WO2019195957A1 - 一种移动终端的访问控制方法、装置、终端及存储介质 - Google Patents

一种移动终端的访问控制方法、装置、终端及存储介质 Download PDF

Info

Publication number
WO2019195957A1
WO2019195957A1 PCT/CN2018/082151 CN2018082151W WO2019195957A1 WO 2019195957 A1 WO2019195957 A1 WO 2019195957A1 CN 2018082151 W CN2018082151 W CN 2018082151W WO 2019195957 A1 WO2019195957 A1 WO 2019195957A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
application
rule
access rule
verification
Prior art date
Application number
PCT/CN2018/082151
Other languages
English (en)
French (fr)
Inventor
李焰
陈飞
Original Assignee
深圳大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳大学 filed Critical 深圳大学
Priority to PCT/CN2018/082151 priority Critical patent/WO2019195957A1/zh
Priority to CN201880000323.7A priority patent/CN108701201A/zh
Publication of WO2019195957A1 publication Critical patent/WO2019195957A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409—Device specific authentication in transaction processing

Definitions

  • the present invention belongs to the field of mobile communications technologies, and in particular, to an access control method, apparatus, terminal, and storage medium for a mobile terminal.
  • a mobile terminal has a corresponding application (App) to access the mode of the applet in the secure component of the mobile terminal, and how to control the application of the mobile terminal can only access a specific small part of the secure component.
  • the program becomes the key. If there is no effective access control method, the mobile terminal application can access all the small programs in the secure element without restriction. Such access methods have hidden dangers of malicious attacks.
  • Global Platforms Global Platform, referred to as GP
  • GGP Global Platforms
  • AR Access Rule Applet
  • AR access rule applications
  • ACE access control executor
  • ARA-M Access Rule Applet-Master
  • ARA-C Access Rule from Application
  • ARA-C Access Rule from Application
  • the rules in ARA-C are maintained and managed by application publishers, so that Multiple application publishers independently and securely manage their own applets in secure elements, but this mode of operation provides denial of service attacks for malicious people under certain circumstances (Denial)
  • DoS The security vulnerability of the Service
  • C or ARA-M rules then he can obtain the HASH value of all other application publishers and the identity identifier (Applet Identification, AID) of the security component to be accessed by reading all the rules.
  • AID identity identifier
  • An object of the present invention is to provide an access control method, device, terminal, and storage medium for a mobile terminal, which are intended to solve the problem that the access control method of the mobile terminal cannot be provided because the prior art cannot provide an effective access control method for the mobile terminal. , the problem of reduced security.
  • the present invention provides an access control method for a mobile terminal, the method comprising the following steps:
  • the access request When receiving an access request by the application requesting access to the corresponding security applet in the secure element, the access request is signed using a pre-generated private key to obtain a digital signature of the access request;
  • the access rule executor is configured to send the received access request, the digital signature, and the application identification code to the access rule main application according to a preset verification rule instruction;
  • the access rule main application controls the access request according to the verification rule instruction,
  • the digital signature and the application identification code are sent to the access rule from the application that has been registered in the access rule main application;
  • the access rule executor determines, according to the returned verification result, whether the application has the right to access the corresponding security applet.
  • the present invention provides an access control apparatus for a mobile terminal, the apparatus comprising:
  • a digital signature unit configured to: when receiving an access request of the corresponding security applet in the application requesting access to the secure element, sign the access request by using a pre-generated private key to obtain a digital signature of the access request;
  • a first information sending unit configured to send the access request, the digital signature, and an application identifier of the corresponding security applet to the access rule executor
  • a second information sending unit configured to control, according to the preset verification rule instruction, the access rule executor to send the received access request, the digital signature, and the application identification code to the access rule main application;
  • a third information sending unit configured to: when the corresponding verification rule is not found in the access rule main application according to the received application identification code, control the access rule main application according to the verification rule instruction Transmitting the access request, the digital signature, and the application identification code to an access rule from an application that has been registered in the access rule main application;
  • a verification result returning unit configured to search the corresponding verification rule from the application in the access rule according to the received application identification code, and use the access rule to apply from the application pair according to the found verification rule
  • the access request and the digital signature are verified, and the verification result is returned to the access rule main application, and the verification result is returned to the access rule executor by the access rule main application;
  • an authority determining unit configured to determine, by the access rule executor, whether the application has the right to access the corresponding security applet according to the returned verification result.
  • the present invention also provides a mobile terminal comprising a memory, a processor, and a computer program stored in the memory and operable on the processor, the processor implementing the computer program The steps of the method as described above.
  • the present invention also provides a computer readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method as previously described.
  • the present invention generates a digital signature of the access request using a pre-generated private key when receiving an access request of the corresponding security applet in the application access security element, and uses the access request, the digital signature, and the corresponding security applet application.
  • the identification code is sent to the access rule executor, and the control access rule executor sends the received access request, the digital signature, and the application identification code to the access rule main application according to the preset verification rule instruction, according to the received application identification code.
  • the access request, the digital signature, and the application identification code are sent to the access rule from the application according to the verification rule instruction, and the access rule is searched according to the application identification code from the application.
  • the corresponding verification rule performs signature verification on the access request and the digital signature according to the found verification rule, and returns the verification result to the access rule main application, and then returns the verification result to the access rule executor through the access rule main application.
  • the application has permission to access the corresponding security applet, thereby reducing the likelihood of conflict and provide access rules for the denial of service attacks by malicious, improved security access security element.
  • FIG. 1 is a flowchart of an implementation of an access control method for a mobile terminal according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic structural diagram of an access control apparatus for a mobile terminal according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic structural diagram of an access control apparatus of a mobile terminal according to Embodiment 3 of the present invention.
  • FIG. 4 is a schematic structural diagram of a mobile terminal according to Embodiment 4 of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • FIG. 1 is a flowchart of an implementation of an access control method for a mobile terminal according to Embodiment 1 of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown, which are as follows:
  • step S101 when receiving an access request from the application requesting access to the corresponding security applet (Applet), the access request is signed using the pre-generated private key to obtain a digital signature of the access request.
  • the embodiment of the present invention is applicable to a mobile terminal, for example, a smart phone, a smart tablet, or the like.
  • the application receiving the mobile terminal requests access to the access request of the security applet in the secure element of the mobile terminal, the access request is signed using the pre-generated private key to obtain a digital signature of the access request.
  • the security applet in the secure element is provided by the application provider.
  • the application provider wants to define by itself which mobile terminal applications can access the security small. Program and manage sensitive data yourself (for example, decryption keys).
  • the private key is an encryption key generated according to an asymmetric encryption algorithm (RSA), thereby improving the difficulty of deciphering the encrypted information and reducing the difficulty of managing the key.
  • RSA asymmetric encryption algorithm
  • step S102 the access request, the digital signature, and the application identification code of the corresponding security applet are sent to the access rule executor.
  • an Access Control Enforcer (ACE) is loaded in the mobile terminal, and is an access interface of the application accessing the security component of the mobile terminal (Application) Programming Interface (API), each security applet has a unique application identifier (AID).
  • step S103 according to the preset verification rule instruction, the control access rule executor sends the received access request, digital signature and application identification code to the access rule main application.
  • an Access Rule Applet-Master (ARA-M) is installed in the secure element, and the ARA-M provides a check rule instruction interface for the ACE call, and the ACE according to the transmission format of the interface
