取到该SD内有一个离线安装的TA的信息，但是在TEE内，SD-T和预设SD都具备对该离线TA的管理权限，当TA完成在线认证时，移除离线管理策略、预设SD与该TA的关联关系，将管理权限完全移交SD-T。
在S102之后，TEE根据离线管理指令安装的SD或TA、或者更新的SD或TA的使用状态确定是否满足离线管理策略。
例如，TEE获取离线安装或离线更新的SD的使用状态，判断是否在离线管理策略规定的使用时长阈值或者使用次数阈值内接收到向该SD内安装TA的离线安装TA指令， 如果未接收到，则删除该SD。
又例如，TEE获取离线安装或离线更新的TA的使用状态，判断是否在离线管理策略规定的使用时长阈值或者使用次数阈值内进行了预设操作，如果未进行预设操作，则删除该TA。其中，预设操作可以为TA的在线认证操作。
S103，当根据离线管理指令安装的SD或TA、或者更新的SD或TA的使用状态不满足所述离线管理策略时，TEE删除根据所述离线安装指令安装的SD或TA、或者更新的SD或TA，或者TEE将所述SD或所述TA还原到更新前的状态。
在本发明实施例中，离线安装的SD或TA，和离线更新的SD或TA的使用状态可以包括该SD或TA被使用/调用的次数和使用时长等使用状态。
可选地，预设操作可以为TA在线认证。当完成离线TA的安装后，TEE对离线TA的运行状态进行检测与记录，并确定其使用状态是否满足离线管理策略。若该离线TA未按照离线管理策略的要求进行在线认证，即TA的使用状态不满足离线管理策略：在使用时长阈值或者使用次数阈值内进行在线认证，则TEE对该TA执行删除操作。若该离线TA在离线管理策略规定的使用状态前，完成了在线认证，则通过在线认证过程解除基于离线管理策略对TA的限制进行移除，经过在线认证的TA即可被视为正常TA。
例如，离线管理参数是使用次数阈值时，TEE每次在检测到该离线TA被调用时，将为该离线TA生成的计数器+1。当离线管理策略指示必须在TA被调用2次内进行在线认证，TEE根据该计数器对TA的使用情况进行判断，当该TA使用次数达到2次且仍未进行在线认证以解除基于离线管理策略对所述SD或TA的限制时，TEE对该TA执行删除操作。
当离线管理参数是使用时间阈值时，TEE根据安装离线TA时记录的安装时间和TEE的可信时钟，以及离线管理策略中的时间要求，对该TA的运行状态进行检测，并确定其使用状态是否满足离线管理策略。
可选地，在本发明的一个实施例中，该管理方法还可以包括：
TEE根据记录的离线安装或更新的SD的使用状态在终端的界面上显示第一提示信息，第一提示信息用于提示用户在离线安装或更新的SD内安装TA；或者，
TEE根据离线安装或更新的TA的使用状态在终端的界面上显示第二提示信息，第二提示信息用于提示用户触发预设操作。
换句话讲，就是TEE可以通过主动提示的方式，在TEE/REE侧的界面(UI)生成通知信息，提示用户发起在SD内安装TA的操作，或者在线激活的操作。
在本发明的另一实施例中，当根据离线管理指令安装的SD或TA、或者更新的SD或TA的使用状态不满足所述离线管理策略时，即离线更新的SD未在离线管理策略规定的使用时长阈值或使用时长次数内接收到向该SD安装TA的离线安装TA指令，则将离线更新的SD还原到更新前的状态；离线更新的TA未在离线管理策略规定的使用时长阈值或使用时长次数内执行TA在线认证，则将离线更新的TA还原到更新前的状态。
例如，离线更新TA，当TEE获取到新版本的TA后，暂时不删除旧版本TA代码，直到新版本TA使用状态满足离线管理策略后，再删除旧版本TA代码；或者新版本TA不满足离线管理策略时，删除新版本TA并恢复到旧版本TA。
采用本发明实施例提供的TEE基于离线管理策略对离线管理操作进行管控，TEE 具有了主动防御恶意应用占用TEE空间资源的能力，避免了重放、DoS攻击等问题，提升了TEE资源的使用率，增强了TEE离线场景下的安全性。
可选地，如图3所示，该管理方法还可以包括：
S104，当TEE根据离线管理指令安装的SD或TA，或者更新的SD或TA的使用状态满足离线管理策略时，TEE解除基于离线管理策略对离线安装的SD，或者离线安装的TA，或者离线更新的TA的限制。
在本发明实施例中，根据TEE对离线管理流程的处理逻辑，TEE解除基于离线管理策略对离线安装的SD，或者离线安装的TA，或者离线更新的TA的限制，可以包括以下几种情况之一：
1、TEE删除所述离线管理策略；例如，删除关联信息中根据离线管理策略标记的离线安装或更新的SD/TA的标记。
2、TEE取消根据离线管理指令安装的SD或TA，或者更新的SD或TA处于离线状态的标记；例如，TEE取消根据离线管理指令安装或更新的SD/TA时自动生成的标记。
3、TEE根据OWE对TA/SD的在线认证结果或响应于OWE在对TA/SD在线认证后发送的在线管理指令，将关联信息中与根据所述离线管理指令安装的SD或TA，或者更新的SD或TA对应的离线生命周期状态修改为可执行状态。例如，TEE修改根据生命周期状态标记的离线安装或更新的SD/TA的标记。
在本发明的一个实施例中，将关联信息中的离线生命周期状态修改为可执行状态可以为将受限运行的生命周期切换至可以正常运行的生命周期。这里的可以正常运行的生命周期是指能够正常使用，在具备权限时正常调用TEE资源，正常响应CA的调用。
可选地，如图4所示，在本发明的一个实施例中，当TEE根据离线管理指令执行离线管理操作时，比如离线安装TA，将TA安装在了预设SD内，则该管理方法还可以包括：
S105，TEE将离线安装或离线更新的TA从预设SD迁移到目标SD标识对应的目标SD内，并删除关联信息中预设SD与离线安装或离线更新的TA的对应关系。
需要说明的是，在本发明实施例中编号仅仅表示逻辑上的一种实现方式，并不代表全部。其中，S104和S105在本发明实施例中可以同时执行，也可以分别先执行，对此不作限制。
可选地，在本发明的一个实施例中，在离线安装或更新的SD/TA的使用状态满足离线管理策略之前，该管理方法还可以包括：
TEE对离线安装的SD或TA，或离线更新的SD或TA的资源访问权限进行限制。例如：对于离线安装的TA，在没有经过在线认证前，可以对TA能访问的TEE资源进行限制，防止出现利用离线安装的有漏洞的旧版本TA对TEE进行攻击。例如，限制离线安装的TA调用TEE的计算、存储资源或是发起对其他TA、TEE API的访问权限。
在本发明实施例中，TEE具有限制或允许离线安装或更新的SD/TA的资源访问权限的能力，可以通过在离线管理指令中设置权限信息，以指示限制或者允许离线安装或更新的SD/TA进行资源访问的权限，或者TEE自身根据预设逻辑对离线安装或更新 的SD/TA资源访问权限进行管理。
可选地，在本发明实施例中，如图4所示，在TEE根据离线管理指令执行离线管理操作之前，该管理方法还可以包括：
S106，确定离线管理指令的标识信息是否包含在TEE保存的第一信息中。
第一信息中包括TEE拒绝执行的离线管理指令的标识信息。在本发明实施例中，该第一信息也可以称为黑名单。通过维护黑名单的方式来实现对离线管理指令的使用限制。
其中，离线管理指令中的标识信息可以包括离线管理指令的标识，离线管理指令的摘要和离线管理指令所要离线管理的SD的标识或TA的标识中的至少一种，或者采用能够对离线管理标识起到标识作用的其他信息，在本发明实施例中对此不作限制。
当TEE确定离线管理指令中包括的标识信息未包含在TEE保存的第一信息中，则执行S102，否则，则取消该离线管理指令的执行。
可选地，在本发明的一个实施例中，当离线安装或者更新的SD/TA的使用状态未满足离线管理策略时，例如当通过离线管理指令安装的SD或TA，或者更新的SD或TA被TEE删除的次数达到预设阈值时，TEE将离线管理指令的标识信息添加至第一信息。
