WO2019223751A1 - 一种基于多容器的可信应用程序的处理方法及相关设备 - Google Patents

一种基于多容器的可信应用程序的处理方法及相关设备 Download PDF

Info

Publication number
WO2019223751A1
WO2019223751A1 PCT/CN2019/088082 CN2019088082W WO2019223751A1 WO 2019223751 A1 WO2019223751 A1 WO 2019223751A1 CN 2019088082 W CN2019088082 W CN 2019088082W WO 2019223751 A1 WO2019223751 A1 WO 2019223751A1
Authority
WO
WIPO (PCT)
Prior art keywords
secure computing
terminal
computing unit
signed
container
Prior art date
Application number
PCT/CN2019/088082
Other languages
English (en)
French (fr)
Inventor
季杰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19807800.8A priority Critical patent/EP3686762A4/en
Publication of WO2019223751A1 publication Critical patent/WO2019223751A1/zh
Priority to US16/872,642 priority patent/US11429719B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates

Definitions

  • the present application relates to the field of communications, and in particular, to a method for processing a trusted application based on multiple containers and a related device.
  • terminal security mainly involves five fields: identity authentication, admission control, security authentication, business authorization, and business audit.
  • hardware devices based on universal serial bus interfaces (universal serial bus keys, USB keys), trusted execution environments (trusted execution environment (TEE), and secure elements (SE), etc. have begun to appear.
  • TEE trusted execution environment
  • SE secure elements
  • an application program executed on a rich execution environment is called a client application (CA), for example, a traditional operating system that is easily attacked such as Android, or Third-party applications, etc .
  • CA rich execution environment
  • TA trusted applications
  • TEE isolates highly security-sensitive TAs from REEs, provides a dedicated secure execution environment for TAs, and protects the confidentiality, integrity, and access rights of TA resources and data. Because the TA runs in TEE / SE, the deployment / upgrade operation of the TA needs to strictly follow the security verification specifications of the TEE / SE issuer (usually the terminal manufacturer).
  • TEE Due to the limitations of the current TEE application architecture, there are also many differences in the implementation of trusted application management platforms for TEE from different terminal vendors, which results in the development and deployment of trusted applications.
  • the core framework of TEE technology lies in REE and TEE isolation, because the REE side is vulnerable to external attacks, data processing with high security levels can only be implemented on the TEE side.
  • TEE needs to take special measures such as digitally signing the TA's secure computing unit to ensure that the TEE is truly trusted, the developers of the TA must contact each TEE issuer (usually a terminal manufacturer) for cooperative development. And the TEE issuer) will lead to low processing efficiency of the trusted application TA.
  • the embodiments of the present application provide a multi-container-based trusted application processing method and related equipment, which are used to simplify the development and deployment process of trusted applications, and improve the processing efficiency and trusted execution of trusted applications. Environment's access interface security.
  • the first aspect of the present application provides a method for processing a multi-container-based trusted application, which includes: a terminal performs integrity check on a signed secure computing unit through a secure computing container, that is, determines whether the signed secure computing unit is Third party tampering; if the signed secure computing unit passes integrity verification, that is, the signed secure computing unit has not been tampered with by the third party, the terminal checks the validity of the signed secure computing unit through the secure computing container and obtains the verification result; If the verification result is valid, that is, the signed secure computing unit to which the secondary certificate belongs is valid, the terminal loads the signed secure computing unit through the trusted execution environment TEE or the secure element SE and obtains the secure computing of the trusted application. result.
  • TEE trusted execution environment
  • the terminal verifies the validity of the signed secure computing unit through the secure computing container and obtains a verification result, including: The computing container obtains a secondary certificate of the signed secure computing unit, which is used to verify the legitimacy of the signed secure computing unit; the terminal sends the secondary certificate to the verification server through the secure computing container; the terminal receives verification through the secure computing container The verification result sent by the server.
  • the secure computing unit can perform secondary certificate verification, authentication, and loading in a secure computing container other than the main container, which not only solves the problem of lengthy processes of trusted application development and reduces It reduces the access costs of third-party developers and terminal manufacturers, and guarantees the security of verifying and loading secure computing units.
  • the terminal performing integrity check on the signed secure computing unit through the secure computing container includes: the terminal passes security in the secure computing container
  • the computing authorization and loading module obtains the signature file from the signed secure computing unit; the terminal obtains the secure computing unit file metadata from the signed secure computing unit through the secure computing authorization and loading module; the terminal uses the secure computing authorization and loading module to perform secure computing
  • the unit file metadata is digested to obtain the hash value of the secure calculation unit file metadata.
  • the terminal compares the hash value with the signature file through the security calculation authorization and loading module, that is, compares the hash value with the signature file. Whether the hash values are the same.
  • the specific integrity check process has been refined. In the development process of trusted applications, before the signed secure computing unit is loaded into the trusted execution environment, the integrity verification of the signed secure computing unit is improved, which improves Reliability and security of a signed secure computing unit.
  • the method before the terminal performs integrity check on the signed secure computing unit through the secure computing container, the method further includes: The main container obtains a loading request, and the loading request is used to load a signed secure computing unit by the secure computing container of the terminal, and the signed secure computing unit is used to perform secure calculation on a trusted application. Added the process of obtaining the load request from the main container, splitting the secure computing function of trusted applications into secure computing units, defining a unified interface for secure computing, and achieving one-time development, all terminal platforms can run, avoiding the first The three-party developers need to customize the TA process for each terminal platform, which reduces the development and distribution costs for developers and terminal manufacturers.
  • the terminal loads a signed secure computing unit through a trusted execution environment TEE or a secure element SE and obtains secure computing of a trusted application.
  • the method further includes: the terminal transmitting the security calculation result to the main container of the terminal.
  • the secure calculation result is fed back to the trusted application to realize the secure calculation of the trusted application.
  • the method further includes: if the signed secure computing unit fails the integrity verification, the terminal stops loading the signed secure computing The process of the unit. Added the process of loading the signed secure computing unit when the signed secure computing unit fails the integrity verification, ensuring the validity of the secure computing unit, and improving the security of the development process of trusted applications.
  • the method further includes: if the verification result is invalid, the terminal stops loading the signed secure computing unit process. . Added the process of stopping the loading of the signed secure computing unit when the secondary certificate is illegal, ensuring the legitimacy of the secure computing unit and improving the security of the development process of trusted applications.
  • the file format of the signed secure computing unit includes at least an initial section, a code section, and a data section.
  • the specific composition of the signed secure computing unit was determined, the unified secure computing unit was clarified, and the development process of trusted applications was simplified.
  • a second aspect of the present application provides a method for processing a multi-container-based trusted application, including: a verification server receiving a secondary certificate sent by a terminal, the secondary certificate used to verify the legitimacy of a signed secure computing unit; verification The server obtains the root certificate from the digital certificate authentication server, which corresponds to the secondary certificate; the verification server verifies whether the secondary certificate is issued by the root certificate; if the secondary certificate is issued by the root certificate, the verification server determines that the signed secure computing unit is Legal; if the secondary certificate is not issued for the root certificate, the verification server determines that the signed secure computing unit is illegal. The verification server validates the validity of the certificate of the secure computing unit online. Only when the certificate is valid will the secure computing unit be loaded, thereby ensuring the legality of the secure computing unit.
  • the method further includes: the verification server sends a verification result to the terminal, and the verification result is used to indicate a signed secure computing unit Is it legal? The process of sending the verification result to the terminal is added, so that the embodiment of the present application is more complete in steps.
  • the verification server verifies whether the secondary certificate is issued by the root certificate includes: the verification server judges the public key of the secondary certificate and the root certificate. Whether the public keys are the same; if they are the same, the verification server determines that the secondary certificate is issued by the root certificate; if not, the verification server determines that the secondary certificate is not issued by the root certificate.
  • the process of verifying the secondary certificate is detailed, and the implementation manners of the embodiments of the present application are added.
  • a third aspect of the present application provides a terminal, including: a verification unit for verifying the integrity of a signed secure computing unit through a secure computing container; and a first processing unit, if the signed secure computing unit passes the integrity check Verification, used to verify the validity of the signed secure computing unit through the secure computing container and obtain the verification result; the second processing unit, if the verification result is valid, is used to pass the trusted execution environment TEE or security
  • the component SE loads the signed secure computing unit and obtains the secure computing result of the trusted application.
  • the first processing unit is specifically configured to obtain a second-level certificate of a signed secure computing unit through a secure computing container.
  • the certificate is used to verify the validity of the signed secure computing unit; the secondary certificate is sent to the verification server through the secure computing container; and the verification result sent by the verification server is received through the secure computing container.
  • the secure computing unit can perform secondary certificate verification, authentication, and loading in a secure computing container other than the main container, which not only solves the problem of lengthy processes of trusted application development and reduces It reduces the access costs of third-party developers and terminal manufacturers, and guarantees the security of verifying and loading secure computing units.
  • the verification unit is specifically configured to: from the signed secure calculation through the secure calculation authorization and loading module in the secure calculation container Obtain the signature file in the unit; obtain the secure computing unit file metadata from the signed secure computing unit through the secure computing authorization and loading module; perform a summary calculation on the secure computing unit file metadata through the secure computing authorization and loading module to obtain the secure computing unit
  • the hash value of the file metadata; the hash value and the signature file are compared and verified by the secure calculation authorization and loading module.
  • the specific integrity check process has been refined. In the development process of trusted applications, before the signed secure computing unit is loaded into the trusted execution environment, the integrity verification of the signed secure computing unit is improved, which improves Reliability and security of a signed secure computing unit.
  • the terminal further includes: an obtaining unit, configured to obtain a loading request from the main container, and the loading request is used for a secure computing container of the terminal.
  • a signed secure computing unit is loaded, and the signed secure computing unit is used to perform secure computing on a trusted application.
  • splitting the secure computing function of trusted applications into secure computing units, defining a unified interface for secure computing, and achieving one-time development all terminal platforms can run, avoiding the first The three-party developers need to customize the TA process for each terminal platform, which reduces the development and distribution costs for developers and terminal manufacturers.
  • the terminal further includes: a transmission unit, configured to transmit a security calculation result to a main container of the terminal.
  • the secure calculation result is fed back to the trusted application to realize the secure calculation of the trusted application.
  • the terminal further includes a first stopping unit, which is used to stop loading if the signed secure computing unit fails the integrity verification.
  • a first stopping unit which is used to stop loading if the signed secure computing unit fails the integrity verification.
  • Signed secure computing unit process Added the process of loading the signed secure computing unit when the signed secure computing unit fails the integrity verification, ensuring the validity of the secure computing unit, and improving the security of the development process of trusted applications.
  • the terminal further includes: a second stopping unit, which is used to stop the security of loading the signature if the verification result is illegal.
  • the flow of calculation units Added the process of stopping the loading of the signed secure computing unit when the secondary certificate is illegal, ensuring the legitimacy of the secure computing unit and improving the security of the development process of trusted applications.
  • the file format of the signed secure computing unit includes at least an initial segment, a code segment, and a data segment.
  • the specific composition of the signed secure computing unit was determined, the unified secure computing unit was clarified, and the development process of trusted applications was simplified.
  • a fourth aspect of the present application provides a server.
  • the server is a verification server and includes: a receiving unit for receiving a secondary certificate sent by a terminal; the secondary certificate is used to verify the legitimacy of a signed secure computing unit; an obtaining unit, It is used to obtain the root certificate from the digital certificate authentication server; the verification unit is used to verify whether the secondary certificate is issued by the root certificate; the first determination unit, if the secondary certificate is issued by the root certificate, the secure computing unit used to determine the signature is Legal; the second determining unit, if the secondary certificate is not issued for the root certificate, the secure computing unit used to determine the signature is illegal.
  • the verification server validates the validity of the certificate of the secure computing unit online. Only when the certificate is valid will the secure computing unit be loaded, thereby ensuring the legality of the secure computing unit.
  • the server further includes: a sending unit, configured to send a verification result to the terminal, where the verification result is used to indicate a secure calculation of the signature. Whether the unit is legal. The process of sending the verification result to the terminal is added, so that the embodiment of the present application is more complete in steps.
  • the verification unit is specifically configured to determine whether the public key of the secondary certificate and the public key of the root certificate are the same; if they are the same, then Determine that the secondary certificate is issued as the root certificate; if it is not the same, determine that the secondary certificate is not issued as the root certificate.
  • the process of verifying the secondary certificate is detailed, and the implementation manners of the embodiments of the present application are added.
  • a fifth aspect of the present application provides a terminal, including: a memory, a transceiver, and at least one processor.
  • the memory stores program code, and the memory, the transceiver, and the at least one processor communicate through a line.
  • the processor runs the code to instruct the terminal to perform the method according to any one of the first aspect.
  • a sixth aspect of the present application provides a server, including: a memory, a transceiver, and at least one processor.
  • the memory stores program code, and the memory, the transceiver, and the at least one processor communicate through a line.
  • the processor runs the code to instruct the server to perform the method according to any one of the second aspect.
  • a seventh aspect of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores program code, and when the computer-readable storage medium runs on the computer, causes the computer to execute the method described in the first aspect above.
  • An eighth aspect of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores program code, and when the computer-readable storage medium is run on a computer, causes the computer to execute the method described in the second aspect above.
  • a ninth aspect of the present application provides a computer program product containing instructions that, when run on a computer, causes the computer to perform the method described in the first aspect above.
  • a tenth aspect of the present application provides a computer program product containing instructions, which when executed on a computer, causes the computer to perform the method described in the second aspect above.
  • the terminal verifies the integrity of the signed secure computing unit through the secure computing container, that is, determines whether the signed secure computing unit has been tampered with by a third party; if the signed secure computing unit passes the integrity verification, the signed secure computing unit has not been Tampering with a third party, the terminal checks the validity of the signed secure computing unit through the secure computing container and obtains a verification result; if the verification result is legitimate, the signed secure computing unit to which the secondary certificate belongs If it is legal, the terminal loads the signed secure computing unit through the trusted execution environment TEE or the secure element SE and obtains the secure computing result of the trusted application.