  • the access request, the digital signature, and the application identification code are sent to the access rule main application.
  • step S104 when the corresponding verification rule is not found in the access rule main application according to the received application identification code, the access rule main application controls the access request, the digital signature, and the application identification code according to the verification rule instruction.
  • the access rule that has been registered in the access rule main application is applied from.
  • the access rule is installed in the secure element from the application (Access Rule Applet-Client, ARA-C for short), the access control rule is stored in the ARA-M, and the ARA-C is managed from the application registry. .
  • the ARA-M searches for the corresponding verification rule according to the received AID.
  • the access rule main application sends the access request, the digital signature, and the application identification code to the registered main application according to the verification rule instruction.
  • ARA-C is a secure element from the application (Access Rule Applet-Client, ARA-C for short)
  • the access control rule is stored in the ARA-M
  • the ARA-C is managed from the application registry.
  • the ARA-M searches for the corresponding verification rule according to the received AID.
  • the access rule main application sends the access request, the digital signature, and the application identification code to the registered main application according to the verification rule instruction.
  • ARA-C is a secure element from the application (Access Rule Applet-Client, ARA-C
  • the data object of the verification rule is composed of an application index field and a public key index field, and the authority rule field (AR-DO) is cancelled, wherein the application index field is represented by AID-REF-DO, and is used to store the related application.
  • the AID, the public key index field is represented by PUBKEY-REF-DO, and is used to store the public key information of the related application, thereby reducing the possibility of access rule conflicts and providing denial of service attacks for malicious persons, and improving the efficiency of signature verification.
  • step S105 the corresponding verification rule is searched from the application according to the received application identification code, and the access request and the digital signature are verified from the application by the access rule according to the found verification rule, and the verification result is obtained. Returned to the access rule master application and returned to the access rule executor via the access rule master application.
  • related information for example, AID
  • AID related information
  • the ARA-C searches for a corresponding verification rule according to the received AID.
  • the digital signature is decrypted according to the PUBKEY-REF-DO in the verification rule, and the decryption is performed.
  • the subsequent data is compared with the access request to determine whether it is consistent.
  • the access rule returns the verification result from the application to the access rule main application, and finally, the access rule main application returns the verification result to the access rule executor.
  • step S106 the access rule executor determines whether the application has the right to access the corresponding security applet based on the returned verification result.
  • the verification result returned by the access rule main application is a Bool amount
  • the TRUE or FALSE indicates that the access rule executor determines whether the application has the right to access the corresponding security applet according to the Bool amount.
  • the access rule executor opens the secure communication channel, and the application and the corresponding security applet are performed through the secure communication channel.
  • the connection is controlled to control the operation instruction of the corresponding security applet to execute the application, thereby improving the security of the operation instruction corresponding to the execution of the application by the security applet.
  • the access rule executor rejects the application request to access the secure component, thereby improving the application access security component.
  • the access rule execution unit when receiving an access request of the application requesting access to the corresponding security applet, performs the digital signature of the access request, the access request, and the corresponding security according to the preset verification rule instruction.
  • the application identification code of the program is sent to the access rule main application.
  • the corresponding verification rule is searched from the application rule according to the access rule.
  • the access rule master in order to improve the verification success rate of the digital signature, preferably, before using the pre-generated private key to sign the access request, the access rule master is controlled according to the preset application from the application registry according to the access rule main application.
  • the application finds whether there is an uninstalled access rule from the application, and when it exists, downloads the access rule from the application from the server associated with the uninstalled access rule from the application, and installs the downloaded access rule from the application in the secure element,
  • the installed access rules are registered from the application-related information to the access rule main application, thereby improving the verification success rate of the digital signature.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • FIG. 2 is a diagram showing the structure of an access control apparatus for a mobile terminal according to Embodiment 2 of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown, including:
  • the digital signature unit 21 is configured to, when receiving an access request of the application for accessing the corresponding security applet in the secure element, sign the access request by using the pre-generated private key to obtain a digital signature of the access request.
  • the embodiment of the present invention is applicable to a mobile terminal, for example, a smart phone, a smart tablet, or the like.
  • the application receiving the mobile terminal requests access to the access request of the corresponding security applet (Applet) in the secure element of the mobile terminal
  • the access request is signed using the pre-generated private key to obtain a digital signature of the access request.
  • the security applet in the secure element is provided by the application provider.
  • the application provider wants to define by itself which mobile terminal applications can access the security small. Program and manage sensitive data yourself (for example, decryption keys).
  • the private key is an encryption key generated according to an asymmetric encryption algorithm (RSA), thereby improving the difficulty of deciphering the encrypted information and reducing the difficulty of managing the key.
  • RSA asymmetric encryption algorithm
  • the first information sending unit 22 is configured to send the access request, the digital signature, and the application identification code of the corresponding security applet to the access rule executor.
  • an Access Control Enforcer (ACE) is loaded in the mobile terminal, and is an access interface of the application accessing the security component of the mobile terminal (Application) Programming Interface (API), each security applet has a unique application identifier (AID).
  • the second information sending unit 23 is configured to control the access rule executor to send the received access request, the digital signature, and the application identification code to the access rule main application according to the preset verification rule instruction.
  • an Access Rule Applet-Master (ARA-M) is installed in the secure element, and the ARA-M provides a check rule instruction interface for the ACE call, and the ACE according to the transmission format of the interface
  • the access request, the digital signature, and the application identification code are sent to the access rule main application.
  • the third information sending unit 24 is configured to: when the corresponding check rule is not found in the access rule main application according to the received application identification code, control the access rule main application to access the request, the digital signature, and the The application identifier is sent to the application from the application that has been registered in the access rule main application.
  • the access rule is installed in the secure element from the application (Access Rule Applet-Client, ARA-C for short), the access control rule is stored in the ARA-M, and the ARA-C is managed from the application registry. .
  • the ARA-M searches for the corresponding verification rule according to the received AID.
  • the access rule main application sends the access request, the digital signature, and the application identification code to the registered main application according to the verification rule instruction.
  • ARA-C is a secure element from the application (Access Rule Applet-Client, ARA-C for short)
  • the access control rule is stored in the ARA-M
  • the ARA-C is managed from the application registry.
  • the ARA-M searches for the corresponding verification rule according to the received AID.
  • the access rule main application sends the access request, the digital signature, and the application identification code to the registered main application according to the verification rule instruction.
  • ARA-C is a secure element from the application (Access Rule Applet-Client, ARA-C
  • the data object of the verification rule is composed of an application index field and a public key index field, and the authority rule field (AR-DO) is cancelled, wherein the application index field is represented by AID-REF-DO, and is used to store the related application.
  • the AID, the public key index field is represented by PUBKEY-REF-DO, and is used to store the public key information of the related application, thereby reducing the possibility of access rule conflicts and providing denial of service attacks for malicious persons, and improving the efficiency of signature verification.
  • the verification result returning unit 25 is configured to search for a corresponding verification rule from the application according to the received application identification code according to the received application identification code, and verify the access request and the digital signature from the application by using the access rule according to the found verification rule, and The verification result is returned to the access rule main application, and the verification result is returned to the access rule executor through the access rule main application.