比如，TEE可以根据离线TA1的使用状态和离线管理策略，在TA1的使用状态不满足离线管理策略时删除TA1。TEE记录因不满足离线管理策略的情况下被删除的TA/SD信息，并根据TEE设定的预设阈值，当TA1被重复安装并因使用状态不满足离线管理策略后被删除的次数达到预设阈值时，TEE识别出安装该TA1的离线管理指令可能被恶意使用，将离线安装的TA删除，同时通过将该离线TA或离线TA安装指令加入黑名单的方式拒绝该离线安装TA1指令后续再次被执行。
可选地，在本发明的一个实施例中，当TEE清理并释放存储空间时，可以优先删除离线安装或更新的SD/TA。TEE可以根据被标记为离线状态的TA的使用状态，对满足空间清理预设条件的离线安装或离线更新的TA进行删除，并释放存储空间。
通过图3和图4中提供的离线管理指令，对于接收到该离线管理指令的SD，只要令牌(token)中指示的SD-A与其是直接关联或间接关联关系，只要该授权令牌能够通过SD-A中的验证密钥进行验证，且验证通过后，该SD就能执行该离线管理指令中指示的管理操作，比如，图5中SD-2执行向SD-1内安装TA的操作，在经过SD-A对token验证后即可执行该离线管理指令对应的离线管理操作。
可以想象，当前的访问控制机制，都无法防止这种情况下离线管理指令被恶意使用。即使可通过Client API对能够访问SD/TA的CA进行限制，只要一条合法的指令能够被发送到任一与SD-A有直接或间接关联的SD且满足使用条件，就能够被执行，依然会存在合法的离线管理指令被CA恶意使用的情况。
因此，本发明还提供了一种离线管理指令的管理方法，通过将离线管理指令与离线管理指令的合法使用者进行绑定，实现当只有在特定离线管理指令由指定或授权的CA(合法使用者)发送到TEE时才能够被执行，进一步对离线管理指令的使用条件进行限制，进而减少离线管理指令被非授权CA获取并恶意使用的情况。
OWE在生成离线管理指令时，在离线管理指令中添加离线管理指令使用者的标识， 将离线管理指令与离线管理指令使用者的关系进行绑定。
比如，生成离线安装TA指令1时，OWE可以将Client A、Client B的标识信息作为离线安装指令的元素，以实现只有Client A或Client B能够使用该指令进行离线TA安装的效果。
其中，在本发明实施例中，离线管理指令使用者的标识可以是CA的包名、APK的证书或证书哈希、APK公钥等能够唯一标识CA身份的信息。离线管理指令使用者标识，可以作为token的参数，也可以作为操作层离线管理指令的参数，该离线管理指令使用者的标识可以设置在离线管理指令的扩展字段中，在本发明实施例中不做限定。
OWE生成离线指令后可以按照图1的方式将其放置在应用服务器中，具体过程请参见图1的描述，为简洁描述在此不再赘述。终端需要时从应用服务器获取离线管理指令。
需要说明的是，在本发明实施例中提到的“第一”，“第二”和“第三”仅仅是为了区分信息，并不对信息本身作限定。
本发明实施例提供的方案可以应用在图3和图4所示的管理方法中，即应用在TEE接收到REE中CA发送离线管理指令之后，且在TEE执行离线管理指令对应的离线管理操作之前。
如图6所示，该管理方法可以包括以下步骤：
S201，TEE接收REE中第二客户端应用CA发送的离线管理指令。
该离线管理指令包括允许使用离线管理指令的至少一个第一CA对应的至少一个第一CA标识。
当终端的REE获取到离线管理指令后，通过客户端Client API或者其他通信方式将离线管理指令发送给TEE。TEE接收到REE中的CA发送的离线管理指令时，获取与其建立会话的使用者CA的CA标识。
可选地，TEE可以通过系统底层，如Linux Kernel层提取，或者其他安全技术提取去获取发送离线管理指令的CA对应的CA标识，以减小使用者身份被仿冒的风险。
在S201之后，TEE验证第二CA对应的第二CA标识是否与至少一个第一CA标识中的任一第一CA标识一致。
S202，当第二CA标识与至少一个第一CA标识中的一个第一CA标识一致时，TEE执行离线管理指令对应的离线管理操作。
当发送离线管理指令的CA的标识与离线管理指令中被授权使用该离线管理指令的CA的标识不一致时，拒绝执行管理操作并返回错误码。
例如，第二CA为CA1，离线管理指令中包括的至少一个第一CA标识有两个：CA1的标识和CA2的标识；REE中的CA1向TEE发送离线管理指令后，TEE将发送离线管理指令的CA1的标识与离线管理指令中包括的被授权使用该离线管理指令的CA1的标识和CA2的标识中的每一CA的标识进行对比；当发送离线管理指令的CA1的标识与离线管理指令中的被授权使用该离线管理指令的CA1的标识一致时，TEE确定发送离线管理指令的CA1有权使用该离线管理指令，TEE执行该离线管理指令。
在本发明实施例中，CA标识可以通用PKI机制实现验证，即OWE分别对离线管理指令和应用数据包(如安卓的APK、iOS的IPA包)进行签名，在REE侧CA向TEE发 送离线管理指令时，TEE对离线管理指令和应用数据包签名者进行验证，确保它们是由同一OWE进行过签名，以此来证明OWE授权该CA使用该离线管理指令。
或者，OWE对APK进行签名，并将用于验证签名的公钥加入离线管理指令。当TEE接收到离线管理指令后，提取OWE的公钥验证OWE对使用者应用数据包的签名进行验证，来确认OWE授权该CA使用该离线管理指令。
在本发明实施例中，第一CA标识和第二CA标识可以是CA数据包的名称、CA数据包证书、CA数据包证书的摘要、CA数据包签发者公钥、或其他CA唯一标识信息(如UUID等)中的至少一项，例如CA包名、APK证书、APK证书摘要、APK签发者公钥。
所述第一CA标识可以作为离线管理指令中的元素，可以包括在离线管理参数中，也可以包括在离线管理指令的扩展字段中，也可以包括在token中。
可选地，在本发明实施例中，离线管理指令为离线删除指令；在TEE确定第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致之后，该管理方法还包括：
S203，当TEE确定REE中除第二CA之外的至少一个第一CA标识对应的第一CA都不存在时，TEE执行离线管理指令对应的离线管理操作；当TEE确定REE中除第二CA之外的至少一个第一CA标识对应的第一CA中的任一第一CA存在时，拒绝执行该离线管理指令。
例如：REE中的CA1发送离线管理指令，离线管理指令中包括CA1的标识、CA2的标识和CA3的标识，说明CA1、CA2、CA3被授权使用所述离线管理指令，这也隐含意味着REE中的这三个CA需要使用TA(或者对该TA存在业务依赖关系)；当TEE确定REE中仅存在CA1、CA2和CA3中的CA1，不存在CA2和CA3时，TEE执行离线管理指令对应的管理操作；当REE中除存在CA1外，还存在CA2或CA3中任一个CA时，即REE中还存在除CA2外其他需要使用该TA的CA时，TEE都拒绝执行该离线管理指令。
在本发明的一个实施例中，该离线管理指令还可以为离线删除指令，包括离线删除SD指令，离线删除TA指令。
例如，离线删除指令为离线删除TA指令，离线删除TA指令中可以包括所要删除TA的TA标识被授权使用该离线管理指令的至少一个第一CA标识。
在离线管理指令安装了TA后，当离线删除TA指令用于删除TA时，TEE获取REE中的CA信息，以及TEE从离线安装TA指令或者从离线安装TA获取并记录的至少一个第三CA标识来判断REE中可能会使用该TA的至少一个第三CA标识对应的至少一个第三CA是否全部都不存在；当任何一个第三CA还存在时，就说明还有CA需要使用该TA，该TA就不能被删除，即不满足离线删除TA的条件，拒绝执行删除该TA的操作。其中，第三CA标识可以为离线安装TA时，用于离线安装TA的离线安装TA指令包括的被授权使用该离线安装TA指令的一个、两个或多个CA对应的CA标识，以及离线安装TA记录的该TA可以被特定CA使用的CA对应的CA标识。例如，至少一个第三CA标识可以为被授权使用该离线安装TA指令的CA1、CA2和CA5的标识，以及TA记录的其能够被特定CA1、CA2、CA3和CA4、CA5使用的CA1、CA2、CA3和CA4、CA5的标识。