  • FIG. 1 is a schematic diagram of a system architecture of an existing solution
  • FIG. 2 is a schematic diagram of a system architecture applied in an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a method for processing a multi-container-based trusted application according to an embodiment of the present application
  • FIG. 4 is a schematic flowchart of another method for processing a multi-container-based trusted application according to an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 6 is another schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a verification server according to an embodiment of the present application.
  • FIG. 8 is another schematic structural diagram of an authentication server according to an embodiment of the present application.
  • FIG. 9A is another schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 9B is another schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 10 is another schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 11 is another schematic structural diagram of an authentication server according to an embodiment of the present application.
  • the embodiments of the present application provide a multi-container-based trusted application processing method and related equipment, which are used to simplify the development and deployment process of trusted applications, and improve the processing efficiency and trusted execution of trusted applications. Environment's access interface security.
  • a system architecture is provided in an existing solution, as shown in FIG. 1.
  • a trusted execution environment (TEE) and a rich execution environment (REE) are included.
  • TEE trusted execution environment
  • REE rich execution environment
  • CA client applications
  • TA trusted applications
  • executing Application of key services such as signature, encryption and decryption calculation.
  • the Trusted Execution Environment TEE includes a trusted execution environment internal application programming interface (TEE Internal API) and a trusted operating system component.
  • TEE Internal API The main role of the TEE Internal API is to provide a trusted operating system upwards. Functions of components, communication with client application CA, realization of TA and TA communication, provision of secure storage, cryptographic functions, time functions, etc .; trusted operating system components mainly include trusted core framework, trusted functions, trusted kernel and Trusted execution environment TEE communication agent.
  • the trusted core framework provides TA with similar operating system functions; the trusted function provides application developers with support capabilities; the trusted kernel is used to interact with trusted devices in platform hardware;
  • the trusted execution environment communication agent provides a secure communication channel for the TA and CA.
  • the trusted execution environment communication agent passes messages to the rich execution environment communication agent through the platform hardware to realize the interaction between the TA and the CA.
  • the rich execution environment REE includes a trusted execution environment client application programming interface (trusted execution environment client application programming interface (TEE Client API)), a trusted execution environment function application programming interface (trusted execution environment functional application programming interface, TEE functional functional programming interface). API) and multimedia operating systems.
  • the components of multimedia operating systems mainly include public device drivers and rich execution environment communication agents.
  • the rich execution environment communication agent is used to communicate with TEE.
  • CA and TA provide a secure communication channel. Public device drivers Used to drive common devices in platform hardware.
  • CA uses TEE Client API and TEE Functional API to access the security services provided by TA.
  • TEE issuers developers of optional application TA must contact each terminal vendor for cooperative development. This kind of coupling relationship between upstream and downstream leads to complicated and verbose TA development process.
  • the TA of the Alipay application requires the development of a set of TAs on the devices of each terminal manufacturer.
  • the TA signature and system interface on each platform are inconsistent, which results in the TA research and development process and distribution process of the Alipay application being extremely complicated. This leads to security risks due to non-standard processes. Similarly, other third-party developers will encounter the same problems.
  • the embodiment of the present application can be applied to the system architecture shown in FIG. 2.
  • the terminal 100 a verification server 200, and a digital certificate authority (CA) server 300 are included.
  • the terminal has three application environments. They are: rich execution environment (REE), trusted execution environment (TEE), and secure element (SE).
  • the terminal includes the main container 101, the secure computing container 102, and the trusted execution environment. (trusted execution environment (TEE)), secure element (SE) 103, system kernel 104, and platform hardware 105, where the running environment in the main container 101 is REE, and the main container includes multiple applications, such as application 1 , Application 2 and application 3; the secure computing container 102 includes a secure computing authorization and loading module.
  • the secure computing container is independent from the main container, and the hardware supported by the secure computing container is the same as that supported by the main container, for example, both support hardware interfaces that use REE.
  • the CA server 300 is used to store all valid certificates provided by the terminal manufacturer.
  • the valid certificates include the secondary certificate and the root certificate.
  • the terminal manufacturer can manage these valid certificates on the CA server 300 (you can query these valid certificates, Increase, revocation, invalidation, reauthorization, etc.).
  • the verification server 200 is configured to provide the security authorization and loading module to verify the validity of the secondary certificate.
  • the system architecture of the present application can be applied to scenarios involving secure computing such as payment and encrypted storage, which are not specifically limited here.
  • An embodiment of the method for processing a multi-container-based trusted application in the embodiment of the present application includes:
  • the terminal obtains a load request from the main container.
  • the terminal obtains a loading request from the main container.
  • the loading request is used to instruct the secure computing container of the terminal to load a signed secure computing unit.
  • the signed secure computing unit is used to perform secure calculation on the trusted application TA.
  • the secure computing unit is A functional module in a trusted application that performs secure computing.
  • This application provides a main container and a secure computing container.
  • the application environment in the container is REE.
  • the trusted application TA requests the secure computing authorization and loading module in the secure computing container of the terminal to load the signed secure computing unit.
  • the main container is running an intelligent operating system (such as the Android system), and applications (such as Alipay) in the main container need to perform secure calculations. Instead of directly invoking calls to TEE, they call the secure computing container. Make an invocation, and transfer the signed secure computing unit and parameters to the secure computing authorization and loading module in the secure computing container. The secure computing authorization and loading module will check whether the application has permission to initiate this call.
  • the user submits the necessary information to the terminal manufacturer, applies for a developer certificate from the terminal manufacturer, and the terminal manufacturer issues a developer certificate (second-level certificate) to the user after passing the review.
  • the key is stored on the CA server.
  • the user uses the software development kit (SDK) and compiler suite of the secure computing unit provided by the terminal manufacturer to obtain the unsigned secure computing unit.
  • SDK includes the C standard library, the encryption and decryption computing library, and the compiler suite. Contains a compiler and a link script. The link script is used to assemble the compiled program into a standard secure computing unit.
  • the link script is specifically used to combine several input files into one output file according to certain rules.
  • the link script command ENTRY specifies the entry function of the secure computing unit as the compute function, so that the TEE can load the secure computing unit when loading the secure computing unit.
  • the calculation parameters need to be directly passed to the compute function for safe calculation and calculation results.
  • the code for this link script is as follows:
  • . 0x8000000
  • the file format of the unsigned secure computing unit is the same as that of the dynamic library file, including an initial (init) section, a code section, and a data section.
  • the process of signing the unsigned secure computing unit is as follows:
  • the digest algorithm can use a secure hash algorithm (SHAHalgorithm, SHA), such as SHA256, SHA512, etc .; then use the public key in the secondary certificate issued by the terminal manufacturer to sign the digest to generate a signature file, specifically a CERT.RSA file; combine the unsigned secure computing unit with the signature file, and finally get the signed security Computing unit.
  • SHAHalgorithm SHA
  • SHA256 SHA256
  • SHA512 etc.
  • the terminal performs integrity check on the signed secure computing unit through the secure computing container.
  • the terminal After the terminal determines that the trusted application TA is authorized to initiate this call according to the loading request and the secure computing authorization and loading module, the terminal obtains the key file from the signed secure computing unit through the secure computing authorization and loading module in the secure computing container; the terminal The secure computing unit file metadata is obtained from the signed secure computing unit through the secure computing authorization and loading module; the terminal calculates the secure computing unit file metadata through the secure computing authorization and loading module to obtain the secure computing unit file metadata.
  • the hash value is compared with the signature file by the terminal through a secure computing authorization and loading module. If the signed secure computing unit passes the integrity verification, that is, the hash value is the same as the hash value of the signature file, the terminal executes step 303. Integrity refers to ensuring that the information or data is not unauthorized or tampered with during the transmission or storage of information or data.
  • the secure computing authorization and loading module first extracts the CERT.RSA information in the header of the secure computing unit file; then extracts the secure computing unit file metadata in the secure computing unit, and the starting address of the secure computing unit file metadata is CERT.RSA At the end, the end address of the secure computing unit file metadata is the end of the secure computing unit file; then the SHA256 algorithm is used to perform a summary calculation on the secure computing unit file metadata to obtain the hash value of the secure computing unit metadata; and then based on.
  • the terminal may consider that the secure computing unit has been tampered with by a third party, and stop loading the signed secure computing unit.
  • this application adds a special "secure computing container", in which the processing steps that are prone to change in the subsequent security computing processing are stripped out.
  • the secure computing container is still located on the REE side and uses the same hardware as the main container on the REE side, but is isolated from the operating system (Android system) in the main container.
  • the data security in the secure computing container has a high guarantee and the highest security
  • the required calculation processing steps are still completed by the TA in the original TEE.
  • Alipay programs developed by users no longer directly use TEE for secure calculations. Instead, TEE is used for secure calculations by secure computing containers. In the newly added secure computing containers, Alipay's secure computing units are verified, authenticated, and verified.
  • the terminal obtains the secondary certificate of the signed secure computing unit through the secure computing container.
  • the terminal obtains the secondary certificate of the signed secure computing unit through the secure computing authorization and loading module in the secure computing container, and the secondary certificate is used to verify the legitimacy of the signed secure computing unit.
  • the terminal uses the secure computing authorization and loading module to extract a secondary certificate from the signed secure computing unit, and the secondary certificate is used to indicate the authorization information of the signed secure computing unit.
  • the terminal sends the secondary certificate to the verification server through the secure computing container.
  • the terminal sends the secondary certificate to the verification server through the secure computing authorization and loading module in the secure computing container.
  • the secondary certificate and the root certificate stored on the digital certificate authentication server belong to the same source. Both have the same public key.
  • the secondary certificate is issued by the root certificate.
  • the verification server obtains a root certificate from the digital certificate authentication server.
  • the authentication server obtains the root certificate from the digital certificate authentication server.
  • the verification server sends a root certificate acquisition request to the digital certificate authentication server according to the target application information carried in the secondary certificate, and the root certificate acquisition request carries the target application information; the digital certificate authentication server according to the target application information Send the corresponding root certificate to the authentication server.
  • the verification server verifies whether the secondary certificate is issued as a root certificate.
  • the verification server verifies whether the secondary certificate is issued as a root certificate.
  • the verification server determines whether the public key of the secondary certificate is the same as the public key of the root certificate; if they are the same, the verification server determines that the secondary certificate is issued by the root certificate; if they are not the same, the verification server determines that the secondary certificate is not The root certificate is issued. If the secondary certificate is issued by the root certificate, the verification server determines that the signed secure computing unit is legitimate; if the secondary certificate is not issued by the root certificate, the verification server determines that the signed secure computing unit is illegal.
  • the verification server sends the verification result to the terminal.
  • the verification server sends a verification result to the terminal, and the verification result is used to indicate whether the signed secure computing unit is legitimate.
  • step 308 if the verification result is valid, the terminal executes step 308. If the verification result is illegal, the terminal stops the process of loading the signed secure computing unit.
  • the terminal loads the signed secure computing unit through the trusted execution environment and obtains the secure computing result of the trusted application.
  • the terminal loads the signed secure computing unit through the trusted execution environment TEE and obtains the secure computing result of the trusted application.
  • the terminal's trusted application manager TA Manager
  • TAManager first checks whether the secondary certificate of the signed secure computing unit is valid. After the check is passed, TAManager calls the universal interface of the signed secure computing unit to obtain the secure computing result. The secure calculation results are returned to the secure computing container.
  • the terminal can also call the signed secure computing unit through the secure element SE and obtain the TA's secure calculation result.
  • the process of the terminal calling the signed secure computing unit through the SE is similar to the process of calling the signed secure computing unit by TEE. I will not repeat them here.
  • the terminal transmits the secure calculation result to the secure computing container of the terminal through the trusted execution environment TEE.
  • the terminal transmits the secure calculation result to the secure computing authorization and loading module in the secure computing container of the terminal through the trusted execution environment TEE.
  • the terminal can also transmit the secure calculation result to the secure computing authorization and loading module in the secure computing container of the terminal through the secure element SE.
  • the terminal transmits the security calculation result to a main container of the terminal.
  • the terminal transmits the result of the security calculation to the terminal's main container. Specifically, the secure computing authorization and loading module of the terminal transmits the received secure computing result to the trusted application TA in the main container.
  • the method of verifying the validity of a secondary certificate and a security container is used to decouple the current problem of the tedious development process of the TA.
  • the security computing capability is opened to third-party developers to simplify third-party development.
  • the development and deployment process of the TA has improved the processing efficiency of the TA.
  • the secure computing unit is verified, authenticated, and loaded in the secure computing container to ensure the verification and loading of the secure computing unit.
  • Security improves the current TA verification process, and enhances the security of the TEE access interface; specifies a unified interface for secure computing, which facilitates the development of TA applications.
  • another embodiment of a method for processing a multi-container-based trusted application in an embodiment of the present application includes:
  • the terminal obtains a loading request from the main container.
  • the terminal obtains a loading request from the main container, and the loading request is used to instruct the secure computing container of the terminal to load a signed secure computing unit, and the signed secure computing unit is used to perform a secure calculation on the trusted application TA.
  • the trusted application TA requests the secure computing authorization and loading module in the secure computing container of the terminal to load the signed secure computing unit.
  • the main container is running an intelligent operating system (such as the Android system), and applications (such as Alipay) in the main container need to perform secure calculations. Instead of directly invoking calls to TEE, they call the secure computing container. Make an invocation, and transfer the signed secure computing unit and parameters to the secure computing authorization and loading module in the secure computing container. The secure computing authorization and loading module will check whether the application has permission to initiate this call.
  • the terminal performs integrity check on the signed secure computing unit through the secure computing container.