  • related information for example, AID
  • AID related information
  • the ARA-C searches for a corresponding verification rule according to the received AID.
  • the digital signature is decrypted according to the PUBKEY-REF-DO in the verification rule, and the decryption is performed.
  • the subsequent data is compared with the access request to determine whether it is consistent.
  • the access rule returns the verification result from the application to the access rule main application, and finally, the access rule main application returns the verification result to the access rule executor.
  • the authority determining unit 26 is configured to determine, by the access rule executor, whether the application has the right to access the corresponding security applet according to the returned verification result.
  • the verification result returned by the access rule main application is a Bool amount
  • the TRUE or FALSE indicates that the access rule executor determines whether the application has the right to access the corresponding security applet according to the Bool amount.
  • each unit of the access control device of the mobile terminal may be implemented by a corresponding hardware or software unit, and each unit may be an independent software and hardware unit, or may be integrated into one soft and hardware unit. Limit the invention.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • FIG. 3 is a diagram showing the structure of an access control apparatus for a mobile terminal according to Embodiment 3 of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown, including:
  • the application search unit 30 is configured to control, according to a preset preset from the application registry, an access rule main application to find whether there is an uninstalled access rule from the application;
  • the application installation unit 31 is configured to, when present, download an access rule from the application and install from a server associated with the uninstalled access rule from the application;
  • An information registration unit 32 configured to register the installed access rule from the application-related information into the access rule main application
  • the digital signature unit 33 is configured to: when receiving an access request of the corresponding security applet in the application requesting access to the secure element, sign the access request by using a pre-generated private key to obtain a digital signature of the access request;
  • the first information sending unit 34 is configured to send the access request, the digital signature, and the application identification code of the corresponding security applet to the access rule executor;
  • the second information sending unit 35 is configured to: according to the preset verification rule instruction, control the access rule executor to send the received access request, the digital signature, and the application identification code to the access rule main application;
  • the third information sending unit 36 is configured to: when the corresponding check rule is not found in the access rule main application according to the received application identification code, control the access rule main application to access the request, the digital signature, and the The application identifier is sent to the application from the application that has been registered in the access rule main application;
  • the verification result returning unit 37 is configured to search for a corresponding verification rule from the application in the access rule according to the received application identification code, and verify the access request and the digital signature from the application by using the access rule according to the found verification rule, and Returning the verification result to the access rule main application, and returning the verification result to the access rule executor through the access rule main application;
  • the authority determining unit 38 is configured to determine, by the access rule executor, whether the application has the right to access the corresponding security applet according to the returned verification result;
  • the application connection unit 39 is configured to: when determining that the application has the right to access the corresponding security applet, the control access rule executor opens the secure communication channel, and connects the application program and the corresponding security applet through the secure communication channel to control the corresponding The security applet executes the operating instructions of the application.
  • each unit of the access control device of the mobile terminal may be implemented by a corresponding hardware or software unit, and each unit may be an independent software and hardware unit, or may be integrated into one soft and hardware unit.
  • each unit may be implemented by a corresponding hardware or software unit, and each unit may be an independent software and hardware unit, or may be integrated into one soft and hardware unit.
  • Limit the invention For a specific implementation of each unit, reference may be made to the description of Embodiment 1, and details are not described herein again.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • FIG. 4 shows the structure of a mobile terminal according to Embodiment 4 of the present invention. For the convenience of description, only parts related to the embodiment of the present invention are shown.
  • the mobile terminal 4 of the embodiment of the present invention includes a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and operable on the processor 40.
  • the processor 40 executes the computer program 42 to implement the steps in the above-described embodiment of the access control method of the mobile terminal, such as steps S101 to S106 shown in FIG.
  • processor 40 when executing computer program 42, implements the functions of the various units of the various apparatus embodiments described above, such as the functions of units 21 through 26 of FIG.
  • the digital signature of the access request is generated by using the pre-generated private key, and the access request, the digital signature, and the corresponding
  • the application identifier of the security applet is sent to the access rule executor, and the control access rule executor sends the received access request, the digital signature, and the application identification code to the access rule main application according to the preset verification rule instruction, according to the receiving
  • the application identification code does not find the corresponding verification rule in the access rule main application
  • the access request, the digital signature, and the application identification code are sent to the access rule from the application according to the verification rule instruction, and are accessed according to the application identification code.
  • the rule searches for the corresponding verification rule from the application, verifies the access request and the digital signature from the application through the access rule according to the found verification rule, and returns the verification result to the access rule main application, and the main application is verified by the access rule.
  • the result is returned to the access rule executor through the access rules Actuator determined according to the verification result returned the application has permission to access the corresponding security applet, thereby reducing the possibility of providing access rule violation and denial of service attack is a malicious person to improve the security of access security element.
  • the mobile terminal in the embodiment of the present invention may be a smart phone or a smart tablet.
  • the mobile terminal in the embodiment of the present invention may be a smart phone or a smart tablet.
  • Embodiment 5 is a diagrammatic representation of Embodiment 5:
  • a computer readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps in the embodiment of the access control method of the mobile terminal are implemented. For example, steps S101 to S106 shown in FIG.
  • the computer program when executed by the processor, implements the functions of the various units in the various apparatus embodiments described above, such as the functions of units 21 through 26 shown in FIG.
  • the digital signature of the access request is generated by using the pre-generated private key, and the access request, the digital signature, and the corresponding
  • the application identifier of the security applet is sent to the access rule executor, and the control access rule executor sends the received access request, the digital signature, and the application identification code to the access rule main application according to the preset verification rule instruction, according to the receiving
  • the application identification code does not find the corresponding verification rule in the access rule main application
  • the access request, the digital signature, and the application identification code are sent to the access rule from the application according to the verification rule instruction, and are accessed according to the application identification code.
  • the rule searches for the corresponding verification rule from the application, verifies the access request and the digital signature from the application through the access rule according to the found verification rule, and returns the verification result to the access rule main application, and the main application is verified by the access rule.
  • the result is returned to the access rule executor through the access rules Actuator determined according to the verification result returned the application has permission to access the corresponding security applet, thereby reducing the possibility of providing access rule violation and denial of service attack is a malicious person to improve the security of access security element.
  • the computer readable storage medium of the embodiments of the present invention may include any entity or device capable of carrying computer program code, a recording medium such as a ROM/RAM, a magnetic disk, an optical disk, a flash memory, or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Finance (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明适用移动通信技术领域，提供了一种移动终端的访问控制方法、装置、终端及存储介质，该方法包括：当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，通过访问规则执行器根据预设的校验规则指令将该访问请求、访问请求的数字签名以及该小程序的应用标识码发送给访问规则主应用，当在访问规则主应用中未查找到对应的校验规则时，则从访问规则从应用根据中查找校验规则并对访问请求和数字签名进行验证，通过访问规则主应用将验证结果返回给访问规则执行器，访问规则执行器根据返回的验证结果确定应用程序是否拥有访问该小程序的权限，从而降低了访问规则冲突和为恶意者提供拒绝服务攻击的可能性，提高了访问安全元件的安全性。