可选地，在本发明的一个实施例中，该离线删除TA指令包括离线管理参数，该离线管理参数包括使用时长阈值，当允许使用该TA的至少一个第三CA标识对应的至少 一个CA全部不存在于REE中时，TEE确定至少一个第三CA标识对应一个的至少一个第三CA不存在于REE中的最小时长超过使用时长阈值时，执行删除该TA的操作。这里的最小时长的计时方式为从所有第三CA都不存在于REE中开始计时，即至少一个第三CA中的最后一个第三CA被删除时开始计时。
在本发明实施例中，CA预先将离线管理指令发送到TEE，TEE缓存离线管理指令，并能够获取REE中CA的应用变化情况；TEE从离线删除指令获取允许使用离线删除指令的CA信息或从TA获取需要使用该TA的所有CA的信息，当需要使用该TA的所有的CA都被删除时，TEE记录CA被删除的事件，并记录删除时间。当离线管理指令中的CA中的最后一个CA被删除，即所有的CA标识对应的CA都不存在时，TEE开始计时，当达到使用时长阈值，且在该使用时长阈值的时间范围内没有安装该被删除的CA时，TEE确定该被删除的CA被彻底删除不再被使用，这时，TEE再执行删除该TA的操作。
例如，至少一个第三CA标识为CA1、CA2、CA3、CA4和CA5的标识，当TEE缓存了离线删除TA的指令后，TEE确定REE中是否还存在CA1、CA2、CA3、CA4和CA5，当CA1、CA2、CA3、CA4和CA5都不在REE中时，执行该离线删除TA指令。
在本发明的一个实施例中，如图7所示，该管理方法可以包括以下步骤：
S301，TEE接收REE中第二CA发送的离线删除指令。
该离线删除指令包括所要删除TA的TA标识、至少一个被授权使用该离线删除TA指令的至少一个CA标识和离线管理参数。可选地，在本发明实施例中，离线管理参数可以包括使用时长阈值。
S302，TEE确定第二CA对应的第二CA标识是否与至少一个第一CA标识中的任一第一CA标识一致。
当所述第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致时，执行S303，否则拒绝执行该离线删除指令对应的离线管理操作。
S303，TEE确定REE中是否存在与所要删除的TA的TA标识相关联的至少一个第三CA标识对应的至少一个第三CA。
其中，至少一个第三CA为可以使用该TA的CA。所述至少一个第三CA标识为所述TEE根据所述离线安装该TA指令或者从离线安装该TA获取并记录的允许使用该TA的至少一个第三CA对应的标识。
TEE记录REE中CA的使用情况，并根据至少一个第三CA标识确定REE中是否还存在至少一个第三CA标识对应的至少一个CA，当至少一个第三CA中的每一个第三CA都不存在REE中时，执行S304，否则，拒绝执行该离线删除指令。
S304，TEE确定REE中不存在至少一个第三CA的时长是否达到使用时长阈值。
在本发明的一个实施例中，从至少一个第三CA中的每一个第三CA都不存在于REE中开始计时，当至少一个第三CA不存在于REE中的时长达到使用时长阈值时，执行该离线删除指令，即执行S305，否则拒绝执行该离线删除指令。
S305，TEE删除TA。
例如，REE中的CA1发送的离线删除TA指令，离线删除TA指令中包括被授权使用该离线删除TA指令的CA1和CA5的标识；TEE接收到CA1发送的离线删除TA指令后，确定发送离线删除TA指令的CA1的标识是否与离线删除TA指令包括的被授权使 用该离线删除TA指令的两个CA1和CA5中一个CA的标识一致；当一致时，TEE确定可以使用该TA的至少一个第三CA标识对应的第三CA(CA1、CA2、CA3、CA4和CA5)是否还在REE中，当CA1、CA2、CA3、CA4和CA5都不在于REE中时，TEE再确定CA1、CA2、CA3、CA4和CA5不在REE中的时长是否达到使用时长阈值，例如1小时，可选地，当CA1、CA2、CA3、CA4和CA5中最后一个不在REE中的时长达到1小时时，TEE删除该TA。
可选地，在本发明的一个实施例中，离线管理指令中还包括指示信息，用于指示同步删除与所要删除的TA关联的SD，当所要删除的TA关联的SD在该TA删除后不包含其他TA后，删除该SD。在本发明实施例中，离线管理指令中的指示信息可以为指令新增的boolean位。
在本发明的另一实施例中，TEE不根据离线删除指令进行离线删除操作。
例如,当TEE判断离线安装TA的CA被删除时，TEE删除该TA；或者当TEE确定REE中不存在至少一个第一CA标识对应的第一CA时，TEE删除该TA，其中，至少一个第一CA标识为离线安装TA的离线安装TA指令中包括的被授权使用该离线安装TA指令的一个、两个或多个CA对应的CA标识；或者当TEE确定REE中不存在至少一个第三CA标识对应的第三CA时，TEE删除该TA，其中，至少一个第三CA标识为TEE从离线安装TA指令或者离线安装的TA中获取并记录的。
例如，当TEE自动删除TA的条件是根据至少一个CA标识判断时，当TEE根据REE中CA的变化情况，以及TEE保存的离线安装所述TA的至少一个CA对应的至少一个CA标识，确定至少一个CA标识对应的至少一个CA是否还存在于REE中，当至少一个CA标识对应的至少一个CA都不存在于REE中时，TEE自动删除该TA。例如，TEE保存了离线管理指令中的至少一个第一CA标识，即被授权使用所述离线安装指令离线安装TA的有CA1、CA2和CA3，例如，当CA1使用该离线管理指令，TEE离线安装该TA后，TEE确定REE中是否还存在CA1、CA2和CA3，当REE中不存在离线安装该TA的CA1、CA2和CA3中的任一个CA时，删除该TA。
在本发明的另一个实施例中，该离线删除指令还可以为删除SD指令，该删除SD指令中可以包括所要删除的SD的SD标识和至少一个第一CA标识。TEE中保存有包括TA标识与SD的对应关系的关联信息。
在本发明的一个实施例中，如图8所示，该管理方法可以包括以下步骤：
S401，TEE接收REE中第二CA发送的离线删除指令。
其中，离线删除指令中包括所要删除的SD的SD标识，被授权使用该离线删除指令的至少一个第一CA对应的至少一个第一CA标识。可选地，在本发明实施例中，离线删除指令还可以包括离线管理参数，所述离线管理参数可以包括使用时长阈值。
S402，TEE确定第二CA对应的第二CA标识是否与至少一个第一CA标识中的任一第一CA标识一致。
当所述第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致时，执行S403，否则拒绝执行该离线删除指令对应的离线删除操作。
S403，TEE根据关联信息确定TEE中是否包括所要删除的SD对应的SD标识。
当TEE中包括所要删除的SD对应的SD标识，则执行S404；否则，不执行该离线删除指令对应的离线删除操作。
S404，TEE根据关联信息确定所要删除的SD的SD标识是否存在与之相关联的TA或SD标识。
当SD中不存在与其有关联关系的TA时，执行S405，否则拒绝该离线删除指令的离线删除操作。
S405，TEE确定所要删除的SD未接收到TA安装指令的时长是否达到使用时长阈值。
可选地，TEE确定从该所要删除的SD从安装到未接收到TA安装指令的时长是否达到使用时长阈值，当所要删除的SD未接收到TA安装指令的时长达到使用时长阈值，且所要删除的SD内未安装其他TA，且没有与之相关联TA或SD时，则执行S406，否则，拒绝该离线删除指令的离线删除操作。
S406，TEE删除SD。
