WO2019242446A1 - 基于tee和ree的分离式切换方法及其系统 - Google Patents

基于tee和ree的分离式切换方法及其系统 Download PDF

Info

Publication number
WO2019242446A1
WO2019242446A1 PCT/CN2019/087734 CN2019087734W WO2019242446A1 WO 2019242446 A1 WO2019242446 A1 WO 2019242446A1 CN 2019087734 W CN2019087734 W CN 2019087734W WO 2019242446 A1 WO2019242446 A1 WO 2019242446A1
Authority
WO
WIPO (PCT)
Prior art keywords
ree
tee
environment
separate
configuration
Prior art date
Application number
PCT/CN2019/087734
Other languages
English (en)
French (fr)
Inventor
陈成钱
周钰
郭伟
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2019242446A1 publication Critical patent/WO2019242446A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2105—Dual mode as a secondary aspect

Definitions

  • the present invention relates to mobile communication technology, and in particular, to a separate switching method based on TEE and REE and a separate switching system based on TEE and REE.
  • TEE Trusted Execution Environment
  • Secure Boot Secure boot
  • Trusted UI secure display and touch
  • secure storage Secure storage
  • Trusted UI that is, TUI, trusted UI
  • TUI trusted UI
  • security-sensitive services such as payment and office.
  • TUI based on TrustZone technology can solve malicious attacks and data theft of user interfaces containing sensitive data information. Or tampering.
  • FIG. 1 is a schematic diagram of a conventional trusted TUI.
  • the user starts an application 71 (for example, an online banking APP), enters the transaction interface, and enters transaction information.
  • the CPU is in SVC mode and the REE (Rich Execution Environment) 60 in the CPU controls the LCD through the bus.
  • the controller 80 thus controls the LCD display 90, and the application 61 finally sends the transaction information to the driver 62 by calling the NDK interface (a plurality of drivers such as a display driver, a touch driver, etc. are illustrated in FIG. 1, and the number and type of the drivers are not affected Limitation), the driver 62 enters TEE 60 through TrustZone's SMC instruction (Secure Monitor Monitor Call).
  • the CPU automatically enters the SecureMonitor mode from the SVC mode, and saves the register values in the LCD controller 80 to the buffer of the REE 60, while the LCD display
  • the display resources at 90 at this time will also be stored in the cache of the REE.
  • the monitor 72 in the TEE 70 starts the corresponding security application 71 (for example, online banking TA, Trust Application) and sends the transaction information. All peripheral-related registers are controlled by TEE 70 (including the registers of LCD controller 80 are also controlled by TEE 70 to display TUI). Display of transaction information (TUI) and user confirmation (such as PIN code verification).
  • the transaction result is returned to the driver 62 by the TEE 70 through the SMC instruction.
  • the CPU automatically switches back to the SVC mode and all peripheral-related registers are returned to the REE.
  • 60 controls including restoring REE 60 control over the registers in LCD controller 80
  • each register in LCD controller 80 restores the value stored in the buffer of REE 60
  • LCD display 90 is immediately loaded and stored in REE 60
  • the resources in the cache, the driver 62 returns the transaction result to the application 61 and prepares the next interface, and the LCD display 90 displays the interface. See Figure 2 for the specific process.
  • FIG. 2 shows a conventional mobile phone transfer process based on REE and TEE.
  • the application 61 initiates a command for displaying a trading interface, and displays a trading interface based on the LCD screen 80 of the REE graphic library.
  • the user enters transaction information through the application and sends the transaction information to the driver 62.
  • the driver 62 sends the SMC instruction and transaction information to the monitor 72.
  • the monitor 72 activates the security corresponding to the application 61.
  • the application (TA) 71 sends transaction information.
  • the security application 71 sends the transaction information to the TUI.
  • the LCD display 80 displays the TUI (including transaction information) and asks the user to enter a PIN code. After the TUI obtains the PIN, it sends it to the security application 71.
  • the security application 71 returns the transaction result to the monitor 72.
  • the monitor 72 sends the SMC instruction and the transaction result. At this time, it indicates that it is leaving the TEE.
  • the driver 62 returns the transaction result to the application 61, and then the application 61 resumes the scene, so that the LCD display screen 90 displays a trading interface, and the reporter, the application 71 prepares the next interface, and then causes the LCD display 90 to display the next interface.
  • the specific user experience takes mobile phone transfer as an example.
  • the user enters the payee, payment card number, transfer amount and other information in the transfer interface (A interface) of the security application.
  • a interface the transfer interface
  • the control right of the LCD screen is The Android REE is transferred to TEE.
  • the LCD screen displays the payee information and requires the PIN code to confirm.
  • This interface is TUI (B interface).
  • the TA in TEE is responsible for displaying the transaction information and confirming the user. After the PIN code is confirmed correctly The control of the LCD screen is returned by TEE to REE.