Description

一种移动终端的访问控制方法、装置、终端及存储介质 技术领域
本发明属于移动通信技术领域，尤其涉及一种移动终端的访问控制方法、装置、终端及存储介质。
 背景技术
随着移动互联网的发展，移动支付如今已经成为人们用于支付的常用方式，市场上关于移动支付的应用程序（App）也是多种多样，例如，苹果的APPLE PAY、华为的华为PAY、小米的米PAY、移动公交一卡通、手机电子钱包以及银联的云闪付等，然而，移动支付应用程序的支付安全问题、支付缓慢或卡顿问题已成为了人们关注的焦点，而基于安全元件（Secure Element，简称SE）的移动支付不仅在便携性上有很好的体现，在交易安全性上也得到了较好的保障。
一般而言，移动终端都会有相应的应用程序（App）去访问移动终端中安全元件里面各自小程序（Applet）的模式，而如何控制这些移动终端的应用程序只能访问安全元件里特定的小程序就成了关键所在，如果没有一种有效的访问控制方法，那移动终端的应用程序就可以无限制的访问安全元件中所有小程序，这样的访问方式存有被恶意攻击的隐患。为了解决这种访问安全问题，全球平台组织（Global Platform，简称GP）定义了一套访问规则应用（Access Rule Applet，简称ARA）标准，它主要包含访问控制执行器（Access Control Enforcer，简称ACE）、访问规则主应用（Access Rule Applet-Master，简称ARA-M）以及访问规则从应用（Access Rule Applet-Client，简称ARA-C）三个部分，而访问控制的规则分别存放在ARA-M和ARA-C中，其中ARA-C中的规则由各应用发行商来维护管理，这样就可以让多个应用发行商独立、安全地管理安全元件中各自的小程序，但是这种运行模式在一定情况下存在为恶意者提供拒绝服务攻击（Denial of Service，简称DoS）的安全性漏洞，即有可能会出现某个恶意者拥有了对其中一个ARA-C的控制管理权限，然后恶意者就在这个ARA-C中添加可以访问其它的ARA-C或者是ARA-M的规则，那么他就可以通过读取全部规则的指令获取到其他所有应用发行商的HASH值和要访问的安全元件中小程序的身份标识（Applet Identification，简称AID），然后再在自己的ARA-C中添加其他应用发行商的HASH值的拒绝访问规则，最终造成其他应用发行商的移动终端的应用程序无法正常访问SE的问题。
 技术问题
本发明的目的在于提供一种移动终端的访问控制方法、装置、终端及存储介质，旨在解决由于现有技术无法提供一种有效的移动终端的访问控制方法，导致移动终端的访问控制不精确、安全性降低的问题。
 技术解决方案
一方面，本发明提供了一种移动终端的访问控制方法，所述方法包括下述步骤：
当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥对所述访问请求进行签名，得到所述访问请求的数字签名；
将所述访问请求、所述数字签名以及所述对应安全小程序的应用标识码发送给访问规则执行器；
根据预先设置的校验规则指令，控制所述访问规则执行器将接收到的所述访问请求、所述数字签名以及所述应用标识码发送给访问规则主应用；
当根据接收到的所述应用标识码在所述访问规则主应用中未查找到对应的校验规则时，根据所述校验规则指令控制所述访问规则主应用将所述访问请求、所述数字签名以及所述应用标识码发送给已在所述访问规则主应用中注册的访问规则从应用；
根据接收到的所述应用标识码在所述访问规则从应用中查找所述对应的校验规则，根据查找到的所述校验规则通过所述访问规则从应用对所述访问请求和所述数字签名进行验证，并将验证结果返回给所述访问规则主应用，并通过所述访问规则主应用将所述验证结果返回给所述访问规则执行器；
通过所述访问规则执行器根据返回的验证结果确定所述应用程序是否拥有访问所述对应安全小程序的权限。
另一方面，本发明提供了一种移动终端的访问控制装置，所述装置包括：
数字签名单元，用于当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥对所述访问请求进行签名，得到所述访问请求的数字签名；
第一信息发送单元，用于将所述访问请求、所述数字签名以及所述对应安全小程序的应用标识码发送给访问规则执行器；
第二信息发送单元，用于根据预先设置的校验规则指令，控制所述访问规则执行器将接收到的所述访问请求、所述数字签名以及所述应用标识码发送给访问规则主应用；
第三信息发送单元，用于当根据接收到的所述应用标识码在所述访问规则主应用中未查找到对应的校验规则时，根据所述校验规则指令控制所述访问规则主应用将所述访问请求、所述数字签名以及所述应用标识码发送给已在所述访问规则主应用中注册的访问规则从应用；
验证结果返回单元，用于根据接收到的所述应用标识码在所述访问规则从应用中查找所述对应的校验规则，根据查找到的所述校验规则通过所述访问规则从应用对所述访问请求和所述数字签名进行验证，并将验证结果返回给所述访问规则主应用，并通过所述访问规则主应用将所述验证结果返回给所述访问规则执行器；以及
权限确定单元，用于通过所述访问规则执行器根据返回的验证结果确定所述应用程序是否拥有访问所述对应安全小程序的权限。
另一方面，本发明还提供了一种移动终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如前所述方法的步骤。
另一方面，本发明还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现如前所述方法的步骤。
 有益效果
本发明在当接收到应用程序访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥生成该访问请求的数字签名，并将该访问请求、数字签名以及对应安全小程序的应用标识码发送给访问规则执行器，控制访问规则执行器根据预先设置的校验规则指令将接收到的访问请求、数字签名以及应用标识码发送给访问规则主应用，当根据接收到的应用标识码在访问规则主应用中未查找到对应的校验规则时，则根据校验规则指令将访问请求、数字签名以及应用标识码发送给访问规则从应用，在访问规则从应用中根据应用标识码查找对应的校验规则，根据查找到的校验规则对访问请求和数字签名进行签名验证，并将验证结果返回给访问规则主应用，再通过访问规则主应用将验证结果返回给访问规则执行器，通过访问规则执行器根据返回的验证结果确定应用程序是否拥有访问对应安全小程序的权限，从而降低了访问规则冲突和为恶意者提供拒绝服务攻击的可能性，提高了访问安全元件的安全性。
 附图说明
图1是本发明实施例一提供的移动终端的访问控制方法的实现流程图；
图2是本发明实施例二提供的移动终端的访问控制装置的结构示意图；
图3是本发明实施例三提供的移动终端的访问控制装置的结构示意图；以及
图4是本发明实施例四提供的移动终端的结构示意图。
 本发明的实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
以下结合具体实施例对本发明的具体实现进行详细描述：
实施例一：
图1示出了本发明实施例一提供的移动终端的访问控制方法的实现流程，为了便于说明，仅示出了与本发明实施例相关的部分，详述如下：
在步骤S101中，当接收到应用程序请求访问安全元件中对应安全小程序（Applet）的访问请求时，使用预先生成的私钥对访问请求进行签名，得到访问请求的数字签名。