例如，REE中的CA1发送的离线删除SD指令，离线删除SD指令中包括被授权使用该离线删除SD的CA1和CA5的标识；TEE接收到CA1发送的离线删除TA指令后，确定发送离线删除TA指令的CA1的标识是否与离线删除SD指令包括的被授权使用该离线删除SD指令的两个CA1和CA5中一个CA的标识一致；当一致时，TEE根据关联信息确定TEE中是否包括该离线删除SD指令所要删除的SD对应的SD标识；当关联信息中包括该所要删除的SD的SD标识时，TEE根据关联信息确定该SD内是否存在与之关联的TA或SD，例如与所要删除的SD相关联的TA可以包括TA1、TA2和TA3，当关联信息中不存在与该SD标识对应的TA1、TA2和TA3的标识时，TEE再确定未接收到在该SD内离线安装TA的离线安装TA指令的时长是否满足使用时长阈值，即可选地，从离线安装该SD到确定时长的时刻的时长满足使用时长阈值时，删除该SD。其中，关联信息为TEE保存的SD与TA对应关系的信息。
图9为本发明实施例提供的一种终端结构示意图。如图9所示，该终端包括可信执行环境TEE和富执行环境REE；TEE包括接收单元510和处理单元520。
接收单元510，用于接收终端的富执行环境REE发送的离线管理指令，离线管理指令包括离线管理参数，离线管理参数包括使用时长阈值和或使用次数阈值中的至少一种；
处理单元520，用于执行离线管理指令对应的离线管理操作，并根据离线管理参数生成离线管理策略；
当安全域SD或可信应用TA的使用状态不满足离线管理策略时，处理单元520删除SD或TA，或者将SD或TA还原到更新前的状态；其中，SD或TA是由TEE根据离线管理指令离线安装或更新的。
可选地，在本发明的一个实施例中，离线管理指令包括离线安装SD指令或离线更新SD指令，离线管理策略为在使用次数阈值内或使用时长阈值内接收到离线安装TA指令。
可选地，在本发明的另一个实施例中，离线管理指令包括离线安装TA指令或离线 更新TA指令，离线管理策略为在使用次数阈值内或使用时长阈值内进行预设操作。
可选地，在本发明的一个实施例中，处理单元520，还用于确定离线管理指令的标识信息是否包含在TEE保存的第一信息中，第一信息中包括TEE拒绝执行的离线管理指令的标识信息。
在本发明的一个实施例中，当SD或TA被TEE删除的次数达到预设阈值时，处理单元520还用于将离线管理指令的标识信息添加至第一信息。
可选地，在本发明的一个实施例中，标识信息包括离线管理指令的标识，离线管理指令的摘要，以及离线管理指令所要离线管理的SD标识或TA标识中的至少一项。
可选地，在本发明的一个实施例中，处理单元520执行离线管理指令对应的离线管理操作，包括：
处理单元520根据离线管理指令在预设SD内离线安装TA或离线更新TA。
可选地，在本发明的一个实施例中，处理单元520，还用于更新关联信息，并将SD或TA标记为离线状态；其中，关联信息包括TEE中安装的SD与TEE中安装的SD内安装的TA的对应关系。
可选地，在本发明的一个实施例中，当SD或TA的使用状态满足离线管理策略时，处理单元520解除基于离线管理策略对SD或的TA的限制。
可选地，在本发明的一个实施例中，处理单元520解除基于离线管理策略对SD或TA的限制，包括：
处理单元520删除离线管理策略；或者处理单元520取消SD或TA处于离线状态的标记；或者处理单元520将SD或TA对应的生命周期状态修改为可执行状态。
可选地，在本发明的一个实施例中，离线管理指令还包括目标SD标识；
当TA的使用状态满足离线管理策略时，处理单元520将TA从预设SD迁移到目标SD标识对应的目标SD内，并删除关联信息中预设SD与TA的对应关系。
可选地，在本发明的一个实施例中，处理单元520还用于，在SD或TA的使用状态满足离线管理策略之前，对SD或TA的资源访问权限进行限制。
可选地，在本发明的一个实施例中，
处理单元520，还用于根据SD的使用状态在终端的界面上显示第一提示信息；或者，
处理单元520，还用于根据TA的使用状态在终端的界面上显示第二提示信息。
可选地，在本发明的一个实施例中，离线管理指令还包括至少一个第一客户端应用CA标识，至少一个第一CA标识为允许使用离线管理指令的至少一个第一CA对应的标识；接收单元510用于接收终端的富执行环境REE发送的离线管理指令，包括：
接收单元510接收REE中第二CA发送的离线管理指令；
处理单元520，还用于在处理单元520执行所述离线管理指令对应的离线管理操作之前，当确定第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致时，处理单元520执行离线管理指令对应的离线管理操作。
可选地，在一个实施例中，离线管理指令为离线删除指令；处理单元520，还用于在处理单元确定第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致之后，当确定REE中除第二CA之外的至少一个第一CA标识对应的第一CA 都不存在时，执行离线管理指令。
可选地，在本发明实施例中，离线管理指令还包括指示信息，指示信息用于指示同步删除所述TA所在的SD；
处理单元520删除所述TA，包括：
当确定所述TA所在的SD内不存存在关联的TA时，处理单元520删除所述TA以及所述TA所在的SD。
可选地，在本发明的另一个实施例中，离线管理指令包括离线安装TA指令；
处理单元520还用于，在处理单元520执行离线管理指令对应的离线管理操作之后，当确定REE中不存在至少一个第三CA标识对应的第三CA时，处理单元520删除所述TA；
其中，离至少一个第三CA标识为TEE通过从离线安装所述TA的离线安装TA指令或从离线安装的所述TA中获取并记录的至少一个第三CA标识，至少一个第三CA标识对应的至少一个第三CA为REE需要使用所述TA的CA；其中，离线安装TA指令中包括至少一个第一CA标识，至少一个第一CA标识为被授权使用离线安装TA指令的至少一个第一CA对应的标识；至少一个第三CA中包括所述至少一个第一CA标识。
可选地，在本发明实施例提供的终端中还包括存储单元530，用于存储指令和数据，处理单元520用于调用存储单元530中的指令并执行相应的操作。可选地，该终端还包括发送单元540，用于与其他设备进行数据传输。
该终端中的各功能单元的功能，可以通过图3至图8中所示实施例中的终端所执行的各步骤来实现，因此，本发明实施例提供的终端的具体工作过程，在此不复赘述。
本发明实施例还提供了一种终端，如图10所示，该终端包括接收器610、处理器620、存储器630和发送器640，接收器、发送器、处理器和存储器相互连接，用于完成相互之间的通信，该终端具有执行图3至图8中终端所执行的方法。
其中，该终端用于执行以下操作：
接收器610，用于接收终端的富执行环境REE发送的离线管理指令，离线管理指令包括离线管理参数，离线管理参数包括使用时长阈值和或使用次数阈值中的至少一种；
处理器620，用于执行离线管理指令对应的离线管理操作，并根据离线管理参数生成离线管理策略；
当安全域SD或可信应用TA的使用状态不满足离线管理策略时，处理器删除SD或TA，或者处理器620将SD或TA还原到更新前的状态；其中，SD或TA是由TEE根据离线管理指令离线安装或更新的。
可选地，在本发明的一个实施例中，离线管理指令包括离线安装SD指令或离线更新SD指令，离线管理策略为在使用次数阈值内或使用时长阈值内接收到离线安装TA指令。
可选地，在本发明的一个实施例中，离线管理指令包括离线安装TA指令或离线更新TA指令，离线管理策略为在使用次数阈值内或使用时长阈值内进行预设操作。
可选地，在本发明的一个实施例中，处理器620，还用于确定离线管理指令的标识信息是否包含在TEE保存的第一信息中，第一信息中包括TEE拒绝执行的离线管理 指令的标识信息。
可选地，在本发明的一个实施例中，当SD或TA被TEE删除的次数达到预设阈值时，处理器620还用于将离线管理指令中包括的标识信息添加至第一信息。