  • REE will restore the scene first, that is, the LCD screen will first jump back to the last interface before entering TUI (in this example, the REE transfer interface, that is, the A interface), wait until After the prompt for successful transfer is prepared, jump to the prompt for successful transfer (C interface).
  • TUI in this example, the REE transfer interface, that is, the A interface
  • C interface the prompt for successful transfer
  • Figure 3 shows an example of a user interface display in a mobile phone transfer.
  • the phenomenon experienced by the user is that the A interface jumps to the B interface and then returns to the A interface and then the C interface, which has no fluency and affects the user experience.
  • the present invention aims to provide a TEE and REE-based split handover method and a TEE and REE-based split handover system that enrich application scenarios and improve user experience.
  • the TEE and REE-based separated switching system of the present invention includes a TEE environment and a REE environment, and is characterized in that:
  • the driver sends a separate configuration application
  • the monitor is provided with a register separation configuration module, and the register separation configuration module accepts the separation configuration application and selectively causes a register corresponding to a peripheral device to return to a REE from an TEE environment based on the separation configuration application.
  • the hold time is still controlled by TEE.
  • the register separation configuration module includes:
  • Non-separated configuration area for managing corresponding registers of peripherals in non-separated configuration mode
  • the separate configuration area is used to manage the corresponding registers of the peripherals in the separate configuration mode.
  • the registers of the peripheral devices are controlled by the REE.
  • the register of the peripheral device keeps the separate configuration state unchanged, that is, controlled by the TEE.
  • the driver is further configured to send a cancel separation configuration request
  • the register separation configuration module accepts the cancel separation configuration request and causes a register corresponding to the peripheral device to be controlled by the REE after an application returns the REE from the TEE environment based on the cancellation separation configuration request.
  • the peripheral includes a display, a camera, and an NFC function.
  • the register separation configuration module is provided in a CPU that uniformly controls each peripheral device.
  • the register separation configuration module is provided in a controller of each peripheral device.
  • Application step sending a separate configuration application through the driver
  • the register corresponding to the peripheral device is selectively controlled by the TEE to remain within a specified time after an application returns to the REE from the TEE environment.
  • a separate configuration request is sent through a driver, and applications of some peripherals are marked as a separate configuration mode, and applications of other peripherals are marked as a non-separate configuration mode according to the setting.
  • the registers of the peripheral devices are controlled by the REE.
  • the registers of the peripheral devices remain in the separate configuration state, that is, they are still controlled by the TEE.
  • the method further includes:
  • the driver sends a cancel separation configuration request, and based on the cancel separation configuration request, the register corresponding to the peripheral device is controlled by the REE after an application returns the REE from the TEE environment.
  • the computer-readable storage medium of the present invention has a computer program stored thereon, which is characterized in that when the program is executed by a processor, the above-mentioned separate switching method based on TEE and REE is implemented.
  • the computer equipment of the present invention includes a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, when the processor executes the program, the foregoing TEE and REE-based separation type is implemented. Switching method.
  • the control rights of all peripherals are uniformly returned to REE.
  • the user can choose which peripherals are returned to the REE control according to the needs, and which peripherals are still controlled by the TEE for a certain period of time. This can enrich the application scenario and optimize the user experience.
  • FIG. 1 is a schematic diagram of a conventional trusted TUI.
  • FIG. 2 shows a conventional mobile phone transfer process based on REE and TEE.
  • Figure 3 shows an example of a user interface display in a mobile phone transfer.
  • Fig. 4 is a block diagram showing the structure of a TEE and REE-based split switching system according to the present invention.
  • FIG. 5 is a block diagram showing the structure of a TEE and REE-based separation switching system according to an embodiment of the present invention.
  • FIG. 6 is a flowchart illustrating a separate switching method according to an embodiment of the present invention.
  • FIG. 7 shows a display example of a user interface for mobile phone transfer using a separate switching method according to an embodiment of the present invention.
  • the main idea of the present invention is to cancel the integrated management method for all peripheral registers when switching between REE and TEE, and adopt a separate method, that is, by integrating the register separation configuration module in the monitor, selectivity can be achieved.