本发明实施例中适用于移动终端，例如，智能手机、智能平板等。当接收到移动终端的应用程序请求访问移动终端的安全元件中对应安全小程序的访问请求时，使用预先生成的私钥对访问请求进行签名，得到该访问请求的数字签名。安全元件中的安全小程序由应用提供商提供，鉴于一些安全小程序的敏感性（例如，银行电子钱包小程序），应用提供商希望由自身来限定哪些移动终端的应用程序可以访问该安全小程序，并自己管理敏感数据（例如，解密密钥）。
优选地，私钥为根据非对称加密算法（RSA）生成的加密密钥，从而提高了对加密信息进行破译的难度，以及降低了管理密钥的难度。
在步骤S102中，将访问请求、数字签名以及对应安全小程序的应用标识码发送给访问规则执行器。
在本发明实施例中，访问规则执行器（Access Control Enforcer，简称ACE）装载在移动终端中，是移动终端的应用程序访问安全元件的访问接口（Application Programming Interface，简称API），每个安全小程序具有唯一的应用标识码（Applet Identification，简称AID）。
在步骤S103中，根据预先设置的校验规则指令，控制访问规则执行器将接收到的访问请求、数字签名以及应用标识码发送给访问规则主应用。
在本发明实施例中，访问规则主应用（Access Rule Applet-Master，简称ARA-M）安装在安全元件中，ARA-M提供校验规则指令接口供ACE调用，ACE根据该接口的传输格式将访问请求、数字签名以及应用标识码发送给访问规则主应用。
在步骤S104中，当根据接收到的应用标识码在访问规则主应用中未查找到对应的校验规则时，根据校验规则指令控制访问规则主应用将访问请求、数字签名以及应用标识码发送给已在访问规则主应用中注册的访问规则从应用。
在本发明实施例中，访问规则从应用（Access Rule Applet-Client，简称ARA-C）安装在安全元件中，ARA-M里存储访问控制规则，同时通过从应用注册表对ARA-C进行管理。ARA-M根据接收到的AID查找对应的校验规则，当没有查找到时，访问规则主应用根据校验规则指令将访问请求、数字签名以及应用标识码发送给已在访问规则主应用中注册的ARA-C。
优选地，校验规则的数据对象由应用索引字段和公钥索引字段组成，同时取消了权限规则字段（AR-DO），其中，应用索引字段通过AID-REF-DO表示，用来存储相关应用的AID，公钥索引字段通过PUBKEY-REF-DO表示，用来存储相关应用的公钥信息，从而降低了访问规则冲突和为恶意者提供拒绝服务攻击的可能性，并提高了签名验证效率。
在步骤S105中，根据接收到的应用标识码在访问规则从应用中查找对应的校验规则，根据查找到的校验规则通过访问规则从应用对访问请求和数字签名进行验证，并将验证结果返回给访问规则主应用，并通过访问规则主应用将验证结果返回给访问规则执行器。
在本发明实施例中，安装在安全元件中的安全小程序的相关信息（例如AID）存储在ARA-C中。具体地，首先，ARA-C根据接收到的AID查找对应的校验规则，当查找到对应的校验规则时，根据该校验规则中的PUBKEY-REF-DO对数字签名进行解密，将解密后的数据和访问请求进行比较，判断是否一致，然后，访问规则从应用将验证结果返回给访问规则主应用，最后，访问规则主应用将验证结果返回给访问规则执行器。
在步骤S106中，通过访问规则执行器根据返回的验证结果确定应用程序是否拥有访问对应安全小程序的权限。
在本发明实施例中，访问规则主应用返回的验证结果为一个Bool量，通过TRUE或者FALSE表示，访问规则执行器根据该Bool量确定应用程序是否拥有访问对应安全小程序的权限。
优选地，当验证结果为TRUE时，则表明应用程序通过签名验证，拥有访问对应安全小程序的权限，访问规则执行器打开安全通信通道，通过安全通信通道将该应用程序和对应安全小程序进行连接，以控制对应安全小程序执行应用程序的操作指令，从而提高了对应安全小程序执行应用程序的操作指令的安全性。
进一步优选地，当验证结果为FALSE时，则表明应用程序没有通过签名验证，没有访问对应安全小程序的权限，访问规则执行器拒绝应用程序访问安全元件的请求，从而提高了应用程序访问安全元件的安全性。
在本发明实施例中，当接收到应用程序请求访问对应安全小程序的访问请求时，通过访问规则执行器根据预先设置的校验规则指令将该访问请求、访问请求的数字签名以及对应安全小程序的应用标识码发送给访问规则主应用，当根据接收到的应用标识码在访问规则主应用中没有查找到对应的校验规则时，则从访问规则从应用根据中查找对应的校验规则并对访问请求和数字签名进行签名验证， 将验证结果返回给访问规则主应用，并通过访问规则主应用将验证结果返回给访问规则执行器，通过访问规则执行器根据返回的验证结果确定应用程序是否拥有访问对应安全小程序的权限，从而降低了访问规则冲突和为恶意者提供拒绝服务攻击的可能性，提高了访问安全元件的安全性。
在本发明实施例中，为了提高数字签名的验证成功率，优选地，在使用预先生成的私钥对访问请求进行签名之前，根据访问规则主应用中预先设置的从应用注册表控制访问规则主应用查找是否存在未安装的访问规则从应用，当存在时，从与未安装的访问规则从应用关联的服务器上下载访问规则从应用，并将下载的访问规则从应用安装在安全元件中，将安装好的访问规则从应用相关信息注册到访问规则主应用中，从而提高了数字签名的验证成功率。
实施例二：
图2示出了本发明实施例二提供的移动终端的访问控制装置的结构，为了便于说明，仅示出了与本发明实施例相关的部分，其中包括：
数字签名单元21，用于当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥对访问请求进行签名，得到访问请求的数字签名。
本发明实施例中适用于移动终端，例如，智能手机、智能平板等。当接收到移动终端的应用程序请求访问移动终端的安全元件中对应安全小程序（Applet）的访问请求时，使用预先生成的私钥对访问请求进行签名，得到该访问请求的数字签名。安全元件中的安全小程序由应用提供商提供，鉴于一些安全小程序的敏感性（例如，银行电子钱包小程序），应用提供商希望由自身来限定哪些移动终端的应用程序可以访问该安全小程序，并自己管理敏感数据（例如，解密密钥）。
优选地，私钥为根据非对称加密算法（RSA）生成的加密密钥，从而提高了对加密信息进行破译的难度，以及降低了管理密钥的难度。
第一信息发送单元22，用于将访问请求、数字签名以及对应安全小程序的应用标识码发送给访问规则执行器。
在本发明实施例中，访问规则执行器（Access Control Enforcer，简称ACE）装载在移动终端中，是移动终端的应用程序访问安全元件的访问接口（Application Programming Interface，简称API），每个安全小程序具有唯一的应用标识码（Applet Identification，简称AID）。
第二信息发送单元23，用于根据预先设置的校验规则指令，控制访问规则执行器将接收到的访问请求、数字签名以及应用标识码发送给访问规则主应用。
在本发明实施例中，访问规则主应用（Access Rule Applet-Master，简称ARA-M）安装在安全元件中，ARA-M提供校验规则指令接口供ACE调用，ACE根据该接口的传输格式将访问请求、数字签名以及应用标识码发送给访问规则主应用。
第三信息发送单元24，用于当根据接收到的应用标识码在访问规则主应用中未查找到对应的校验规则时，根据校验规则指令控制访问规则主应用将访问请求、数字签名以及应用标识码发送给已在访问规则主应用中注册的访问规则从应用。