  • the terminal After the terminal determines that the trusted application TA is authorized to initiate this call according to the loading request and the secure computing authorization and loading module, the terminal obtains the key file from the signed secure computing unit through the secure computing authorization and loading module in the secure computing container; the terminal The secure computing unit file metadata is obtained from the signed secure computing unit through the secure computing authorization and loading module; the terminal calculates the secure computing unit file metadata through the secure computing authorization and loading module to obtain the secure computing unit file metadata.
  • the hash value is compared with the signature file by the terminal through a secure computing authorization and loading module. If the signed secure computing unit passes the integrity verification, that is, the hash value is the same as the hash value of the signature file, the terminal executes step 303.
  • the terminal obtains the secondary certificate of the signed secure computing unit through the secure computing container.
  • the terminal obtains the secondary certificate of the signed secure computing unit through the secure computing authorization and loading module in the secure computing container, and the secondary certificate is used to verify the legitimacy of the signed secure computing unit.
  • the terminal sends the secondary certificate to the verification server through the secure computing container.
  • the terminal sends the secondary certificate to the verification server through the secure computing authorization and loading module in the secure computing container.
  • the verification server obtains a root certificate from the digital certificate authentication server.
  • the authentication server obtains the root certificate from the digital certificate authentication server.
  • the verification server sends a root certificate acquisition request to the digital certificate authentication server according to the target application information carried in the secondary certificate, and the root certificate acquisition request carries the target application information; the digital certificate authentication server according to the target application information Send the corresponding root certificate to the authentication server.
  • the verification server verifies whether the secondary certificate is issued as a root certificate.
  • the verification server verifies whether the secondary certificate is issued as a root certificate.
  • the verification server determines whether the public key of the secondary certificate is the same as the public key of the root certificate; if they are the same, the verification server determines that the secondary certificate is issued by the root certificate; if they are not the same, the verification server determines that the secondary certificate is not The root certificate is issued. If the secondary certificate is issued by the root certificate, the verification server determines that the signed secure computing unit is legitimate; if the secondary certificate is not issued by the root certificate, the verification server determines that the signed secure computing unit is illegal.
  • the verification server sends the verification result to the terminal.
  • the verification server sends a verification result to the terminal, and the verification result is used to indicate whether the signed secure computing unit is legitimate.
  • step 308 if the verification result is valid, the terminal executes step 308. If the verification result is illegal, the terminal stops the process of loading the signed secure computing unit.
  • Steps 401 to 407 are similar to steps 301 to 307, and details are not described herein again.
  • the terminal loads the signed secure computing unit through the secure element and obtains the secure computing result of the trusted application.
  • the terminal loads the signed secure computing unit through the secure element SE and obtains the secure computing result of the trusted application TA.
  • the terminal's trusted application manager TA Manager
  • TAManager first checks whether the secondary certificate of the signed secure computing unit is valid. After the check is passed, TAManager calls the universal interface of the signed secure computing unit to obtain the secure computing result. The secure calculation results are returned to the secure computing container.
  • the terminal transmits the secure calculation result to the secure computing container of the terminal through the secure element SE.
  • the terminal transmits the secure calculation result to the secure computing authorization and loading module in the secure computing container of the terminal through the secure element SE.
  • the terminal transmits the security calculation result to the main container of the terminal.
  • the terminal transmits the result of the security calculation to the terminal's main container. Specifically, the secure computing authorization and loading module of the terminal transmits the received secure computing result to the trusted application TA in the main container.
  • the secure computing unit is verified, authenticated, and loaded in the secure computing container through the newly added secure computing container, which ensures the security of verifying and loading the secure computing unit, and improves the current TA for verification.
  • Process which not only reduces the access costs of third-party developers and terminal manufacturers, but also guarantees the security of verifying and loading secure computing units; the method of demonstrating legality verification in a secure container through a secondary certificate decouples the current.
  • the problem of lengthy TA development process has opened the security computing capabilities to third-party developers, simplified the third-party developers' development and deployment process for TA, and improved the processing efficiency of TA.
  • FIG. 5 is an embodiment of the terminal in the embodiment of the present application.
  • a verification unit 501 configured to verify the integrity of a signed secure computing unit through a secure computing container
  • the first processing unit 502 if the signed secure computing unit passes the integrity check, is used to verify the validity of the signed secure computing unit through the secure computing container and obtain a verification result;
  • the second processing unit 503 is used to load the signed secure computing unit through the trusted execution environment TEE or the secure element SE and obtain the secure computing result of the trusted application program if the verification result is valid.
  • the client application of the TEE is prevented from being attacked, the security effect of isolating the main container and the TEE is achieved, and the security of the access interface of the trusted execution environment is improved.
  • FIG. 6 another embodiment of the terminal in the embodiment of the present application includes:
  • a verification unit 601, configured to verify the integrity of the signed secure computing unit through the secure computing container
  • the first processing unit 602 if the signed secure computing unit passes the integrity check, is used to verify the validity of the signed secure computing unit through the secure computing container and obtain a verification result;
  • the second processing unit 603 is configured to load the signed secure computing unit through the trusted execution environment TEE or the secure element SE and obtain the secure computing result of the trusted application program if the verification result is valid.
  • the first processing unit 602 is specifically configured to:
  • the verification unit 601 is specifically configured to:
  • the secure computing unit file metadata is calculated by the secure computing authorization and loading module, and the hash value of the secure computing unit file metadata is obtained;
  • the hash value and signature file are checked for integrity by the secure computing authorization and loading module.
  • the terminal may further include:
  • the obtaining unit 604 is configured to obtain a loading request from the main container, where the loading request is used to load a signed secure computing unit by the secure computing container of the terminal, and the signed secure computing unit is used to perform secure calculation on a trusted application.
  • the terminal may further include:
  • the transmitting unit 605 is configured to transmit the security calculation result to the main container of the terminal.
  • the terminal may further include:
  • the first stopping unit 606 is used to stop the flow of loading the signed secure computing unit if the signed secure computing unit fails the integrity verification.
  • the terminal may further include:
  • the second stopping unit 607 is used to stop the flow of loading the secure computing unit if the verification result is invalid.
  • the file format of the signed secure computing unit includes at least an initial section, a code section, and a data section.
  • the secure computing unit is verified, authenticated, and loaded in the secure computing container through the newly added secure computing container, which ensures the security of verifying and loading the secure computing unit, and improves the current TA for verification.
  • Process which improves the security of the access interface of TEE; through the method of secondary certificate and legality verification in a secure container, it decouples the current problem of the tedious development process of TA, and opens the security computing capabilities to third-party developers , Simplifying the development and deployment process of TA by third-party developers, improving the processing efficiency of TA; providing a unified interface for secure computing, facilitating the development of TA applications.
  • an embodiment of the authentication server in the embodiment of the present application includes:
  • the receiving unit 701 is configured to receive a secondary certificate sent by the terminal, where the secondary certificate is used to verify the validity of the signed secure computing unit;
  • An obtaining unit 702 configured to obtain a root certificate from a digital certificate authentication server
  • a verification unit 703, configured to verify whether the secondary certificate is issued as a root certificate
  • a first determining unit 704 if the secondary certificate is issued as a root certificate, determining that the signed secure computing unit is legal;
  • the second determining unit 705 if the secondary certificate is not issued for the root certificate, the secure computing unit for determining the signature is illegal.
  • the validity of the secure computing unit's certificate is verified online by the verification server, and the secure computing unit is loaded only when the certificate is valid, thereby ensuring the legitimacy of the secure computing unit.
  • another embodiment of the authentication server in the embodiment of the present application includes:
  • a receiving unit 801 configured to receive a secondary certificate sent by a terminal, where the secondary certificate is used to verify the validity of a signed secure computing unit;
  • An obtaining unit 802 configured to obtain a root certificate from a digital certificate authentication server
  • a verification unit 803, configured to verify whether the secondary certificate is issued as a root certificate
  • a first determining unit 804 if the secondary certificate is issued as a root certificate, determining that the signed secure computing unit is legal;
  • the second determining unit 805 if the secondary certificate is not issued for the root certificate, determine that the signed secure computing unit is illegal.
  • the server also includes:
  • the sending unit 806 is configured to send a verification result to the terminal, where the verification result is used to indicate whether the signed secure computing unit is legitimate.
  • the verification unit 803 is specifically configured to:
  • the validity of the certificate of the secure computing unit is verified online by the verification server, and the secure computing unit is loaded only when the certificate is valid, so as to ensure the legality of the secure computing unit.
  • An embodiment of the present application provides a terminal.
  • the terminal has a memory 901, a transceiver 902, and at least one processor 903.
  • the memory 901 stores program code and data.
  • a protected area in the memory may store TEE Operating system and trusted applications.
  • the unprotected area of the memory can store the REE operating system and client applications.
  • the memory 901, the transceiver 902, and at least one processor 903 are connected to each other through a bus 904.
  • the bus 904 may be a peripheral device. Component interconnect standard (peripheral component interconnect) (PCI) bus or extended industry standard architecture (extended industry standard architecture (EISA) bus).
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the processor 903 executes the program code in the memory 901 to instruct the terminal to complete the operations in the foregoing method embodiments, simplify the development and deployment process of trusted applications, and improve the processing efficiency of trusted applications.
  • FIG. 9B is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • the terminal 910 includes a main container 911, a secure computing container 912, a trusted execution environment (TEE), and a secure element (secure element).
  • SE secure element 913, system kernel 914, and platform hardware 915.
  • the running environment in the main container 911 is REE
  • the main container 911 includes multiple applications
  • the secure computing container 912 includes a secure computing authorization and loading module
  • a trusted execution environment
  • the secure element 913 includes a trusted application manager.
  • FIG. 10 is a block diagram showing a partial structure of a terminal provided by an embodiment of the present application.
  • the terminal includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WIFI) module 1070, and processing Device 1080 and other components.
  • RF radio frequency
  • WIFI wireless fidelity
  • FIG. 10 does not constitute a limitation on the terminal, and may include more or fewer components than shown in the figure, or combine certain components, or arrange different components.
  • the processor 1080 is a control center of the terminal.
  • the integrity verification of the signed secure computing unit can be performed, the signed secure computing unit can be loaded, and the secure computing result of the trusted application can be obtained.
  • the RF circuit 1010 is connected to the processor 1080 through a bus, and is responsible for sending data to or receiving data from the Internet. It can also be used for receiving and sending signals during the process of receiving and sending information, for example, sending a secondary certificate to a verification server. In addition, After receiving the verification result sent by the verification server, the terminal sends the verification result to the processor 1080 for processing.
  • the RF circuit 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, and the like. In addition, the RF circuit 1010 can also communicate with a network and other devices through wireless communication.
  • the above wireless communication can use any communication standard or protocol, including, but not limited to, Global System (GSM), General Packet Radio Service (GPRS), and Code Division Multiple Access (code division) multiple access (CDMA), wideband code division multiple access (WCDMA), long term evolution (LTE), email, short message service (SMS), and so on.
  • GSM Global System
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA wideband code division multiple access
  • LTE long term evolution
  • email short message service
  • SMS short message service
  • the memory 1020 may be configured to store software programs and modules.
  • the processor 1080 executes various functional applications and data processing of the terminal by running the software programs and modules stored in the memory 1020.
  • the memory 1020 may mainly include a storage program area and a storage data area, where the storage program area may store an operating system, at least one application required by a function (such as integrity verification of a signed secure computing unit, etc.), etc .; storage The data area can store data (such as security calculation results, etc.) created according to the use of the terminal.
  • the memory 1020 may include a high-speed random access memory, and may further include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage device.
  • FIG. 11 is a schematic structural diagram of a verification server according to an embodiment of the present application.
  • the verification server 1100 may have a large difference due to different configurations or performance, and may include one or more processors (central processing units) (CPU) 1101. (Eg, one or more processors) and a storage medium 1108, one or more storage media 1108 (eg, one or more storage devices) that store application programs 1107 or data 1106.
  • the storage medium 1108 may be temporary storage or persistent storage.
  • the program stored in the storage medium 1108 may include one or more modules (not shown in the figure), and each module may include a series of codes in the authentication server.
  • the processor 1101 may be configured to communicate with the storage medium 1108.
  • the processor 1101 is a control center of the authentication server, and may use various interfaces and lines to connect various parts of the entire authentication server.
  • the storage medium 1108 may be used to store software programs and modules.
  • the processor 1101 executes various functional applications and data processing of the authentication server 1100 by running the software programs and modules stored in the storage medium 1108.
  • the storage medium 1108 may mainly include a storage program area and a storage data area, where the storage program area may store an operating system, at least one application required by a function (such as judging whether a secondary certificate is legal, etc.), etc .; the storage data area may store data according to Verify the use of data created by the server (such as determining that the secondary certificate is legitimate).
  • the storage medium 1108 may include a high-speed random access memory, and may further include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage device.
  • a non-volatile memory such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage device.
  • the authentication server 1100 may also include one or more power sources 1102, one or more wired or wireless network interfaces 1103, one or more input / output interfaces 1104, and / or, one or more operating systems 1105, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc.
  • operating systems 1105 such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc.
  • the disclosed systems, devices, and methods may be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, which may be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objective of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit.
  • the above integrated unit may be implemented in the form of hardware or in the form of software functional unit.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, a computer, a server, or a data center. Transmission by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) to another website site, computer, server, or data center.
  • wire such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server, a data center, and the like that includes one or more available medium integration.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially a part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium , Including a number of instructions to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disks, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks, and other media that can store program codes .