  • the purpose of returning some peripheral devices to the REE from the TEE for a period of time is still controlled by the TEE, rather than returning all the peripheral devices to the REE control as in the original scheme.
  • the present invention is implemented as follows: When the driver enters the TEE via the SMC instruction (meaning that the LCD display content is ready to jump from Android to TUI), the control of the LCD is handed over to the TEE by the REE, and the LCD displays the TUI
  • the TEE returns the transaction result to the driver through the SMC instruction meaning that the LCD display content is ready to jump from TEE to Android
  • the TEE control of the LCD is maintained, and the LCD still displays TUI (that is, the control of the LCD is still handed over TEE, other peripheral control rights are returned to Android)
  • Android ’s next interface resource is ready
  • notify the CPU to return control of the LCD to the REE notify the CPU to return control of the LCD to the REE, and the LCD loads the interface resources just prepared.
  • an important point of the present invention is to integrate a register separation configuration module in the TEE monitor, thereby achieving that some peripherals can still be selected by the application for a period of time after the application returns from TEE to REE. Purpose of TEE control.
  • Fig. 4 is a block diagram showing the structure of a TEE and REE-based split switching system according to the present invention.
  • a TEE and REE-based separation switching system includes a REE environment 100 and a TEE environment 200.
  • a driver 110 is provided in the REE environment 100.
  • four drivers are illustrated, and the driver 1 to the driver 4 are collectively referred to as the driver 110.
  • the driver 110 is configured to send a separate configuration application.
  • a monitor 210 is provided in the TEE environment 200.
  • the register 300 of each peripheral device controlled by the CNOOC monitor 210 is shown here as one register. In fact, it represents the register corresponding to each peripheral device, and they may be multiple.
  • the peripheral means here but is not limited to a display, a camera, and an NFC function.
  • a register separation configuration module 211 is set in the monitor 210, and the register separation configuration module 211 accepts the separation configuration application and selectively causes the register 300 corresponding to the peripheral device to return to the REE from an TEE environment based on the separation configuration application.
  • the hold time is still controlled by TEE.
  • the register separate configuration module 211 includes a non-separated configuration area 212 for managing corresponding registers of peripherals in the non-separated configuration mode, and a separate configuration area 213 for managing corresponding peripherals in the separate configuration mode. Register 300.
  • the register 300 of the peripheral device In the non-detached configuration mode, when an application returns from the TEE environment 200 to the REE environment 100, the register 300 of the peripheral device is controlled by the REE; in the separated configuration mode, when an application is in the slave TEE environment When 200 returns to the REE environment 100, the peripheral register 300 remains in a separate configuration state, that is, it is still controlled by the TEE.
  • the driver 110 sends an application instruction to the register separation configuration module 211 in the monitor 210, and marks certain peripheral applications as a separate configuration mode as required, and the remaining peripheral applications are Non-detached configuration mode.
  • the peripheral related registers 300 in the separate configuration mode are all taken over by the separate configuration area 213, and the peripheral related registers 300 in the non-separate configuration mode are all taken over by the non-separate configuration area 212. .
  • the registers 300 of the peripherals in the non-separated configuration mode are collectively restored to the REE scene (that is, the non-separated configuration status of these registers is canceled, and the corresponding peripheral control is returned to REE 100, each register.
  • the values before entering the TEE 200 are restored again), and the peripheral register 300 in the separate configuration mode remains in the separate configuration state (the peripherals corresponding to these registers are still controlled by the TEE).
  • the register separated configuration module 211 cancels the separated configuration state of the corresponding peripheral related registers 300, and the control rights of the registers 300 of these peripherals are returned to the REE. Therefore, the peripherals are also controlled by the REE.
  • FIG. 5 is a block diagram showing the structure of a TEE and REE-based separation switching system according to an embodiment of the present invention.
  • a REE (that is, Android) 10 and a TEE (ie, a believeable area) 20 are set in the CPU.
  • the REE 10 includes an application 11 (for example, an online banking App) and a driver 12.
  • the driver 12 there may be a driver such as a display driver 13, a touch driver 14, and the like.
  • the TEE 20 includes a security application 21 and a monitor 22, wherein a register separation configuration module 23 is provided in the monitor 22, and a non-separation configuration area 24 and a separation configuration area 25 are provided in the register separation configuration module 23.
  • the CPU is connected to the LCD controller 30 and the LCD display screen 40 through a bus.
  • the separated switching system in the above description is implemented in the CPU, that is, as shown in FIG. 5, the register separation configuration module 23 is provided in the CPU.