在本发明实施例中，访问规则从应用（Access Rule Applet-Client，简称ARA-C）安装在安全元件中，ARA-M里存储访问控制规则，同时通过从应用注册表对ARA-C进行管理。ARA-M根据接收到的AID查找对应的校验规则，当没有查找到时，访问规则主应用根据校验规则指令将访问请求、数字签名以及应用标识码发送给已在访问规则主应用中注册的ARA-C。
优选地，校验规则的数据对象由应用索引字段和公钥索引字段组成，同时取消了权限规则字段（AR-DO），其中，应用索引字段通过AID-REF-DO表示，用来存储相关应用的AID，公钥索引字段通过PUBKEY-REF-DO表示，用来存储相关应用的公钥信息，从而降低了访问规则冲突和为恶意者提供拒绝服务攻击的可能性，并提高了签名验证效率。
验证结果返回单元25，用于根据接收到的应用标识码在访问规则从应用中查找对应的校验规则，根据查找到的校验规则通过访问规则从应用对访问请求和数字签名进行验证，并将验证结果返回给访问规则主应用，并通过访问规则主应用将验证结果返回给访问规则执行器。
在本发明实施例中，安装在安全元件中的安全小程序的相关信息（例如AID）存储在ARA-C中。具体地，首先，ARA-C根据接收到的AID查找对应的校验规则，当查找到对应的校验规则时，根据该校验规则中的PUBKEY-REF-DO对数字签名进行解密，将解密后的数据和访问请求进行比较，判断是否一致，然后，访问规则从应用将验证结果返回给访问规则主应用，最后，访问规则主应用将验证结果返回给访问规则执行器。
权限确定单元26，用于通过访问规则执行器根据返回的验证结果确定应用程序是否拥有访问对应安全小程序的权限。
在本发明实施例中，访问规则主应用返回的验证结果为一个Bool量，通过TRUE或者FALSE表示，访问规则执行器根据该Bool量确定应用程序是否拥有访问对应安全小程序的权限。
在本发明实施例中，移动终端的访问控制装置的各单元可由相应的硬件或软件单元实现，各单元可以为独立的软、硬件单元，也可以集成为一个软、硬件单元，在此不用以限制本发明。
实施例三：
图3示出了本发明实施例三提供的移动终端的访问控制装置的结构，为了便于说明，仅示出了与本发明实施例相关的部分，其中包括：
从应用查找单元30，用于根据预先设置的从应用注册表控制访问规则主应用查找是否存在未安装的访问规则从应用；
从应用安装单元31，用于当存在时，从与未安装的访问规则从应用关联的服务器上下载访问规则从应用并安装；
信息注册单元32，用于将安装好的访问规则从应用相关的信息注册到访问规则主应用中；
数字签名单元33，用于当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥对访问请求进行签名，得到访问请求的数字签名；
第一信息发送单元34，用于将访问请求、数字签名以及对应安全小程序的应用标识码发送给访问规则执行器；
第二信息发送单元35，用于根据预先设置的校验规则指令，控制访问规则执行器将接收到的访问请求、数字签名以及应用标识码发送给访问规则主应用；
第三信息发送单元36，用于当根据接收到的应用标识码在访问规则主应用中未查找到对应的校验规则时，根据校验规则指令控制访问规则主应用将访问请求、数字签名以及应用标识码发送给已在访问规则主应用中注册的访问规则从应用；
验证结果返回单元37，用于根据接收到的应用标识码在访问规则从应用中查找对应的校验规则，根据查找到的校验规则通过访问规则从应用对访问请求和数字签名进行验证，并将验证结果返回给访问规则主应用，并通过访问规则主应用将验证结果返回给访问规则执行器；
权限确定单元38，用于通过访问规则执行器根据返回的验证结果确定应用程序是否拥有访问对应安全小程序的权限；以及
应用连接单元39，用于当确定出应用程序拥有访问对应安全小程序的权限时，控制访问规则执行器打开安全通信通道，通过安全通信通道将应用程序和对应安全小程序进行连接，以控制对应安全小程序执行应用程序的操作指令。
在本发明实施例中，移动终端的访问控制装置的各单元可由相应的硬件或软件单元实现，各单元可以为独立的软、硬件单元，也可以集成为一个软、硬件单元，在此不用以限制本发明。各单元的具体实施方式可参考实施例一的描述，在此不再赘述。
实施例四：
图4示出了本发明实施例四提供的移动终端的结构，为了便于说明，仅示出了与本发明实施例相关的部分。
本发明实施例的移动终端4包括处理器40、存储器41以及存储在存储器41中并可在处理器40上运行的计算机程序42。该处理器40执行计算机程序42时实现上述移动终端的访问控制方法实施例中的步骤，例如图1所示的步骤S101至S106。或者，处理器40执行计算机程序42时实现上述各装置实施例中各单元的功能，例如图2所示单元21至26的功能。
在本发明实施例中，当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥生成该访问请求的数字签名，并将该访问请求、数字签名以及对应安全小程序的应用标识码发送给访问规则执行器，控制访问规则执行器根据预先设置的校验规则指令将接收到的访问请求、数字签名以及应用标识码发送给访问规则主应用，当根据接收到的应用标识码在访问规则主应用中没有查找到对应的校验规则时，则根据校验规则指令将访问请求、数字签名以及应用标识码发送给访问规则从应用，根据应用标识码在访问规则从应用中查找对应的校验规则，根据查找到的校验规则通过访问规则从应用对访问请求和数字签名进行验证，并将验证结果返回给访问规则主应用，通过访问规则主应用将验证结果返回给访问规则执行器，通过访问规则执行器根据返回的验证结果确定应用程序是否拥有访问对应安全小程序的权限，从而降低了访问规则冲突和为恶意者提供拒绝服务攻击的可能性，提高了访问安全元件的安全性。
本发明实施例的移动终端可以为智能手机、智能平板。该移动终端4中处理器40执行计算机程序42时实现移动终端的访问控制方法时实现的步骤可参考前述方法实施例的描述，在此不再赘述。
实施例五：
在本发明实施例中，提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述移动终端的访问控制方法实施例中的步骤，例如，图1所示的步骤S101至S106。或者，该计算机程序被处理器执行时实现上述各装置实施例中各单元的功能，例如图2所示单元21至26的功能。
在本发明实施例中，当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥生成该访问请求的数字签名，并将该访问请求、数字签名以及对应安全小程序的应用标识码发送给访问规则执行器，控制访问规则执行器根据预先设置的校验规则指令将接收到的访问请求、数字签名以及应用标识码发送给访问规则主应用，当根据接收到的应用标识码在访问规则主应用中没有查找到对应的校验规则时，则根据校验规则指令将访问请求、数字签名以及应用标识码发送给访问规则从应用，根据应用标识码在访问规则从应用中查找对应的校验规则，根据查找到的校验规则通过访问规则从应用对访问请求和数字签名进行验证，并将验证结果返回给访问规则主应用，通过访问规则主应用将验证结果返回给访问规则执行器，通过访问规则执行器根据返回的验证结果确定应用程序是否拥有访问对应安全小程序的权限，从而降低了访问规则冲突和为恶意者提供拒绝服务攻击的可能性，提高了访问安全元件的安全性。
本发明实施例的计算机可读存储介质可以包括能够携带计算机程序代码的任何实体或装置、记录介质，例如，ROM/RAM、磁盘、光盘、闪存等存储器。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (10)