可选地，在本发明的一个实施例中，标识信息包括离线管理指令的标识，离线管理指令的摘要，以及离线管理指令所要离线管理的SD标识或TA标识中的至少一项。
可选地，在本发明的一个实施例中，处理器620执行离线管理指令对应的离线管理操作，包括：
处理器620根据离线管理指令在预设SD内离线安装TA或离线更新TA。
可选地，在本发明的一个实施例中，
处理器620，还用于更新关联信息，并将SD或TA标记为离线状态；其中，关联信息包括TEE中安装的SD与TEE中安装的SD内安装的TA的对应关系。
可选地，在本发明的一个实施例中，当SD或TA的使用状态满足离线管理策略时，处理器620解除基于离线管理策略对SD或的TA的限制。
可选地，在本发明的一个实施例中，处理器620解除基于离线管理策略对SD或TA的限制，包括：
处理器620删除离线管理策略；或者处理器620取消SD或TA处于离线状态的标记；或者处理器620将SD或TA对应的生命周期状态修改为可执行状态。
可选地，在本发明的一个实施例中，离线管理指令还包括目标SD标识；
当TA的使用状态满足离线管理策略时，处理器620将TA从预设SD迁移到目标SD标识对应的目标SD内，并删除关联信息中预设SD与TA的对应关系。
可选地，在本发明的一个实施例中，处理器620还用于在SD或TA的使用状态满足离线管理策略之前，对SD或TA的资源访问权限进行限制。
可选地，在本发明的一个实施例中，：
处理器620，还用于根据SD的使用状态在终端的界面上显示第一提示信息；或者，
处理器620，还用于根据TA的使用状态在终端的界面上显示第二提示信息。
可选地，在本发明的一个实施例中，离线管理指令还包括至少一个第一客户端应用CA标识，至少一个第一CA标识为允许使用离线管理指令的至少一个第一CA对应的标识；接收器610用于接收终端的富执行环境REE发送的离线管理指令，包括：
接收器610接收REE中第二CA发送的离线管理指令；
处理器620，还用于在处理器620执行离线管理指令对应的离线管理操作之前，当确定第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致时，处理器620执行离线管理指令对应的离线管理操作。
可选地，在一个实施例中，离线管理指令为离线删除指令；处理器620，还用于在处理器620确定第二CA对应的第二CA标识与至少一个第一CA标识中的任一第一CA标识一致之后，当确定REE中除第二CA之外的至少一个第一CA标识对应的第一CA都不存在时，执行离线管理指令。
可选地，在本发明实施例中，离线管理指令还包括指示信息，指示信息用于指示同步删除所述TA所在的SD；
处理器620删除所述TA，包括：
当确定所述TA所在的SD内不存存在关联的TA时，所述处理器620删除所述TA以及所述TA所在的SD。
可选地，在本发明的另一个实施例中，离线管理指令包括离线安装TA指令；处理器620还用于，在处理器620执行离线管理指令对应的离线管理操作之后，当确定REE中不存在至少一个第三CA标识对应的第三CA时，处理器620删除所述TA；
其中，离至少一个第三CA标识为TEE通过从离线安装所述TA的离线安装TA指令或从离线安装的所述TA中获取并记录的至少一个第三CA标识，至少一个第三CA标识对应的至少一个第三CA为REE需要使用所述TA的CA；其中，离线安装TA指令中包括至少一个第一CA标识，至少一个第一CA标识为被授权使用离线安装TA指令的至少一个第一CA对应的标识；至少一个第三CA中包括所述至少一个第一CA标识。
可选地，在本发明实施例提供的终端中还包括存储器630，用于存储指令和数据，处理器620用于调用存储器630中的指令并执行相应的操作。可选地，该终端还包括发送器640，用于与其他设备进行数据传输。
该终端中的各功能器件的功能，可以通过图3至图8中所示实施例中的终端所执行的各步骤来实现，因此，本发明实施例提供的终端的具体工作过程，在此不复赘述。
本发明实施例提供的终端可以为手机。处理器是手机的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器内的软件程序和/或模块，以及调用存储在存储器内的数据，执行手机的各种功能和处理数据，从而对手机进行整体监控。处理器可以是中央处理器(central processing unit，CPU)、通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。处理器可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等。可选的，处理器可包括一个或多个处理器单元。可选的，处理器还可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器中。
存储器可用于存储软件程序以及模块，处理器通过运行存储在存储器的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。存储器可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图象播放功能等)等；存储数据区可存储根据手机的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器可以包括易失性存储器，例如非挥发性动态随机存取内存(Nonvolatile Random Access Memory，NVRAM)、相变化随机存取内存(Phase Change RAM，PRAM)、磁阻式随机存取内存(Magetoresistive RAM，MRAM)等；存储器620还可以包括非易失性存储器，例如至少一个磁盘存储器件、电子可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、闪存器件，例如反或闪存(NOR flash memory)或是反与闪存(NAND flash memory)、半导体器件，例如固态硬盘(Solid State Disk，SSD)等。所述存 储器还可以包括上述种类的存储器的组合。
图11为本发明实施例提供的一种通信装置示意图，如图11所示，所述通信装置1100可以是芯片，所述芯片包括处理单元和通信单元。所述处理单元可以是处理器1110，所述处理器可以是前文所述的各种类型的处理器。所述通信单元例如可以是输入/输出接口1120、管脚或电路等，所述通信单元可以包括系统总线或者与系统总线连接。可选地，所述通信装置还包括存储单元，所述存储单元可以是所述芯片内部的存储器1130，例如寄存器、缓存、随机存取存储器(random access memory，RAM)、EEPROM或者FLASH等；所述存储单元还可以是位于所述芯片外部的存储器，该存储器可以是前文所述的各种类型的存储器。处理器连接到存储器，该处理器可以运行存储器存储的指令，以使该通信装置执行上述图3至图8中终端所执行的方法。
本发明实施例还提供了一种计算机可读存储介质，包括指令，当其在设备上运行时，使得该设备执行如图3至图8中所执行的方法。
本发明实施例还提供了一种包含指令的计算机程序产品或者计算机程序，当其在计算机上运行时，使得计算机执行如图3至图8中所执行的方法。
本发明实施例还提供了一种系统，该系统可以包括图3至图8中描述的终端，以及OWE，服务提供商服务器。
在上述各个本发明实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读介质向另一个计算机可读介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如，固态硬盘)等。
以上所述，仅为本发明较佳的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应该以权利要求的保护范围为准。