Abstract

一种基于多容器的可信应用程序的处理方法及相关设备，用于简化可信应用程序的开发和部署流程，提高了对可信应用程序的处理效率和可信执行环境的访问接口的安全性。该方法包括：终端通过安全计算容器对签名的安全计算单元进行完整性校验；若签名的安全计算单元通过完整性校验，则终端通过安全计算容器对签名的安全计算单元进行合法性校验并获取校验结果；若校验结果为合法的，则终端通过可信执行环境TEE或安全元件SE加载签名的安全计算单元并获取可信应用程序的安全计算结果。

Description

一种基于多容器的可信应用程序的处理方法及相关设备
本申请要求于2018年05月25日提交中国专利局、申请号为201810516372.8、申请名称为“一种基于多容器的可信应用程序的处理方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种基于多容器的可信应用程序的处理方法及相关设备。
背景技术
目前，终端安全主要涉及五种领域：身份认证，准入控制，安全认证，业务授权，业务审计。对于安全认证领域，开始出现基于通用串行总线接口的硬件设备(universal serial bus key，USB Key)、可信执行环境(trusted execution environment，TEE)和安全元件(secure element，SE)等更为安全的解决方案，其中，可信执行环境TEE可以解决在移动支付场景下消费者、商户、移动运营商、第三方支付、金融机构等上下游参与方的各种不同安全诉求，是当前最具备发展潜力的技术之一。目前，TEE技术已经在手机、机顶盒、平板和其它设备上广泛使用。
现有技术中，将在富执行环境(rich execution environment，REE)上执行的应用程序称为客户应用程序(client application，CA)，例如，安卓(Android)等容易被攻击的传统操作系统，或第三方应用程序等；将在TEE上执行的应用程序称为可信应用程序(trusted application，TA)，例如，执行签名、加解密计算等关键服务的程序。为了提升安全性，通过TEE将高安全敏感的TA与REE进行隔离，为TA提供专门的安全执行环境，并保护TA的资源和数据的保密性、完整性和访问权限。由于TA运行在TEE/SE中，TA的部署/升级操作需要严格遵循TEE/SE发行方(通常是终端厂商)的安全验证规范。
由于目前的TEE的应用架构存在一些限制，不同终端厂商的TEE实现可信应用管理平台也存在较多差异，导致可信应用程序的开发及部署过程较为复杂，由于TEE技术的核心框架在于REE和TEE的隔离，由于REE侧容易遭受外界攻击，高安全级别的数据处理只能全部放在TEE侧实现。因为TEE需要通过对TA的安全计算单元进行数字签名等专有措施确保TEE真正可信，TA的开发者必须联系各个TEE发行方(通常是终端厂商)进行合作开发，这种上下游(TA开发者和TEE发行方)的耦合关系，会导致可信应用程序TA的处理效率低。
发明内容
本申请实施例提供了一种基于多容器的可信应用程序的处理方法及相关设备，用于简化可信应用程序的开发和部署流程，提高了对可信应用程序的处理效率和可信执行环境的访问接口的安全性。
本申请第一方面提供了一种基于多容器的可信应用程序的处理方法，包括：终端通过安全计算容器对签名的安全计算单元进行完整性校验，即确定该签名的安全计算单元是否被第三方篡改；若签名的安全计算单元通过完整性验证，即签名的安全计算单元未被第三方篡改，则终端通过安全计算容器对签名的安全计算单元进行合法性校验并获取校验结果；若校验结果为合法的，即二级证书所属的签名的安全计算单元是合法的，则终端通过可信执行环境TEE或安全元件SE加载签名的安全计算单元并获取可信应用程序的安全计算结果。通过引入安全计算容器的方式，避免了TEE的客户端应用程序受到攻击，达到了隔离主容器和TEE的安全效果，提高了可信执行环境的访问接口的安全性。
在一种可能的设计中，在本申请实施例第一方面的第一种实现方式中，终端通过安全计算容器对签名的安全计算单元进行合法性校验并获取校验结果包括：终端通过安全计算容器获取签名的安全计算单元的二级证书，该二级证书用于验证签名的安全计算单元的合法性；终端通过安全计算容器将二级证书发送至验证服务器；终端通过安全计算容器接收验证服务器发送的校验结果。通过给安全计算单元分配二级证书，使安全计算单元在主容器之外的安全计算容器中进行二级证书校验，认证与加载，既解决了可信应用程序开发的流程冗长的问题，降低了第三方开发者和终端厂商的接入成本，又保证了验证与加载安全计算单元的安全性。
在一种可能的设计中，在本申请实施例第一方面的第二种实现方式中，终端通过安全计算容器对签名的安全计算单元进行完整性校验包括：终端通过安全计算容器中的安全计算授权与加载模块从签名的安全计算单元中获取签名文件；终端通过安全计算授权与加载模块从签名的安全计算单元中获取安全计算单元文件元数据；终端通过安全计算授权与加载模块对安全计算单元文件元数据进行摘要计算，得到安全计算单元文件元数据的哈希值；终端通过安全计算授权与加载模块将哈希值和签名文件进行比对校验，即比较哈希值与签名文件的哈希值是否相同。对具体的完整性校验过程进行了细化，在可信应用程序的开发流程中，在签名的安全计算单元加载至可信执行环境之前，对签名的安全计算单元进行完整性验证，提高了签名的安全计算单元的可靠性和安全性。
在一种可能的设计中，在本申请实施例第一方面的第三种实现方式中，终端通过安全计算容器对签名的安全计算单元进行完整性校验之前，所述方法还包括：终端从主容器获取加载请求，该加载请求用于所述终端的安全计算容器加载签名的安全计算单元，该签名的安全计算单元用于对可信应用程序进行安全计算。增加了从主容器获取加载请求的过程，将对可信应用程序的安全计算功能拆分到安全计算单元中，定义安全计算的统一接口，达到一次开发，所有终端平台均可运行，避免了第三方开发者需要为每个终端平台定制TA的过程，降低了开发者和终端厂商的开发和分发成本。
在一种可能的设计中，在本申请实施例第一方面的第四种实现方式中，终端通过可信执行环境TEE或安全元件SE加载签名的安全计算单元并获取可信应用程序的安全计算结果之后，所述方法还包括：终端将安全计算结果传输至终端的主容器。将安全计算结果反馈至可信应用程序，实现对可信应用程序的安全计算。
在一种可能的设计中，在本申请实施例第一方面的第五种实现方式中，所述方法还包 括：若签名的安全计算单元没有通过完整性验证，则终端停止加载签名的安全计算单元的流程。增加了签名的安全计算单元没有通过完整性验证时，停止加载签名的安全计算单元的过程，确保了安全计算单元的有效性，提高了可信应用程序的开发过程的安全性。
在一种可能的设计中，在本申请实施例第一方面的第六种实现方式中，所述方法还包括：若校验结果为不合法的，则终端停止加载签名的安全计算单元的流程。增加了当二级证书为不合法的情况下，停止加载签名的安全计算单元的过程，确保了安全计算单元的合法性，提高了可信应用程序的开发过程的安全性。
在一种可能的设计中，在本申请实施例第一方面的第七种实现方式中，签名的安全计算单元的文件格式至少包括初始段、代码段和数据段。确定了签名的安全计算单元的具体组成，明确了统一的安全计算单元，简化了可信应用程序的开发过程。
本申请第二方面提供了一种基于多容器的可信应用程序的处理方法，包括：验证服务器接收终端发送的二级证书，该二级证书用于验证签名的安全计算单元的合法性；验证服务器从数字证书认证服务器获取根证书，该根证书与二级证书对应；验证服务器验证二级证书是否为根证书签发；若二级证书为根证书签发，则验证服务器确定签名的安全计算单元为合法的；若二级证书不为根证书签发，则验证服务器确定签名的安全计算单元为不合法的。通过验证服务器对安全计算单元的证书进行在线验证合法性，只有在证书有效的情况才会加载安全计算单元，保证了安全计算单元的合法性。
在一种可能的设计中，在本申请实施例第二方面的第一种实现方式中，所述方法还包括：验证服务器将验证结果发送至终端，该验证结果用于指示签名的安全计算单元是否为合法的。增加了将验证结果发送至终端的过程，使本申请实施例在步骤上更完善。
在一种可能的设计中，在本申请实施例第二方面的第二种实现方式中，验证服务器验证二级证书是否为根证书签发包括：验证服务器判断二级证书的公钥和根证书的公钥是否相同；若相同，则验证服务器确定二级证书为根证书签发；若不相同，则验证服务器确定二级证书不为根证书签发。细化了对二级证书的验证过程，增加了本申请实施例的实现方式。
本申请第三方面提供了一种终端，包括：校验单元，用于通过安全计算容器对签名的安全计算单元进行完整性校验；第一处理单元，若签名的安全计算单元通过完整性校验，则用于通过安全计算容器对签名的安全计算单元进行合法性校验并获取校验结果；第二处理单元，若校验结果为合法的，则用于通过可信执行环境TEE或安全元件SE加载签名的安全计算单元并获取可信应用程序的安全计算结果。通过引入安全计算容器的方式，避免了TEE的客户端应用程序受到攻击，达到了隔离主容器和TEE的安全效果，提高了可信执行环境的访问接口的安全性。
在一种可能的设计中，在本申请实施例第三方面的第一种实现方式中，第一处理单元具体用于：通过安全计算容器获取签名的安全计算单元的二级证书，该二级证书用于验证签名的安全计算单元的合法性；通过安全计算容器将二级证书发送至验证服务器；通过安全计算容器接收验证服务器发送的校验结果。通过给安全计算单元分配二级证书，使安全计算单元在主容器之外的安全计算容器中进行二级证书校验，认证与加载，既解决了可信 应用程序开发的流程冗长的问题，降低了第三方开发者和终端厂商的接入成本，又保证了验证与加载安全计算单元的安全性。
在一种可能的设计中，在本申请实施例第三方面的第二种实现方式中，所述校验单元具体用于：通过安全计算容器中的安全计算授权与加载模块从签名的安全计算单元中获取签名文件；通过安全计算授权与加载模块从签名的安全计算单元中获取安全计算单元文件元数据；通过安全计算授权与加载模块对安全计算单元文件元数据进行摘要计算，得到安全计算单元文件元数据的哈希值；通过安全计算授权与加载模块将哈希值和签名文件进行比对校验。对具体的完整性校验过程进行了细化，在可信应用程序的开发流程中，在签名的安全计算单元加载至可信执行环境之前，对签名的安全计算单元进行完整性验证，提高了签名的安全计算单元的可靠性和安全性。
在一种可能的设计中，在本申请实施例第三方面的第三种实现方式中，终端还包括：获取单元，用于从主容器获取加载请求，该加载请求用于终端的安全计算容器加载签名的安全计算单元，该签名的安全计算单元用于对可信应用程序进行安全计算。增加了从主容器获取加载请求的过程，将对可信应用程序的安全计算功能拆分到安全计算单元中，定义安全计算的统一接口，达到一次开发，所有终端平台均可运行，避免了第三方开发者需要为每个终端平台定制TA的过程，降低了开发者和终端厂商的开发和分发成本。
在一种可能的设计中，在本申请实施例第三方面的第四种实现方式中，终端还包括：传输单元，用于将安全计算结果传输至终端的主容器。将安全计算结果反馈至可信应用程序，实现对可信应用程序的安全计算。
在一种可能的设计中，在本申请实施例第三方面的第五种实现方式中，终端还包括：第一停止单元，若签名的安全计算单元没有通过完整性验证，则用于停止加载签名的安全计算单元的流程。增加了签名的安全计算单元没有通过完整性验证时，停止加载签名的安全计算单元的过程，确保了安全计算单元的有效性，提高了可信应用程序的开发过程的安全性。
在一种可能的设计中，在本申请实施例第三方面的第六种实现方式中，终端还包括：第二停止单元，若校验结果为不合法的，则用于停止加载签名的安全计算单元的流程。增加了当二级证书为不合法的情况下，停止加载签名的安全计算单元的过程，确保了安全计算单元的合法性，提高了可信应用程序的开发过程的安全性。
在一种可能的设计中，在本申请实施例第三方面的第七种实现方式中，签名的安全计算单元的文件格式至少包括初始段、代码段和数据段。确定了签名的安全计算单元的具体组成，明确了统一的安全计算单元，简化了可信应用程序的开发过程。
本申请第四方面提供了一种服务器，服务器为验证服务器，包括：接收单元，用于接收终端发送的二级证书，该二级证书用于验证签名的安全计算单元的合法性；获取单元，用于从数字证书认证服务器获取根证书；验证单元，用于验证二级证书是否为根证书签发；第一确定单元，若二级证书为根证书签发，则用于确定签名的安全计算单元为合法的；第二确定单元，若二级证书不为根证书签发，则用于确定签名的安全计算单元为不合法的。通过验证服务器对安全计算单元的证书进行在线验证合法性，只有在证书有效的情 况才会加载安全计算单元，保证了安全计算单元的合法性。
在一种可能的设计中，在本申请实施例第四方面的第一种实现方式中，服务器还包括：发送单元，用于将验证结果发送至终端，该验证结果用于指示签名的安全计算单元是否为合法的。增加了将验证结果发送至终端的过程，使本申请实施例在步骤上更完善。
在一种可能的设计中，在本申请实施例第四方面的第二种实现方式中，验证单元具体用于：判断二级证书的公钥和根证书的公钥是否相同；若相同，则确定二级证书为根证书签发；若不相同，则确定二级证书不为根证书签发。细化了对二级证书的验证过程，增加了本申请实施例的实现方式。
本申请第五方面提供了一种终端，包括：存储器、收发器和至少一个处理器，所述存储器中存储有程序代码，所述存储器、所述收发器和所述至少一个处理器通过线路通信，所述处理器运行所述代码以指令所述终端执行上述第一方面任一项所述的方法。
本申请第六方面提供了一种服务器，包括：存储器、收发器和至少一个处理器，所述存储器中存储有程序代码，所述存储器、所述收发器和所述至少一个处理器通过线路通信，所述处理器运行所述代码以指令所述服务器执行上述第二方面任一项所述的方法。
本申请的第七方面提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有程序代码，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
本申请的第八方面提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有程序代码，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法。
本申请的第九方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
本申请的第十方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法。
从以上技术方案可以看出，本申请实施例具有以下优点：
终端通过安全计算容器对签名的安全计算单元进行完整性校验，即确定该签名的安全计算单元是否被第三方篡改；若签名的安全计算单元通过完整性验证，即签名的安全计算单元未被第三方篡改，则终端通过所述安全计算容器对所述签名的安全计算单元进行合法性校验并获取校验结果；若校验结果为合法的，即二级证书所属的签名的安全计算单元是合法的，则终端通过可信执行环境TEE或安全元件SE加载签名的安全计算单元并获取可信应用程序的安全计算结果。本申请中，通过引入安全计算容器的方式，避免了TEE的客户端应用程序受到攻击，达到了隔离主容器和TEE的安全效果，改进了目前可信应用程序进行验证的流程，提高了可信执行环境的访问接口安全性。
附图说明
图1为现有方案应用的系统架构示意图；
图2为本申请实施例应用的系统架构示意图；
图3为本申请实施例中基于多容器的可信应用程序的处理方法的一个流程示意图；
图4为本申请实施例中基于多容器的可信应用程序的处理方法的另一个流程示意图；