  1. 一种移动终端的访问控制方法，其特征在于，所述方法包括下述步骤：
    当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥对所述访问请求进行签名，得到所述访问请求的数字签名；
    将所述访问请求、所述数字签名以及所述对应安全小程序的应用标识码发送给访问规则执行器；
    根据预先设置的校验规则指令，控制所述访问规则执行器将接收到的所述访问请求、所述数字签名以及所述应用标识码发送给访问规则主应用；
    当根据接收到的所述应用标识码在所述访问规则主应用中未查找到对应的校验规则时，根据所述校验规则指令控制所述访问规则主应用将所述访问请求、所述数字签名以及所述应用标识码发送给已在所述访问规则主应用中注册的访问规则从应用；
    根据接收到的所述应用标识码在所述访问规则从应用中查找所述对应的校验规则，根据查找到的所述校验规则通过所述访问规则从应用对所述访问请求和所述数字签名进行验证，并将验证结果返回给所述访问规则主应用，并通过所述访问规则主应用将所述验证结果返回给所述访问规则执行器；
    通过所述访问规则执行器根据返回的验证结果确定所述应用程序是否拥有访问所述对应安全小程序的权限。
  2. 如权利要求1所述的方法，其特征在于，使用预先生成的私钥对所述访问请求进行签名的步骤之前，包括：
    根据预先设置的从应用注册表控制所述访问规则主应用查找是否存在未安装的访问规则从应用；
    当存在时，从与所述未安装的访问规则从应用关联的服务器上下载所述访问规则从应用并安装；
    将所述安装好的访问规则从应用相关的信息注册到所述访问规则主应用中。
  3. 如权利要求1所述的方法，其特征在于，所述访问规则执行器根据返回的验证结果确定所述应用程序是否拥有访问所述对应安全小程序的权限的步骤之后，包括：
    当确定所述应用程序拥有访问所述对应安全小程序的权限时，控制所述访问规则执行器打开安全通信通道，通过所述安全通信通道将所述应用程序和所述对应安全小程序进行连接，以控制所述对应安全小程序执行所述应用程序的操作指令。
  4. 如权利要求1所述的方法，其特征在于，所述私钥为根据非对称加密算法生成的加密密钥，所述校验规则的数据对象由应用索引字段和公钥索引字段组成。
  5. 一种移动终端的访问控制装置，其特征在于，所述装置包括：
    数字签名单元，用于当接收到应用程序请求访问安全元件中对应安全小程序的访问请求时，使用预先生成的私钥对所述访问请求进行签名，得到所述访问请求的数字签名；
    第一信息发送单元，用于将所述访问请求、所述数字签名以及所述对应安全小程序的应用标识码发送给访问规则执行器；
    第二信息发送单元，用于根据预先设置的校验规则指令，控制所述访问规则执行器将接收到的所述访问请求、所述数字签名以及所述应用标识码发送给访问规则主应用；
    第三信息发送单元，用于当根据接收到的所述应用标识码在所述访问规则主应用中未查找到对应的校验规则时，根据所述校验规则指令控制所述访问规则主应用将所述访问请求、所述数字签名以及所述应用标识码发送给已在所述访问规则主应用中注册的访问规则从应用；
    验证结果返回单元，用于根据接收到的所述应用标识码在所述访问规则从应用中查找所述对应的校验规则，根据查找到的所述校验规则通过所述访问规则从应用对所述访问请求和所述数字签名进行验证，并将验证结果返回给所述访问规则主应用，并通过所述访问规则主应用将所述验证结果返回给所述访问规则执行器；以及
    权限确定单元，用于通过所述访问规则执行器根据返回的验证结果确定所述应用程序是否拥有访问所述对应安全小程序的权限。
  6. 如权利要求5所述的装置，其特征在于，所述装置还包括：
    从应用查找单元，用于根据预先设置的从应用注册表控制所述访问规则主应用查找是否存在未安装的访问规则从应用；
    从应用安装单元，用于当存在时，从与所述未安装的访问规则从应用关联的服务器上下载所述访问规则从应用并安装；以及
    信息注册单元，用于将所述安装好的访问规则从应用相关的信息注册到所述访问规则主应用中。
  7. 如权利要求5所述的装置，其特征在于，所述装置还包括：
    应用连接单元，用于当确定出所述应用程序拥有访问所述对应安全小程序的权限时，控制所述访问规则执行器打开安全通信通道，通过所述安全通信通道将所述应用程序和所述对应安全小程序进行连接，以控制所述对应安全小程序执行所述应用程序的操作指令。
  8. 如权利要求5所述的装置，其特征在于，所述私钥为根据非对称加密算法生成的加密密钥，所述校验规则的数据对象由应用索引字段和公钥索引字段组成。
  9. 一种移动终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1至4任一项所述方法的步骤。
  10. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1至4任一项所述方法的步骤。
     