  • the register separation configuration module 23 can be implemented by a specific peripheral controller. While the CPU does not require unified control, it further satisfies the unique control requirements of specific peripheral devices.
  • the register separation configuration module 23 may be set in the controller (not shown) of each peripheral device.
  • the display screen is used as an example to describe the method of this patent.
  • Other peripherals such as cameras, NFC, etc., can also achieve the required separation delay control requirements by using this method.
  • Next, for the use of the separated switching system shown in FIG. 5 The implementation of the separated switching method will be described.
  • FIG. 6 is a flowchart illustrating a separate switching method according to an embodiment of the present invention.
  • FIG. 6 it includes the following steps:
  • the user opens the online banking APP (that is, application 11) and enters the transaction interface.
  • the CPU enters the SVC mode and the LCD display 40 is controlled by the REE through the bus to display the transaction interface in Android (for example, by calling the REE graphic library for display).
  • the user enters the transaction.
  • Information (payee, first card number, amount, etc.);
  • the online banking APP sends the LCD separation configuration application to the register separation configuration module 23 of the monitor 22 through the driver 112.
  • the LCD related registers are set to the separation configuration state (the purpose is to return to the TUI after the transaction is completed)
  • the LCD is still controlled by TEE to keep displaying TUI, but all resources and peripherals other than LCD are returned to REE.
  • REE prepares the next interface resource, it will notify Monitor to cancel its separate configuration state.
  • Each register of other peripherals is requested to be configured in a non-separated configuration state.
  • the relevant registers corresponding to each peripheral are set to a non-separated configuration state, and then the online banking APP is notified of the successful application;
  • the online banking APP sends the transaction information entered by the user to the driver 12, and the driver 12 sends SMC instructions and transaction information to the monitor 22 in the TEE.
  • the CPU enters the security monitor mode, and the control of the LCD is given to the TEE by the REE.
  • the monitor 22 Start the corresponding TA (security application) 21 and send the transaction information.
  • the LCD display screen loads the TUI resource (displays the transaction information) and asks the user to confirm the information. Then enter the PIN code to confirm. TA21 verifies the correctness of the PIN code.
  • TA21 will The verification result is returned to the monitor, and the monitor sends the transaction result to the driver 12 of the REE through the SMC instruction (at this time, because the registers related to the LCD display are in a separate configuration state and are still controlled by the TEE, the LCD display still displays TUI; and other (Because the peripheral related registers are in a non-separated configuration state, they will change from being controlled by TEE to being controlled by REE);
  • Online banking APP11 prepares the next interface resource according to the received transaction results (at this time, the LCD display still displays TUI, all resources except the LCD have been handed over to TEE by REE). After the next interface resource is ready, it informs the driver 12 Send the command to switch the LCD display back to the REE to the register separation configuration module 23. After receiving the command, the register separation configuration module 23 cancels the separation configuration state of the registers of the LCD display and returns control of the LCD display to the REE control after notification Online banking APP is set successfully;
  • the LCD display loads the prepared interface resources.
  • FIG. 7 shows a display example of a user interface for mobile phone transfer using a separate switching method according to an embodiment of the present invention.
  • the smooth experience of the A interface and then the C interface can be achieved (it will not return to the A interface and then the C interface after changing from the A interface to the B interface as in the prior art). ).
  • the TEE and REE-based separation switching method and the TEE and REE-based separation switching system according to the present invention are sufficient to solve the problem that when the application is switched from TEE to REE, the control rights of all peripherals are returned to the REE in a unified manner.
  • application developers can choose which peripherals to return to REE control according to needs, and which peripherals are still controlled by TEE for a certain period of time, which can enrich application scenarios and optimize user experience.
  • the invention also provides a computer-readable storage medium on which a computer program is stored, which is characterized in that when the program is executed by a processor, the above-mentioned separate switching method based on TEE and REE is implemented.
  • the present invention also provides a computer device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the TEE and REE based on the above when the program is executed. Separate switching method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Mathematical Physics (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Telephone Function (AREA)