图5为本申请实施例中终端的一个结构示意图；
图6为本申请实施例中终端的另一个结构示意图；
图7为本申请实施例中验证服务器的一个结构示意图；
图8为本申请实施例中验证服务器的另一个结构示意图；
图9A为本申请实施例中终端的另一个结构示意图；
图9B为本申请实施例中终端的另一个结构示意图；
图10为本申请实施例中终端的另一个结构示意图；
图11为本申请实施例中验证服务器的另一个结构示意图。
具体实施方式
本申请实施例提供了一种基于多容器的可信应用程序的处理方法及相关设备，用于简化可信应用程序的开发和部署流程，提高了对可信应用程序的处理效率和可信执行环境的访问接口的安全性。
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例进行描述。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”或“具有”及其任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
现有方案中提供了一种系统架构，如图1所示，在该系统架构中，包括可信执行环境(trusted execution environment，TEE)和富执行环境(rich execution environment，REE)。将高安全敏感的应用与通用的软件环境进行隔离，提供专门的可信执行环境TEE，并保护应用的资源和数据的保密性、完整性和访问权限；对Android等容易被攻击的传统操作系统提供通用的富执行环境REE。在REE侧执行的应用称为客户端应用程序(client application，CA)，比如银行类应用等第三方支付应用，在TEE侧执行的应用称为可信应用程序(trusted application，TA)，比如执行签名、加解密计算等关键服务的应用。由于TA运行在可信执行环境TEE中，TA的部署/升级操作需要严格遵循TEE发行方(通常是终端厂商)的安全验证规范，比如使用数字签名等措施，确保TEE各个环节是真正可信的。可信执行环境TEE中包括可信执行环境内部应用程序编程接口(trusted execution environment internal application programming interface，TEE Internal API)和可信操作系统部件，TEE Internal API的主要作用为：向上提供可信操作系统部件的功能、与客户端应用程序CA通信、实现TA与TA通信、提供安全存储、密码学功能、时间功能等；可信操作系统部件主要包括可信核心框架、可信功能、可信内核和可信执行环境TEE通信代理，其中，可信核心框架为TA提供类似操作系统的功能；可信功能为应用开发者 提供支持能力；可信内核用于与平台硬件中的可信设备进行交互；可信执行环境通信代理为TA和CA提供一个安全的通信通道，例如，可信执行环境通信代理通过平台硬件将消息传递至富执行环境通信代理，实现TA和CA的交互。富执行环境REE中包括可信执行环境客户端应用程序编程接口(trusted execution environment client application programming interface，TEE Client API)、可信执行环境功能应用程序编程接口(trusted execution environment functional application programming interface，TEE Functional API)和多媒体操作系统，多媒体操作系统部件主要包括公共设备驱动和富执行环境通信代理，其中，富执行环境通信代理用于与TEE进行通信，CA和TA提供一个安全的通信通道，公共设备驱动用于驱动平台硬件中的公共设备。CA使用TEE Client API、TEE Functional API接入到由TA提供的安全服务。
由于该系统架构存在一些限制，不同终端厂商的TEE实现可信应用管理平台也存在较多差异，导致TA的开发及部署过程较为复杂。由于TEE侧通过数字签名等专有措施确保TEE真正可信，具体的管控措施由具体的终端厂商(TEE发行方)实施，可选应用程序TA的开发者必须联系各终端厂商进行合作开发，这种上下游的耦合关系，导致TA开发流程复杂和冗长。例如，支付宝应用程序的TA，需要在每个终端厂商的设备上开发一套TA，每个平台上的TA签名与系统接口都不一致，导致支付宝应用程序的TA研发流程和分发流程异常复杂，进而导致因流程不规范而存在的安全风险，同理，其他第三方开发者也会遇到同样的问题。
本申请实施例可应用于如图2所示的系统架构，在该系统架构中，包括终端100、验证服务器200和数字证书认证(certificate authority，CA)服务器300，其中，终端有三种应用环境，分别为：富执行环境(rich execution environment，REE)、可信执行环境(trusted execution environment，TEE)和安全元件(secure element，SE)，终端包括主容器101、安全计算容器102、可信执行环境(trusted execution environment，TEE)和安全元件(secure element，SE)103、系统内核104和平台硬件105，其中，主容器101中运行环境为REE，主容器中包括多个应用程序，例如应用程序1、应用程序2和应用程序3；安全计算容器102包括安全计算授权与加载模块。其中，安全计算容器从主容器中独立出来，安全计算容器支持的硬件与主容器支持的硬件相同，例如，都是支持使用REE的硬件接口。CA服务器300用于保存终端厂商提供的所有有效的证书，有效的证书包括二级证书和根证书，终端厂商可以在CA服务器300上管理这些有效的证书(可以对这些有效的证书进行查询、新增、吊销、失效、重新授权等操作)。验证服务器200用于为安全授权与加载模块提供对二级证书的有效性进行验证。本申请的系统架构可以应用在支付、加密存储等涉及安全计算的场景中，具体此处不做限定。
为便于理解，下面对本申请实施例的具体流程进行描述，请参阅图3，本申请实施例中基于多容器的可信应用程序的处理方法的一个实施例包括：
301、终端从主容器获取加载请求。
终端从主容器获取加载请求，该加载请求用于指示终端的安全计算容器加载签名的安全计算单元，该签名的安全计算单元用于对可信应用程序TA进行安全计算，其中，安全 计算单元为可信应用程序中执行安全计算的功能模块。
在操作系统内核中隔离出多个相互独立的系统资源，即容器，每个容器都运行独立的OS，各个容器之间无法直接相互访问，本申请中提供了主容器和安全计算容器，其中主容器中的应用环境为REE。
可信应用程序TA向终端的安全计算容器中的安全计算授权与加载模块请求加载签名的安全计算单元。具体的，主容器中运行的是一个智能操作系统(比如Android系统)，这个主容器中的应用程序(比如支付宝)需要进行安全计算，不再是直接向TEE发起调用，而是向安全计算容器进行发起调用，将签名的安全计算单元和参数传输至安全计算容器中的安全计算授权与加载模块，安全计算授权与加载模块会检查应用程序是否有权限发起此调用。
需要说明的是，在发送加载请求之前，需要用户先开发得到未签名的安全计算单元，在对该未签名的安全计算单元进行签名，得到签名的安全计算单元。开发得到未签名的安全计算单元的过程如下：
用户(第三方开发者)向终端厂商提交必要的资料，向终端厂商申请开发者证书，终端厂商在审核通过之后，给用户颁发开发者证书(二级证书)，同时，将二级证书的公钥保存在CA服务器上。用户利用终端厂商提供的安全计算单元的软件开发工具包(software development kit，SDK)和编译器套件得到未签名的安全计算单元，其中，SDK包含了C标准库和加解密计算库，编译器套件包含了编译器和链接脚本，链接脚本用于将编译之后的程序组装成一个标准的安全计算单元，例如，用户使用支付宝进行指纹支付时，因为指纹信息为重要的安全数据信息，需要在一个安全的环境中进行收集，因此支付宝需要对指纹采集的环境进行安全计算，将执行该功能的程序剥离出来重新编译得到未签名的安全计算单元，通过该未签名的安全计算单元对指纹采集的环境进行安全计算。该链接脚本具体用于将若干个输入文件根据一定的规则合并成一个输出文件，例如，链接脚本命令ENTRY指定了安全计算单元的入口函数为compute函数，这样TEE在加载安全计算单元时就能够将需要计算参数直接传递给compute函数，进行安全计算，获得计算结果。该链接脚本的代码如下所示：
ENTRY(compute)
SECTIONS
{
.＝0×10000；
.text:{*(.text)}
.＝0×8000000；
.data:{*(.data)}
.bss:{*(.bss)}
}
其中，经过编译器编译之后，未签名的安全计算单元的文件格式与动态库文件格式一样，有初始(init)段，代码段，数据段等。
对该未签名的安全计算单元进行签名的过程如下：
首先利用摘要算法对编译之后的未签名的安全计算单元文件进行摘要计算，得到安全计算单元的摘要文件，可选的，摘要算法可以采用安全哈希算法(secure Hash algorithm，SHA)，例如SHA256，SHA512等；然后利用终端厂商颁发的二级证书中的公钥对摘要进行签名，生成签名文件，具体为CERT.RSA文件；将未签名的安全计算单元与签名文件进行合成，最终得到签名的安全计算单元。
可以理解的是，在开发得到未签名的安全计算单元之前，需要定义安全计算单元的同一格式，用户不用再考虑不同质终端厂家采用不同的TEE技术，实现开发一套安全计算单元，可以运行在各个终端平台的TEE之上。
302、终端通过安全计算容器对签名的安全计算单元进行完整性校验。
终端根据加载请求和安全计算授权与加载模块判断可信应用程序TA有权限发起此调用之后，终端通过安全计算容器中的安全计算授权与加载模块从签名的安全计算单元中获取密钥文件；终端通过所述安全计算授权与加载模块从签名的安全计算单元中获取安全计算单元文件元数据；终端通过安全计算授权与加载模块对安全计算单元文件元数据进行摘要计算，得到安全计算单元文件元数据的哈希值；终端通过安全计算授权与加载模块将哈希值和签名文件进行比对校验。若签名的安全计算单元通过完整性验证，即哈希值与签名文件的哈希值相同，则终端执行步骤303。完整性是指在传输、存储信息或数据的过程中，确保信息或数据不被未授权的篡改或在篡改后能被迅速发现。
例如，安全计算授权与加载模块首先提取安全计算单元文件头部的CERT.RSA信息；接着提取安全计算单元中的安全计算单元文件元数据，安全计算单元文件元数据的起始地址为CERT.RSA的尾部，安全计算单元文件元数据的结束地址是安全计算单元文件的末尾；再利用SHA256算法对安全计算单元文件元数据进行摘要计算，得到安全计算单元元数据的哈希值；再根据。
需要说明的是，若签名的安全计算单元没有通过完整性验证，则终端可以认为此安全计算单元受到第三方篡改，停止加载签名的安全计算单元的流程。
可以理解的是，本申请在现有的“主容器”的基础上，增加了一个专门的“安全计算容器”，在该安全计算容器中将安全计算处理中后续容易产生变化的处理步骤剥离出来。该安全计算容器仍然位于REE侧，与REE侧的主容器使用相同的硬件，但是和主容器中的操作系统(Android系统)相互隔离，安全计算容器中的数据安全性有较高保证，最高安全要求的计算处理步骤仍然由原TEE中的TA完成。例如，用户开发的支付宝程序不再直接使用TEE进行安全计算，而由安全计算容器来使用TEE进行安全计算，在新增的安全计算容器中，实现对支付宝的安全计算单元进行校验、认证与加载计算流程，这样能保证安全计算单元的安全性，解决了用户开发的TA分发的安全性问题；并且新增的安全计算容器，隔离了应用程序与TEE之间的联系，解决了TA容易遭受CA侧恶意调用，而导致TEE拒绝服务的风险。
303、终端通过安全计算容器获取签名的安全计算单元的二级证书。
终端通过通过安全计算容器中的安全计算授权与加载模块获取签名的安全计算单元的 二级证书，该二级证书用于验证签名的安全计算单元的合法性。
例如，终端通过安全计算授权与加载模块从签名的安全计算单元中提取二级证书，该二级证书用于指示该签名的安全计算单元的授权信息。
304、终端通过安全计算容器将二级证书发送至验证服务器。
终端通过安全计算容器中的安全计算授权与加载模块将二级证书发送至验证服务器。
需要说明的是，二级证书与存储在数字证书认证服务器上的根证书属于同源，二者具有同样的公钥，二级证书为根证书签发的。
305、验证服务器从数字证书认证服务器获取根证书。
验证服务器从数字证书认证服务器获取根证书。
具体的，验证服务器根据二级证书中携带的目标应用程序信息，向数字证书认证服务器发送根证书获取请求，该根证书获取请求中携带有目标应用程序信息；数字证书认证服务器根据目标应用程序信息将对应的根证书发送至验证服务器。
306、验证服务器验证二级证书是否为根证书签发。
验证服务器验证二级证书是否为根证书签发。
具体的，验证服务器判断二级证书的公钥和根证书的公钥是否相同；若相同，则验证服务器确定二级证书为根证书签发；若不相同，则验证服务器确定所二级证书不为根证书签发。若二级证书为根证书签发，则验证服务器确定签名的安全计算单元为合法的；若二级证书不为根证书签发，则验证服务器确定签名的安全计算单元为不合法的。
可以理解的是，通过公钥对证书进行验证为现有技术，具体此处不再赘述。还可以采用其他的验证方法验证二级证书的合法性，具体此处不做限定。
307、验证服务器将验证结果发送至终端。
验证服务器将验证结果发送至终端，该验证结果用于指示签名的安全计算单元是否为合法的。
需要说明的是，若校验结果为合法的，则终端执行步骤308。若校验结果为不合法的，则终端停止加载签名的安全计算单元的流程。
308、终端通过可信执行环境加载签名的安全计算单元并获取可信应用程序的安全计算结果。
终端通过可信执行环境TEE加载签名的安全计算单元并获取可信应用程序的安全计算结果。具体的，终端的可信应用程序管理器(TA Manager)先检查签名的安全计算单元的二级证书是否合法，检查通过后，TAManager调用签名的安全计算单元的通用接口，获取安全计算结果，将安全计算结果返回至安全计算容器。
需要说明的是，终端还可以通过安全元件SE调用签名的安全计算单元并获取TA的安全计算结果，终端通过SE调用签名的安全计算单元的过程与TEE调用签名的安全计算单元的过程类似，此处不再赘述。
309、终端通过可信执行环境TEE将安全计算结果传输至终端的安全计算容器。
终端通过可信执行环境TEE将安全计算结果传输至终端的安全计算容器中的安全计算授权与加载模块。
需要说明的是，终端还可以通过安全元件SE将安全计算结果传输至终端的安全计算容器中的安全计算授权与加载模块。
310、终端将安全计算结果传输至终端的主容器。
终端将安全计算结果传输至终端的主容器。具体的，终端的安全计算授权与加载模块将接收到的安全计算结果传输至主容器中的可信应用程序TA。
本申请实施例中，通过二级证书、在安全容器中进行合法性校验的方法，解耦了目前TA开发流程冗长的问题，向第三方开发者开放了安全计算的能力，简化第三方开发者对TA的开发和部署流程，提高了对TA的处理效率；通过新增的安全计算容器，在安全计算容器中对安全计算单元进行校验、认证与加载，保证了验证与加载安全计算单元的安全性，改进了目前TA进行验证的流程，提高了TEE的访问接口安全性；规定了安全计算的统一接口，便于TA应用程序的开发。
请参阅图4，本申请实施例中基于多容器的可信应用程序的处理方法的另一个实施例包括：
401、终端从主容器获取加载请求。