PCT/CN2018/082151 2018-04-08 2018-04-08 一种移动终端的访问控制方法、装置、终端及存储介质 WO2019195957A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2018/082151 WO2019195957A1 (zh) 2018-04-08 2018-04-08 一种移动终端的访问控制方法、装置、终端及存储介质
CN201880000323.7A CN108701201A (zh) 2018-04-08 2018-04-08 一种移动终端的访问控制方法、装置、终端及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/082151 WO2019195957A1 (zh) 2018-04-08 2018-04-08 一种移动终端的访问控制方法、装置、终端及存储介质

Publications (1)

Publication Number Publication Date
WO2019195957A1 true WO2019195957A1 (zh) 2019-10-17

Family

ID=63841460

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/082151 WO2019195957A1 (zh) 2018-04-08 2018-04-08 一种移动终端的访问控制方法、装置、终端及存储介质

Country Status (2)

Country Link
CN (1) CN108701201A (zh)
WO (1) WO2019195957A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111680334A (zh) * 2020-06-11 2020-09-18 深圳市网心科技有限公司 一种磁盘安全访问方法、装置、设备、介质
CN114546524A (zh) * 2022-02-11 2022-05-27 支付宝(杭州)信息技术有限公司 应用权限处理方法及装置

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110908728B (zh) * 2018-09-15 2021-04-09 Oppo广东移动通信有限公司 权限配置方法及相关产品
CN111147428B (zh) * 2018-11-06 2022-04-26 中国电信股份有限公司 访问控制方法、系统、安全单元se访问插件装置和终端
CN110519753B (zh) * 2019-07-09 2023-05-02 中移（杭州）信息技术有限公司 访问方法、装置、终端和可读存储介质
CN110750761A (zh) * 2019-09-20 2020-02-04 阿里巴巴集团控股有限公司 一种小程序访问控制方法和装置
CN110941844B (zh) * 2019-11-27 2022-04-01 网易（杭州）网络有限公司 一种认证鉴权方法、系统、电子设备及可读存储介质
CN111274554B (zh) * 2020-02-10 2023-03-21 广州虎牙科技有限公司 小程序的api调用方法、装置、设备和介质
CN112182623B (zh) * 2020-10-13 2022-05-13 支付宝(杭州)信息技术有限公司 保护用户隐私的方法以及装置
CN113076502A (zh) * 2021-04-23 2021-07-06 南京始云网络科技有限公司 一种基于请求标识的参数控制方法与系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080022381A1 (en) * 2002-12-18 2008-01-24 Eric Le Saint Uniform framework for security tokens
US20150026759A1 (en) * 2013-07-17 2015-01-22 Pt Oberthur Technologies Indonesia Ltd Method of enforcing control of access by a device to a secure element, and corresponding secure element
CN104380652A (zh) * 2012-04-17 2015-02-25 安全Nfc私人有限公司 用于nfc使能设备的多发行商安全元件分区架构

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080022381A1 (en) * 2002-12-18 2008-01-24 Eric Le Saint Uniform framework for security tokens
CN104380652A (zh) * 2012-04-17 2015-02-25 安全Nfc私人有限公司 用于nfc使能设备的多发行商安全元件分区架构
US20150026759A1 (en) * 2013-07-17 2015-01-22 Pt Oberthur Technologies Indonesia Ltd Method of enforcing control of access by a device to a secure element, and corresponding secure element

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111680334A (zh) * 2020-06-11 2020-09-18 深圳市网心科技有限公司 一种磁盘安全访问方法、装置、设备、介质
CN111680334B (zh) * 2020-06-11 2023-05-09 深圳市网心科技有限公司 一种磁盘安全访问方法、装置、设备、介质
CN114546524A (zh) * 2022-02-11 2022-05-27 支付宝(杭州)信息技术有限公司 应用权限处理方法及装置
CN114546524B (zh) * 2022-02-11 2024-04-05 支付宝(杭州)信息技术有限公司 应用权限处理方法及装置

Also Published As

Publication number Publication date
CN108701201A (zh) 2018-10-23

Similar Documents

Publication Publication Date Title
WO2019195957A1 (zh) 一种移动终端的访问控制方法、装置、终端及存储介质
US10748144B2 (en) System and method for transaction security enhancement
CN110036613B (zh) 提供用于去中心化应用的身份认证的系统和方法
US8694795B1 (en) Method and apparatus for secure application execution
US10878066B2 (en) System and method for controlled access to application programming interfaces
US9867043B2 (en) Secure device service enrollment
US8560857B2 (en) Information processing apparatus, a server apparatus, a method of an information processing apparatus, a method of a server apparatus, and an apparatus executable program
RU2364049C2 (ru) Способ аутентификации приложений
US9871821B2 (en) Securely operating a process using user-specific and device-specific security constraints
US8131997B2 (en) Method of mutually authenticating between software mobility device and local host and a method of forming input/output (I/O) channel
US8417964B2 (en) Software module management device and program
WO2021169107A1 (zh) 一种网络身份保护方法、装置及电子设备和存储介质
EP3759630A1 (en) Systems and methods for controlling access to a blockchain
US9942047B2 (en) Controlling application access to mobile device functions
TW201248526A (en) Dynamic platform reconfiguration by multi-tenant service providers
CN108335105B (zh) 数据处理方法及相关设备
EP3912064B1 (en) Apparatus and method for dynamic configuration of trusted application access control
EP3048553B1 (en) Method for distributing applets, and entities for distributing applets
WO2019007145A1 (zh) Sfs访问控制方法及系统、sfs及终端设备
US20150106871A1 (en) System and method for controlling access to security engine of mobile terminal
CN111125705A (zh) 一种能力开放方法及装置
US11949779B2 (en) Method and apparatus for registering shared key
KR102201218B1 (ko) 모바일 단말의 보안 엔진의 접근 제어 시스템 및 방법
CN118828496A (zh) 卡应用的认证方法、装置、设备、介质和产品
CN107925653B (zh) 用于安全传输其中数据的电信系统以及与该电信系统相关联的设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18914852

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 22.01.2021)

122 Ep: pct application non-entry in european phase

Ref document number: 18914852

Country of ref document: EP

Kind code of ref document: A1