Claims (37)

  1. 一种离线管理指令的管理方法，其特征在于，所述管理方法包括：
    终端的可信执行环境TEE接收终端的富执行环境REE发送的离线管理指令，所述离线管理指令包括离线管理参数，所述离线管理参数包括使用时长阈值和或使用次数阈值中的至少一种；
    所述TEE执行所述离线管理指令对应的离线管理操作，并根据所述离线管理参数生成离线管理策略；
    当安全域SD或可信应用TA的使用状态不满足所述离线管理策略时，所述TEE删除所述SD或所述TA，或者所述TEE将所述SD或所述TA还原到更新前的状态；其中,所述SD或所述TA是由所述TEE根据所述离线管理指令离线安装或离线更新的。
  2. 根据权利要求1所述的管理方法，其特征在于，所述离线管理指令包括离线安装SD指令或离线更新SD指令，所述离线管理策略为在使用次数阈值内或使用时长阈值内接收到离线安装TA指令。
  3. 根据权利要求1所述的管理方法，其特征在于，所述离线管理指令包括离线安装TA指令或离线更新TA指令，所述离线管理策略为在使用次数阈值内或使用时长阈值内进行预设操作。
  4. 根据权利要求1至3任一项所述的管理方法，其特征在于，在所述TEE执行所述离线管理指令对应的离线管理操作之前，所述管理方法还包括：
    所述TEE确定所述离线管理指令的标识信息是否包含在所述TEE保存的第一信息中，所述第一信息包括所述TEE拒绝执行的离线管理指令的标识信息。
  5. 根据权利要求4任一项所述的管理方法，其特征在于，所述管理方法还包括：
    当所述SD或所述TA被所述TEE删除的次数达到预设阈值时，所述TEE将所述标识信息添加至第一信息。
  6. 根据权利要求4或5所述的管理方法，其特征在于，所述标识信息包括所述离线管理指令的标识，所述离线管理指令的摘要，以及所述离线管理指令所要离线管理的SD标识或TA标识中的至少一项。
  7. 根据权利要求1所述的管理方法，其特征在于，所述TEE执行所述离线管理指令对应的离线管理操作，包括：
    所述TEE根据所述离线管理指令在预设SD内离线安装TA或离线更新TA。
  8. 根据权利要求1至7任一项所述的管理方法，其特征在于，在所述TEE执行离线管理指令对应的离线管理操作之后，所述管理方法还包括：
    所述TEE更新关联信息，并将所述SD或所述TA标记为离线状态；其中，所述关联信息包括所述TEE中安装的SD与所述TEE中安装的SD内安装的TA的对应关系。
  9. 根据权利要求1至8任一项所述的管理方法，其特征在于，所述管理方法还包括：
    当所述SD或所述TA的使用状态满足所述离线管理策略时，所述TEE解除基于所述离线管理策略对所述SD或所述的TA的限制。
  10. 根据权利要求9所述的管理方法，其特征在于，所述TEE解除基于所述离线管理策略对所述SD或所述TA的限制，包括：
    所述TEE删除所述离线管理策略；或者所述TEE取消所述SD或所述TA处于离线状态的标记；或者所述TEE将所述SD或所述TA对应的生命周期状态修改为可执行状态。
  11. 根据权利要求1至10任一项所述的管理方法，其特征在于，所述离线管理指令还包括目标SD标识；所述管理方法还包括：
    当所述TA的使用状态满足离线管理策略时，所述TEE将所述TA从预设SD迁移到所述目标SD标识对应的目标SD内，并删除关联信息中预设SD与所述TA的对应关系。
  12. 根据权利要求1至11任一项所述的管理方法，其特征在于，在所述SD或所述TA的使用状态满足所述离线管理策略之前，所述管理方法还包括：
    所述TEE对所述SD或所述TA的资源访问权限进行限制。
  13. 根据权利要求1至12任一项所述的管理方法，其特征在于，所述管理方法还包括：
    所述TEE根据所述SD的使用状态在所述终端的界面上显示第一提示信息；或者，
    所述TEE根据所述TA的使用状态在所述终端的界面上显示第二提示信息。
  14. 根据权利要求1至13任一项所述的管理方法，其特征在于，所述离线管理指令还包括至少一个第一客户端应用CA标识，所述至少一个第一CA标识为被授权使用所述离线管理指令的至少一个第一CA对应的标识；
    所述终端的可信执行环境TEE接收终端的富执行环境REE发送的离线管理指令，包括：
    所述TEE接收所述REE中第二CA发送的离线管理指令；
    在所述TEE执行所述离线管理指令对应的离线管理操作之前，所述管理方法还包括：
    当所述第二CA对应的第二CA标识与所述至少一个第一CA标识中的任一第一CA标识一致时，所述TEE执行所述离线管理指令对应的离线管理操作。
  15. 根据权利要求14所述的管理方法，其特征在于，所述离线管理指令为离线删除指令；在所述TEE确定所述第二CA对应的第二CA标识与所述至少一个第一CA标识中的任一第一CA标识一致之后，所述管理方法还包括：
    当所述REE中除所述第二CA之外的所述至少一个第一CA标识对应的第一CA都不存在时，所述TEE执行所述离线管理指令对应的离线管理操作。
  16. 根据权利要求1至15任一项所述的管理方法，其特征在于，所述离线管理指令还包括指示信息，所述指示信息用于指示同步删除所述TA所在的SD；
    所述TEE删除所述TA，包括：
    当所述TA所在的SD内不存在关联的TA时，所述TEE删除所述TA以及所述TA所在的SD。
  17. 根据权利要求1至16任一项所述的管理方法，其特征在于，所述离线管理指令包括离线安装TA指令；在所述TEE执行所述离线管理指令对应的离线管理操作之后，包括：
    当所述REE中不存在至少一个第三CA标识对应的第三CA时，所述TEE删除所述TA；
    其中，所述至少一个第三CA为所述TEE通过从离线安装所述TA的离线安装TA指令或从离线安装的所述TA中获取并记录至少一个第三CA标识，所述至少一个第三CA标识对应的至少一个第三CA为REE需要使用所述TA的CA；其中，所述离线安装TA指令中包括至少一个第一CA标识，所述至少一个第一CA标识为被授权使用所述离线安装TA指令的至少一个第一CA对应的标识；所述至少一个第三CA中包括所述至少一个第一CA标识。
  18. 一种终端，其特征在于，所述终端包括可信执行环境TEE和富执行环境REE；所述TEE包括：
    接收单元，用于接收所述富执行环境REE发送的离线管理指令，所述离线管理指 令包括离线管理参数，所述离线管理参数包括使用时长阈值和或使用次数阈值中的至少一种；
    处理单元，用于执行所述离线管理指令对应的离线管理操作，并根据所述离线管理参数生成离线管理策略；
    当安全域SD或可信应用TA的使用状态不满足所述离线管理策略时，所述处理单元删除所述SD或所述TA，或者所述处理单元将所述SD或所述TA还原到更新前的状态；其中，所述SD或所述TA是由所述TEE根据所述离线管理指令离线安装或更新的。
  19. 根据权利要求18所述的终端，其特征在于，所述离线管理指令包括离线安装SD指令或离线更新SD指令，所述离线管理策略为在使用次数阈值内或使用时长阈值内接收到离线安装TA指令。