终端从主容器获取加载请求，该加载请求用于指示终端的安全计算容器加载签名的安全计算单元，该签名的安全计算单元用于对可信应用程序TA进行安全计算。
可信应用程序TA向终端的安全计算容器中的安全计算授权与加载模块请求加载签名的安全计算单元。具体的，主容器中运行的是一个智能操作系统(比如Android系统)，这个主容器中的应用程序(比如支付宝)需要进行安全计算，不再是直接向TEE发起调用，而是向安全计算容器进行发起调用，将签名的安全计算单元和参数传输至安全计算容器中的安全计算授权与加载模块，安全计算授权与加载模块会检查应用程序是否有权限发起此调用。
402、终端通过安全计算容器对签名的安全计算单元进行完整性校验。
终端根据加载请求和安全计算授权与加载模块判断可信应用程序TA有权限发起此调用之后，终端通过安全计算容器中的安全计算授权与加载模块从签名的安全计算单元中获取密钥文件；终端通过所述安全计算授权与加载模块从签名的安全计算单元中获取安全计算单元文件元数据；终端通过安全计算授权与加载模块对安全计算单元文件元数据进行摘要计算，得到安全计算单元文件元数据的哈希值；终端通过安全计算授权与加载模块将哈希值和签名文件进行比对校验。若签名的安全计算单元通过完整性验证，即哈希值与签名文件的哈希值相同，则终端执行步骤303。
403、终端通过安全计算容器获取签名的安全计算单元的二级证书。
终端通过通过安全计算容器中的安全计算授权与加载模块获取签名的安全计算单元的二级证书，该二级证书用于验证签名的安全计算单元的合法性。
404、终端通过安全计算容器将二级证书发送至验证服务器。
终端通过安全计算容器中的安全计算授权与加载模块将二级证书发送至验证服务器。
405、验证服务器从数字证书认证服务器获取根证书。
验证服务器从数字证书认证服务器获取根证书。
具体的，验证服务器根据二级证书中携带的目标应用程序信息，向数字证书认证服务器发送根证书获取请求，该根证书获取请求中携带有目标应用程序信息；数字证书认证服务器根据目标应用程序信息将对应的根证书发送至验证服务器。
406、验证服务器验证二级证书是否为根证书签发。
验证服务器验证二级证书是否为根证书签发。
具体的，验证服务器判断二级证书的公钥和根证书的公钥是否相同；若相同，则验证服务器确定二级证书为根证书签发；若不相同，则验证服务器确定所二级证书不为根证书签发。若二级证书为根证书签发，则验证服务器确定签名的安全计算单元为合法的；若二级证书不为根证书签发，则验证服务器确定签名的安全计算单元为不合法的。
407、验证服务器将验证结果发送至终端。
验证服务器将验证结果发送至终端，该验证结果用于指示签名的安全计算单元是否为合法的。
需要说明的是，若校验结果为合法的，则终端执行步骤308。若校验结果为不合法的，则终端停止加载签名的安全计算单元的流程。
步骤401至步骤407与步骤301至步骤307类似，具体此处不再赘述。
408、终端通过安全元件加载签名的安全计算单元并获取可信应用程序的安全计算结果。
终端通过安全元件SE加载签名的安全计算单元并获取可信应用程序TA的安全计算结果。具体的，终端的可信应用程序管理器(TA Manager)先检查签名的安全计算单元的二级证书是否合法，检查通过后，TAManager调用签名的安全计算单元的通用接口，获取安全计算结果，将安全计算结果返回至安全计算容器。
409、终端通过安全元件SE将安全计算结果传输至终端的安全计算容器。
终端通过安全元件SE将安全计算结果传输至终端的安全计算容器中的安全计算授权与加载模块。
410、终端将安全计算结果传输至终端的主容器。
终端将安全计算结果传输至终端的主容器。具体的，终端的安全计算授权与加载模块将接收到的安全计算结果传输至主容器中的可信应用程序TA。
本申请实施例中，通过新增的安全计算容器，在安全计算容器中对安全计算单元进行校验、认证与加载，保证了验证与加载安全计算单元的安全性，改进了目前TA进行验证的流程，既降低第三方开发者和终端厂商的接入成本，又保证了验证与加载安全计算单元的安全性；通过二级证书、在安全容器中进行合法性校验的方法，解耦了目前TA开发流程冗长的问题，向第三方开发者开放了安全计算的能力，简化第三方开发者对TA的开发和部署流程，提高了对TA的处理效率。
上面对本申请实施例中基于多容器的可信应用程序的处理方法进行了描述，下面对本申请实施例中的终端和验证服务器进行描述，请参阅图5，本申请实施例中终端的一个实施例包括：
校验单元501，用于通过安全计算容器对签名的安全计算单元进行完整性校验；
第一处理单元502，若签名的安全计算单元通过完整性校验，则用于通过安全计算容器对签名的安全计算单元进行合法性校验并获取校验结果；
第二处理单元503，若校验结果为合法的，则用于通过可信执行环境TEE或安全元件SE加载签名的安全计算单元并获取可信应用程序的安全计算结果。
本申请实施例，通过引入安全计算容器的方式，避免了TEE的客户端应用程序受到攻击，达到了隔离主容器和TEE的安全效果，提高了可信执行环境的访问接口的安全性。
请参阅图6，本申请实施例中终端的另一个实施例包括：
校验单元601，用于通过安全计算容器对签名的安全计算单元进行完整性校验；
第一处理单元602，若签名的安全计算单元通过完整性校验，则用于通过安全计算容器对签名的安全计算单元进行合法性校验并获取校验结果；
第二处理单元603，若校验结果为合法的，则用于通过可信执行环境TEE或安全元件SE加载签名的安全计算单元并获取可信应用程序的安全计算结果。
在一个示例中，第一处理单元602具体用于：
通过安全计算容器获取签名的安全计算单元的二级证书，该二级证书用于验证签名的安全计算单元的合法性；
通过安全计算容器将二级证书发送至验证服务器；
通过安全计算容器接收验证服务器发送的校验结果。
在一个示例中，校验单元601具体用于：
通过安全计算容器中的安全计算授权与加载模块从签名的安全计算单元中获取签名文件；
通过安全计算授权与加载模块从签名的安全计算单元中获取安全计算单元文件元数据；
通过安全计算授权与加载模块对安全计算单元文件元数据进行摘要计算，得到安全计算单元文件元数据的哈希值；
通过安全计算授权与加载模块将哈希值和签名文件进行完整性校验。
在一个示例中，终端还可以包括：
获取单元604，用于从主容器获取加载请求，该加载请求用于终端的安全计算容器加载签名的安全计算单元，该签名的安全计算单元用于对可信应用程序进行安全计算。
在一个示例中，终端还可以包括：
传输单元605，用于将安全计算结果传输至终端的主容器。
在一个示例中，终端还可以包括：
第一停止单元606，若签名的安全计算单元没有通过完整性验证，则用于停止加载签名的安全计算单元的流程。
在一个示例中，终端还可以包括：
第二停止单元607，若校验结果为不合法的，则用于停止加载签名的安全计算单元的流程。
在一个示例中，签名的安全计算单元的文件格式至少包括初始段、代码段和数据段。
本申请实施例中，通过新增的安全计算容器，在安全计算容器中对安全计算单元进行校验、认证与加载，保证了验证与加载安全计算单元的安全性，改进了目前TA进行验证的流程，提高了TEE的访问接口安全性；通过二级证书、在安全容器中进行合法性校验的方法，解耦了目前TA开发流程冗长的问题，向第三方开发者开放了安全计算的能力，简化第三方开发者对TA的开发和部署流程，提高了对TA的处理效率；规定了安全计算的统一接口，便于TA应用程序的开发。
请参阅图7，本申请实施例中验证服务器的一个实施例包括：
接收单元701，用于接收终端发送的二级证书，该二级证书用于验证签名的安全计算单元的合法性；
获取单元702，用于从数字证书认证服务器获取根证书；
验证单元703，用于验证二级证书是否为根证书签发；
第一确定单元704，若二级证书为根证书签发，则用于确定签名的安全计算单元为合法的；
第二确定单元705，若二级证书不为根证书签发，则用于确定签名的安全计算单元为不合法的。
本申请实施例中，通过验证服务器对安全计算单元的证书进行在线验证合法性，只有在证书有效的情况才会加载安全计算单元，保证了安全计算单元的合法性。
请参阅图8，本申请实施例中验证服务器的另一个实施例包括：
接收单元801，用于接收终端发送的二级证书，该二级证书用于验证签名的安全计算单元的合法性；
获取单元802，用于从数字证书认证服务器获取根证书；
验证单元803，用于验证二级证书是否为根证书签发；
第一确定单元804，若二级证书为根证书签发，则用于确定签名的安全计算单元为合法的；
第二确定单元805，若二级证书不为根证书签发，则用于确定签名的安全计算单元为不合法的。
在一个示例中，服务器还包括：
发送单元806，用于将验证结果发送至终端，该验证结果用于指示签名的安全计算单元是否为合法的。
在一个示例中，验证单元803具体用于：
判断二级证书的公钥和根证书的公钥是否相同；
若相同，则确定二级证书为根证书签发；
若不相同，则确定二级证书不为根证书签发。
本申请实施例中，通过验证服务器对安全计算单元的证书进行在线验证合法性，只有在证书有效的情况才会加载安全计算单元，这样保证了安全计算单元的合法性。
上面图5至图8从模块化功能实体的角度分别对本申请实施例中终端和验证服务器进行详细描述，下面从硬件处理的角度对本申请实施例中终端和验证服务器进行详细描述。
本申请实施例提供一种终端，如图9A所示，该终端具有存储器901、收发器902和至少一个处理器903，该存储器901存储程序代码和数据，例如该存储器中受保护区域可以存储TEE操作系统和可信应用程序，该存储器的非受保护区域可以存储REE操作系统和客户端应用程序，存储器901、收发器902和至少一个处理器903通过总线904互相连接，总线904可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。该处理器903执行该存储器901中的程序代码以指令该终端完成上述方法实施例中的操作，简化可信应用程序的开发和部署流程，提高对可信应用程序的处理效率。
图9B是本申请实施例提供的一种终端的结构示意图，参考图9B，终端910包括主容器911、安全计算容器912、可信执行环境(trusted execution environment，TEE)和安全元件(secure element，SE)913、系统内核914和平台硬件915，其中，主容器911中运行环境为REE，主容器911中包括多个应用程序，安全计算容器912包括安全计算授权与加载模块，可信执行环境和安全元件913中包括可信应用程序管理器。
图10示出的是与本申请实施例提供的终端的部分结构的框图。参考图10，所述终端包括：射频(radio frequency，RF)电路1010、存储器1020、输入单元1030、显示单元1040、传感器1050、音频电路1060、无线保真(wireless fidelity，WIFI)模块1070和处理器1080等部件。本领域技术人员可以理解，图10中示出的终端结构并不构成对所述终端的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
处理器1080是终端的控制中心，在本申请实施例中，可以对签名的安全计算单元进行完整性验证，并加载签名的安全计算单元并获取可信应用程序的安全计算结果。
RF电路1010通过总线与所述处理器1080连接，负责向互联网发送数据或者从互联网接收数据，还可用于收发信息过程中，信号的接收和发送，例如，向验证服务器发送二级证书；另外，终端在接收到验证服务器发送的验证结果后，将验证结果发送给处理器1080处理。通常，所述RF电路1010包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(low noise amplifier，LNA)、双工器等。此外，所述RF电路1010还可以通过无线通信与网络和其他设备通信。上述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(global system of mobile communication，GSM)、通用分组无线服务(general packet radio service，GPRS)、码分多址(code division multiple access，CDMA)、宽带码分多址(wideband code division multiple access，WCDMA)、长期演进(long term evolution，LTE)、电子邮件、短消息服务(short messaging service，SMS)等。
存储器1020可用于存储软件程序以及模块，所述处理器1080通过运行存储在所述存储器1020的软件程序以及模块，从而执行终端的各种功能应用以及数据处理。所述存储器1020可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如对签名的安全计算单元进行完整性验证等)等；存储数据区可存储根据终端的使用所创建的数据(比如安全计算结果等)等。此外，所述存储器1020 可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
图11是本申请实施例提供的一种验证服务器的结构示意图，该验证服务器1100可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(central processing units，CPU)1101(例如，一个或一个以上处理器)和存储介质1108，一个或一个以上存储应用程序1107或数据1106的存储介质1108(例如一个或一个以上海量存储设备)。其中，存储介质1108可以是短暂存储或持久存储。存储在存储介质1108的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对验证服务器中的一系列代码。更进一步地，处理器1101可以设置为与存储介质1108通信，处理器1101是验证服务器的控制中心，可利用各种接口和线路连接整个验证服务器的各个部分，通过运行或执行存储在存储介质1108内的软件程序和/或模块，以及调用存储在存储介质1108内的数据，验证服务器的各种功能和处理数据，从而完成对终端发送的二级证书的合法性验证。
存储介质1108可用于存储软件程序以及模块，处理器1101通过运行存储在存储介质1108的软件程序以及模块，从而执行验证服务器1100的各种功能应用以及数据处理。存储介质1108可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如判断二级证书是否合法等)等；存储数据区可存储根据验证服务器的使用所创建的数据(比如确定二级证书为合法的)等。此外，存储介质1108可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。在本申请实施例中提供的基于多容器的可信应用程序的处理方法的程序和接收到的数据流存储在存储器中，当需要使用时，处理器1101从存储介质1108中调用。
验证服务器1100还可以包括一个或一个以上电源1102，一个或一个以上有线或无线网络接口1103，一个或一个以上输入输出接口1104，和/或，一个或一个以上操作系统1105，例如Windows Serve，Mac OS X，Unix，Linux，FreeBSD等等。本领域技术人员可以理解，图11中示出的验证服务器结构并不构成对验证服务器的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络 单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (24)