  20. 根据权利要求18所述的终端，其特征在于，所述离线管理指令包括离线安装TA指令或离线更新TA指令，所述离线管理策略为在使用次数阈值内或使用时长阈值内进行预设操作。
  21. 根据权利要求18至20任一项所述的终端，其特征在于，
    所述处理单元，还用于确定所述离线管理指令的标识信息是否包含在所述TEE保存的第一信息中，所述第一信息包括所述TEE拒绝执行的离线管理指令的标识信息。
  22. 根据权利要求21任一项所述的终端，其特征在于，
    当所述SD或所述TA被所述TEE删除的次数达到预设阈值时，所述处理单元还用于将所述标识信息添加至第一信息。
  23. 根据权利要求21或22所述的终端，其特征在于，所述标识信息包括所述离线管理指令的标识，所述离线管理指令的摘要，以及所述离线管理指令所要离线管理的SD标识或TA标识中的至少一项。
  24. 根据权利要求18所述的终端，其特征在于，所述处理单元执行所述离线管理指令对应的离线管理操作，包括：
    所述处理单元根据所述离线管理指令在预设SD内离线安装TA或离线更新TA。
  25. 根据权利要求18至24任一项所述的终端，其特征在于，
    所述处理单元，还用于更新关联信息，并将所述SD或所述TA标记为离线状态；其中，所述关联信息包括所述TEE中安装的SD与所述TEE中安装的SD内安装的TA的对应关系。
  26. 根据权利要求18至25任一项所述的终端，其特征在于，当所述SD或所述TA的使用状态满足所述离线管理策略时，所述处理单元解除基于所述离线管理策略对所述SD或所述的TA的限制。
  27. 根据权利要求26所述的终端，其特征在于，所述处理单元解除基于所述离线管理策略对所述SD或所述TA的限制，包括：
    所述处理单元删除所述离线管理策略；或者所述处理单元取消所述SD或所述TA处于离线状态的标记；或者所述处理单元将所述SD或所述TA对应的生命周期状态修改为可执行状态。
  28. 根据权利要求18至27任一项所述的终端，其特征在于，所述离线管理指令还包括目标SD标识；
    当所述TA的使用状态满足离线管理策略时，所述处理单元将所述TA从预设SD迁移到所述目标SD标识对应的目标SD内，并删除关联信息中预设SD与所述TA的对应关系。
  29. 根据权利要求18至28任一项所述的终端，其特征在于，所述处理单元，还用于在所述SD或所述TA的使用状态满足所述离线管理策略之前，对所述SD或所述 TA的资源访问权限进行限制。
  30. 根据权利要求18至29任一项所述的终端，其特征在于，：
    所述处理单元，还用于根据所述SD的使用状态在所述终端的界面上显示第一提示信息；或者，
    所述处理单元，还用于根据所述TA的使用状态在所述终端的界面上显示第二提示信息。
  31. 根据权利要求18至30任一项所述的终端，其特征在于，所述离线管理指令还包括至少一个第一客户端应用CA标识，所述至少一个第一CA标识为被授权使用所述离线管理指令的至少一个第一CA对应的标识；所述接收单元用于接收终端的富执行环境REE发送的离线管理指令，包括：
    所述接收单元接收所述REE中第二CA发送的离线管理指令；
    所述处理单元，还用于在所述处理单元执行所述离线管理指令对应的离线管理操作之前，当确定所述第二CA对应的第二CA标识与所述至少一个第一CA标识中的任一第一CA标识一致时，所述处理单元执行所述离线管理指令对应的离线管理操作。
  32. 根据权利要求31所述的终端，其特征在于，所述离线管理指令为离线删除指令；所述处理单元，还用于在所述处理单元确定所述第二CA对应的第二CA标识与所述至少一个第一CA标识中的任一第一CA标识一致之后，当确定所述REE中除所述第二CA之外的所述至少一个第一CA标识对应的第一CA都不存在时，所述处理单元执行所述离线管理指令。
  33. 根据权利要求18至32任一项所述的终端，其特征在于，所述离线管理指令还包括指示信息，所述指示信息用于指示同步删除所述TA所在的SD；
    所述处理单元删除所述TA，包括：
    当确定所述TA所在的SD内不存在关联的TA时，所述处理单元删除所述TA以及所述TA所在的SD。
  34. 根据权利要求18至33任一项所述的终端，其特征在于，所述离线管理指令包括离线安装TA指令；
    所述处理单元还用于，在所述处理单元执行所述离线管理指令对应的离线管理操作之后，当确定所述REE中不存在至少一个第三CA标识对应的第三CA时，所述处理单元删除所述TA；
    其中，所述至少一个第三CA标识为所述TEE通过从离线安装所述TA的离线安装TA指令或从离线安装的所述TA中获取并记录的至少一个第三CA标识，所述至少一个第三CA标识对应的至少一个第三CA为REE需要使用所述TA的CA；其中，所述离线安装TA指令中包括至少一个第一CA标识，所述至少一个第一CA标识为被授权使用所述离线安装TA指令的至少一个第一CA对应的标识；所述至少一个第三CA中包括所述至少一个第一CA标识。
  35. 一种终端，其特征在于，所述终端包括TEE和富执行环境REE，所述TEE包括接收器和处理器；
    所述接收器，用于接收所述REE发送的离线管理指令，所述离线管理指令包括离线管理参数，所述离线管理参数包括使用时长阈值和或使用次数阈值中的至少一种；
    所述处理器，用于执行所述离线管理指令对应的离线管理操作，并根据所述离线管理参数生成离线管理策略；
    当安全域SD或可信应用TA的使用状态不满足所述离线管理策略时，所述处理器删除所述SD或所述TA，或者所述处理器将所述SD或所述TA还原到更新前的状态； 其中，所述SD或所述TA是由所述TEE根据所述离线管理指令离线安装或更新的。
  36. 一种计算机可读存储介质，其特征在于，包括指令，当其在设备上运行时，使得该设备执行如权利要求1至17中任一项所述的方法。
  37. 一种通信装置，其特征在于，包括处理器，所述处理器被配置为支持所述通信装置执行根据权利要求1至17任一项所述的方法。
PCT/CN2019/077219 2018-03-07 2019-03-06 一种离线管理指令的管理方法和终端 WO2019170111A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP19764790.2A EP3737129B1 (en) 2018-03-07 2019-03-06 Management method for offline management instruction and terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810188418.8 2018-03-07
CN201810188418.8A CN110247877B (zh) 2018-03-07 2018-03-07 一种离线管理指令的管理方法和终端

Publications (1)

Publication Number Publication Date
WO2019170111A1 true WO2019170111A1 (zh) 2019-09-12

Family

ID=67846920

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/077219 WO2019170111A1 (zh) 2018-03-07 2019-03-06 一种离线管理指令的管理方法和终端

Country Status (3)

Country Link
EP (1) EP3737129B1 (zh)
CN (1) CN110247877B (zh)
WO (1) WO2019170111A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113037498A (zh) * 2021-03-15 2021-06-25 珠海晶通科技有限公司 离线设备的安全认证方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111327643B (zh) * 2020-05-15 2020-09-01 支付宝(杭州)信息技术有限公司 一种多方数据共享方法和装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104581214A (zh) * 2015-01-28 2015-04-29 三星电子（中国）研发中心 基于ARM TrustZone系统的多媒体内容保护方法和装置
CN107466031A (zh) * 2017-08-08 2017-12-12 深圳市金立通信设备有限公司 一种保护数据的方法及终端

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8898769B2 (en) * 2012-11-16 2014-11-25 At&T Intellectual Property I, Lp Methods for provisioning universal integrated circuit cards
US9069952B1 (en) * 2013-05-20 2015-06-30 Sprint Communications Company L.P. Method for enabling hardware assisted operating system region for safe execution of untrusted code using trusted transitional memory
CN103902333A (zh) * 2014-03-05 2014-07-02 上海乐今通信技术有限公司 移动终端自动卸载应用的方法及移动终端
WO2016024876A1 (en) * 2014-08-11 2016-02-18 Oracle International Corporation Method and system for managing fine-grained policies for requiring user approval of device management operations
WO2017035758A1 (zh) * 2015-08-31 2017-03-09 华为技术有限公司 短信处理方法、装置及终端
WO2017088135A1 (zh) * 2015-11-25 2017-06-01 华为技术有限公司 一种安全指示信息的配置方法及设备
CN105791284B (zh) * 2016-02-29 2019-04-05 华为技术有限公司 一种数据安全传输装置及方法
CN105809036B (zh) * 2016-04-01 2019-05-10 中国银联股份有限公司 一种tee访问控制方法以及实现该方法的移动终端

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104581214A (zh) * 2015-01-28 2015-04-29 三星电子（中国）研发中心 基于ARM TrustZone系统的多媒体内容保护方法和装置
CN107466031A (zh) * 2017-08-08 2017-12-12 深圳市金立通信设备有限公司 一种保护数据的方法及终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
XU JUN: "Research on high performance secure mobile terminal based on offline business detection", 2017 4TH INTERNATIONAL CONFERENCE ON INFORMATION SCIENCE AND CONTROL ENGINEERING (ICISCE), 16 November 2017 (2017-11-16), XP033255027 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113037498A (zh) * 2021-03-15 2021-06-25 珠海晶通科技有限公司 离线设备的安全认证方法

Also Published As

Publication number Publication date
EP3737129A4 (en) 2021-03-03
EP3737129A1 (en) 2020-11-11
CN110247877A (zh) 2019-09-17
EP3737129B1 (en) 2023-08-30
CN110247877B (zh) 2020-10-09

Similar Documents

Publication Publication Date Title
JP6262278B2 (ja) アクセス制御クライアントの記憶及び演算に関する方法及び装置
WO2018050081A1 (zh) 设备身份认证的方法、装置、电子设备及存储介质
RU2595904C2 (ru) Способы и устройство для крупномасштабного распространения электронных клиентов доступа
US11349831B2 (en) Technique for downloading a network access profile
JP2016526223A (ja) モバイルアプリケーション管理のためのモバイルアプリケーションのアイデンティティの検証
WO2015108580A1 (en) Verifying the security of a remote server
WO2015024253A1 (zh) 管理权限方法、装置及终端
JP2014531163A (ja) サードパーティーアプリケーションの集中型セキュアマネージメント方法、システム、および対応する通信システム
JP2014531163A5 (zh)
US11265702B1 (en) Securing private wireless gateways
US10045212B2 (en) Method and apparatus for providing provably secure user input/output
WO2019051839A1 (zh) 一种数据处理的方法及装置
WO2019071650A1 (zh) 一种安全元件中的应用的升级方法及相关设备
JP2017511619A (ja) セキュアな音声とデータの方法及びシステム
WO2019165931A1 (zh) 一种管理方法、终端和服务器
CN110463155A (zh) 增强特定于数据中心的信息的完整性
WO2019170111A1 (zh) 一种离线管理指令的管理方法和终端
TWI469655B (zh) 電子存取用戶端之大規模散佈之方法及裝置
EP3942770B1 (en) Chained trusted platform modules (tpms) as a secure bus for pre-placement of device capabilities
CN112311556B (zh) 设备认证的方法、设备控制的方法、节点、设备、区块链
WO2020177116A1 (zh) 仿冒app识别方法及装置
CN115967623A (zh) 设备管理方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19764790

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019764790

Country of ref document: EP

Effective date: 20200804

NENP Non-entry into the national phase

Ref country code: DE