  1. 一种基于多容器的可信应用程序的处理方法，其特征在于，包括：
    终端通过安全计算容器对签名的安全计算单元进行完整性校验；
    若所述签名的安全计算单元通过所述完整性校验，则所述终端通过所述安全计算容器对所述签名的安全计算单元进行合法性校验并获取校验结果；
    若所述校验结果为合法的，则所述终端通过可信执行环境TEE或安全元件SE加载所述签名的安全计算单元并获取可信应用程序的安全计算结果。
  2. 根据权利要求1所述的处理方法，其特征在于，所述终端通过所述安全计算容器对所述签名的安全计算单元进行合法性校验并获取校验结果包括：
    所述终端通过所述安全计算容器获取所述签名的安全计算单元的二级证书，所述二级证书用于验证所述签名的安全计算单元的合法性；
    所述终端通过所述安全计算容器将所述二级证书发送至验证服务器；
    所述终端通过所述安全计算容器接收所述验证服务器发送的校验结果。
  3. 根据权利要求1所述的处理方法，其特征在于，所述终端通过安全计算容器对签名的安全计算单元进行完整性校验包括：
    所述终端通过所述安全计算容器中的安全计算授权与加载模块从所述签名的安全计算单元中获取签名文件；
    所述终端通过所述安全计算授权与加载模块从所述签名的安全计算单元中获取安全计算单元文件元数据；
    所述终端通过所述安全计算授权与加载模块对所述安全计算单元文件元数据进行摘要计算，得到所述安全计算单元文件元数据的哈希值；
    所述终端通过所述安全计算授权与加载模块将所述哈希值和所述签名文件进行比对校验。
  4. 根据权利要求1所述的处理方法，其特征在于，所述终端通过安全计算容器对签名的安全计算单元进行完整性校验之前，所述方法还包括：
    所述终端从主容器获取加载请求，所述加载请求用于所述终端的安全计算容器加载所述签名的安全计算单元，所述签名的安全计算单元用于对所述可信应用程序进行安全计算。
  5. 根据权利要求1-4任一所述的处理方法，其特征在于，所述终端通过可信执行环境TEE或安全元件SE加载所述签名的安全计算单元并获取可信应用程序的安全计算结果之后，所述方法还包括：
    所述终端将所述安全计算结果传输至所述终端的主容器。
  6. 根据权利要求1-4任一所述的处理方法，其特征在于，所述方法还包括：
    若所述签名的安全计算单元没有通过所述完整性校验，则所述终端停止加载所述签名的安全计算单元的流程。
  7. 根据权利要求1-4任一所述的处理方法，其特征在于，所述方法还包括：
    若所述校验结果为不合法的，则所述终端停止加载所述签名的安全计算单元的流程。
  8. 一种基于多容器的可信应用程序的处理方法，其特征在于，包括：
    验证服务器接收终端发送的二级证书，所述二级证书用于验证签名的安全计算单元的合法性；
    所述验证服务器从数字证书认证服务器获取根证书；
    所述验证服务器验证所述二级证书是否为所述根证书签发；
    若所述二级证书为所述根证书签发，则所述验证服务器确定所述签名的安全计算单元为合法的；
    若所述二级证书不为所述根证书签发，则所述验证服务器确定所述签名的安全计算单元为不合法的。
  9. 根据权利要求8所述的处理方法，其特征在于，所述方法还包括：
    所述验证服务器将验证结果发送至所述终端，所述验证结果用于指示所述签名的安全计算单元是否为合法的。
  10. 根据权利要求8或9所述的处理方法，其特征在于，所述验证服务器验证所述二级证书是否为所述根证书签发包括：
    所述验证服务器判断所述二级证书的公钥和根证书的公钥是否相同；
    若相同，则所述验证服务器确定所述二级证书为所述根证书签发；
    若不相同，则所述验证服务器确定所述二级证书不为所述根证书签发。
  11. 一种终端，其特征在于，包括：
    校验单元，用于通过安全计算容器对签名的安全计算单元进行完整性校验；
    第一处理单元，若所述签名的安全计算单元通过所述完整性校验，则用于通过所述安全计算容器对所述签名的安全计算单元进行合法性校验并获取校验结果；
    第二处理单元，若所述校验结果为合法的，则用于通过可信执行环境TEE或安全元件SE加载所述签名的安全计算单元并获取可信应用程序的安全计算结果。
  12. 根据权利要求11所述的终端，其特征在于，所述第一处理单元具体用于：
    通过所述安全计算容器获取所述签名的安全计算单元的二级证书，所述二级证书用于验证所述签名的安全计算单元的合法性；
    通过所述安全计算容器将所述二级证书发送至验证服务器；
    通过所述安全计算容器接收所述验证服务器发送的校验结果。
  13. 根据权利要求11所述的终端，其特征在于，所述校验单元具体用于：
    通过所述安全计算容器中的安全计算授权与加载模块从所述签名的安全计算单元中获取签名文件；
    通过所述安全计算授权与加载模块从所述签名的安全计算单元中获取安全计算单元文件元数据；
    通过所述安全计算授权与加载模块对所述安全计算单元文件元数据进行摘要计算，得到所述安全计算单元文件元数据的哈希值；
    通过所述安全计算授权与加载模块将所述哈希值和所述签名文件进行比对校验。
  14. 根据权利要求11所述的终端，其特征在于，所述终端还包括：
    获取单元，用于从主容器获取加载请求，所述加载请求用于所述终端的安全计算容器加载所述签名的安全计算单元，所述签名的安全计算单元用于对所述可信应用程序进行安全计算。
  15. 根据权利要求11-14任一所述的终端，其特征在于，所述终端还包括：
    传输单元，用于将所述安全计算结果传输至所述终端的主容器。
  16. 根据权利要求11-14任一所述的终端，其特征在于，所述终端还包括：
    第一停止单元，若所述签名的安全计算单元没有通过所述完整性校验，则用于停止加载所述签名的安全计算单元的流程。
  17. 根据权利要求11-14任一所述的终端，其特征在于，所述终端还包括：
    第二停止单元，若所述校验结果为不合法的，则用于停止加载所述签名的安全计算单元的流程。
  18. 一种服务器，其特征在于，所述服务器为验证服务器，包括：
    接收单元，用于接收终端发送的二级证书，所述二级证书用于验证签名的安全计算单元的合法性；
    获取单元，用于从数字证书认证服务器获取根证书；
    验证单元，用于验证所述二级证书是否为所述根证书签发；
    第一确定单元，若所述二级证书为所述根证书签发，则用于确定所述签名的安全计算单元为合法的；
    第二确定单元，若所述二级证书不为所述根证书签发，则用于确定所述签名的安全计算单元为不合法的。
  19. 根据权利要求18所述的服务器，其特征在于，所述服务器还包括：
    发送单元，用于将验证结果发送至所述终端，所述验证结果用于指示所述签名的安全计算单元是否为合法的。
  20. 根据权利要求18或19所述的服务器，其特征在于，所述验证单元具体用于：
    判断所述二级证书的公钥和根证书的公钥是否相同；
    若相同，则确定所述二级证书为所述根证书签发；
    若不相同，则确定所述二级证书不为所述根证书签发。
  21. 一种终端，其特征在于，包括：
    存储器、收发器和至少一个处理器，所述存储器中存储有程序代码，所述存储器、所述收发器和所述至少一个处理器通过线路通信，所述处理器运行所述代码以指令所述终端执行如权利要求1-7任一项所述的方法。
  22. 一种服务器，其特征在于，包括：
    存储器、收发器和至少一个处理器，所述存储器中存储有程序代码，所述存储器、所述收发器和所述至少一个处理器通过线路通信，所述处理器运行所述代码以指令所述服务器执行如权利要求8-10任一项所述的方法。
  23. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1-10任意一项所述的方法。
  24. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如权利要求1-10任意一项所述的方法。
PCT/CN2019/088082 2018-05-25 2019-05-23 一种基于多容器的可信应用程序的处理方法及相关设备 WO2019223751A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19807800.8A EP3686762A4 (en) 2018-05-25 2019-05-23 MULTIPLE CONTAINER BASED TRUSTED APPLICATION PROCESSING METHOD AND ASSOCIATED DEVICE
US16/872,642 US11429719B2 (en) 2018-05-25 2020-05-12 Multi-container-based trusted application processing method and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810516372.8 2018-05-25
CN201810516372.8A CN110532766B (zh) 2018-05-25 2018-05-25 一种基于多容器的可信应用程序的处理方法及相关设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/872,642 Continuation US11429719B2 (en) 2018-05-25 2020-05-12 Multi-container-based trusted application processing method and related device

Publications (1)

Publication Number Publication Date
WO2019223751A1 true WO2019223751A1 (zh) 2019-11-28

Family

ID=68616564

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/088082 WO2019223751A1 (zh) 2018-05-25 2019-05-23 一种基于多容器的可信应用程序的处理方法及相关设备

Country Status (4)

Country Link
US (1) US11429719B2 (zh)
EP (1) EP3686762A4 (zh)
CN (1) CN110532766B (zh)
WO (1) WO2019223751A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11341247B2 (en) * 2019-08-27 2022-05-24 Red Hat, Inc. Use of a trusted execution environment as a safe build environment
CN110995759A (zh) * 2019-12-23 2020-04-10 中国联合网络通信集团有限公司 物联网的接入方法以及装置
CN111143857B (zh) * 2019-12-27 2022-04-22 达闼机器人有限公司 一种数据分享方法、机器人控制器及存储介质
CN111148070B (zh) * 2019-12-31 2021-06-15 华为技术有限公司 V2x通信方法、装置及车辆
US11436343B2 (en) * 2019-12-31 2022-09-06 Arm Limited Device, system, and method of policy enforcement for rich execution environment
CN111224986A (zh) * 2020-01-07 2020-06-02 杭州宇链科技有限公司 一种基于可信执行环境的多方隐私计算系统
CN111221629B (zh) * 2020-01-09 2023-09-05 上海沄界信息科技有限公司 计算资源使用量量化方法及装置
CN113849565A (zh) * 2021-09-26 2021-12-28 支付宝(杭州)信息技术有限公司 用于可信上链的方法及终端设备
CN114301601B (zh) * 2021-12-28 2023-11-03 福建汇思博数字科技有限公司 一种基于Android平台的接口管理方法及终端
CN115695039B (zh) * 2022-11-13 2023-08-18 济南三泽信息安全测评有限公司 网络安全漏洞检测系统及方法
CN116436681B (zh) * 2023-04-25 2024-01-02 上海物盾信息科技有限公司 一种基于TrustZone的安全隔离系统、方法、终端及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105429760A (zh) * 2015-12-01 2016-03-23 神州融安科技（北京）有限公司 一种基于tee的数字证书的身份验证方法及系统
CN106815494A (zh) * 2016-12-28 2017-06-09 中软信息系统工程有限公司 一种基于cpu时空隔离机制实现应用程序安全认证的方法
CN107277020A (zh) * 2017-06-23 2017-10-20 国民认证科技（北京）有限公司 基于公私钥体制的远程验证移动设备合法性的系统和方法
CN107567629A (zh) * 2015-03-19 2018-01-09 英特尔公司 在可信执行环境容器中的动态固件模块加载器
US20180113817A1 (en) * 2015-06-15 2018-04-26 Intel Corporation Virtualization-based platform protection technology

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030037237A1 (en) * 2001-04-09 2003-02-20 Jean-Paul Abgrall Systems and methods for computer device authentication
US9497221B2 (en) * 2013-09-12 2016-11-15 The Boeing Company Mobile communication device and method of operating thereof
CN104239802A (zh) * 2014-10-15 2014-12-24 浪潮电子信息产业股份有限公司 一种基于云数据中心的可信服务器设计方法
KR20160124648A (ko) * 2015-04-20 2016-10-28 삼성전자주식회사 프로파일 다운로드 및 설치 장치
WO2016167536A1 (en) * 2015-04-13 2016-10-20 Samsung Electronics Co., Ltd. Method and apparatus for managing a profile of a terminal in a wireless communication system
US20160350534A1 (en) * 2015-05-29 2016-12-01 Intel Corporation System, apparatus and method for controlling multiple trusted execution environments in a system
CN105138904B (zh) * 2015-08-25 2018-06-15 华为技术有限公司 一种访问控制方法和装置
CN107577937B (zh) * 2017-09-01 2021-05-04 深信服科技股份有限公司 一种应用程序保护方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107567629A (zh) * 2015-03-19 2018-01-09 英特尔公司 在可信执行环境容器中的动态固件模块加载器
US20180113817A1 (en) * 2015-06-15 2018-04-26 Intel Corporation Virtualization-based platform protection technology
CN105429760A (zh) * 2015-12-01 2016-03-23 神州融安科技（北京）有限公司 一种基于tee的数字证书的身份验证方法及系统
CN106815494A (zh) * 2016-12-28 2017-06-09 中软信息系统工程有限公司 一种基于cpu时空隔离机制实现应用程序安全认证的方法
CN107277020A (zh) * 2017-06-23 2017-10-20 国民认证科技（北京）有限公司 基于公私钥体制的远程验证移动设备合法性的系统和方法

Also Published As

Publication number Publication date
CN110532766B (zh) 2023-09-08
US11429719B2 (en) 2022-08-30
CN110532766A (zh) 2019-12-03
US20200272737A1 (en) 2020-08-27
EP3686762A4 (en) 2021-06-09
EP3686762A1 (en) 2020-07-29

Similar Documents

Publication Publication Date Title
WO2019223751A1 (zh) 一种基于多容器的可信应用程序的处理方法及相关设备
US20210006416A1 (en) Platform attestation and registration for servers
US10601596B2 (en) Techniques to secure computation data in a computing environment
WO2021136290A1 (zh) 一种身份认证方法、装置及相关设备
US9867043B2 (en) Secure device service enrollment
US9998438B2 (en) Verifying the security of a remote server
US11336635B2 (en) Systems and methods for authenticating device through IoT cloud using hardware security module
WO2016011778A1 (zh) 数据处理的方法和装置
US10536271B1 (en) Silicon key attestation
WO2022105462A1 (zh) 一种数据库多重认证方法、系统、终端及存储介质
WO2019071650A1 (zh) 一种安全元件中的应用的升级方法及相关设备
EP3912064A1 (en) Apparatus and method for dynamic configuration of trusted application access control
WO2022048318A1 (zh) 一种建立通信信道的方法及用户终端
CN112765637A (zh) 数据处理方法、密码服务装置和电子设备
EP3133791B1 (en) Double authentication system for electronically signed documents
WO2023030014A1 (zh) 智能设备的绑定方法、系统及相关设备
JP2023552421A (ja) ハードウェア・セキュリティ・モジュールのリモート管理
EP3179751B1 (en) Information sending method and apparatus, terminal device, and system
US20240013206A1 (en) In-line verification of transactions
WO2023087930A1 (zh) 一种设备身份的认证方法、装置、电子设备及存储介质
CN116094793A (zh) 基于数据证书建立运营中心与安全设备连接的方法及系统
CN115357866A (zh) 应用程序执行方法、装置、设备及存储介质
WO2021238769A1 (zh) 一种数字证书安装方法及设备
CN117063174A (zh) 用于通过基于app的身份的app间相互信任的安全模块及方法
WO2022088434A1 (zh) 程序验证方法和装置、平台和用户终端及在线服务系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19807800

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019807800

Country of ref document: EP

Effective date: 20200424

NENP Non-entry into the national phase

Ref country code: DE