Abstract

本发明涉及种基于TEE和REE的分离式切换系统。该系统包括TEE环境和REE环境，其特征在于，在所述REE环境中具备驱动器，在所述TEE环境中具备监控器以及对应于外设的寄存器，其中，所述驱动器发送分离配置申请，所述监控器具备寄存器分离配置模块，所述寄存器分离配置模块接受所述分离配置申请并且基于所述分离配置申请有选择性地使得外设对应的寄存器在某个应用从TEE环境返回REE后的规定时间内保持仍被TEE控制。根据本发明，够解决应用从TEE切换回REE时候，所有外设的控制权都统一交还给REE的问题，能够有选择地设定哪些外设交还给REE控制而哪些外设一定时间内依旧由TEE控制。

Description

基于TEE和REE的分离式切换方法及其系统 技术领域
本发明涉及移动通信技术，特别地涉及一种基于TEE和REE的分离式切换方法以及基于TEE和REE的分离式切换系统。
背景技术
目前随着移动设备的安全问题越来越受到关注，TEE(Trusted Execution Environment，可信执行环境)技术越来越广泛的被运用在终端安全领域(例如手机支付)，TEE包含的关键技术有：安全启动(Secure Boot)、安全显示和触摸(Trusted UI)、安全存储(Secure filesystem)等等，以下以Trusted UI为例说明目前的TEE方案实现方法。
目前Trusted UI(即TUI，可信UI)被广泛用于移动设备中，参与到安全敏感的业务(如支付、办公)中。移动设备中的用户界面因为在应用中处于相对敏感的位置(处理输入和输出)，容易成为恶意行为的目标，基于TrustZone技术的TUI可以解决包含敏感数据信息的用户界面被恶意攻击以及数据被窃取或篡改等问题。
图1是现有的可信TUI的框架示意图。
如图1所示，用户启动应用71(例如，网银APP)，进入交易界面，输入交易信息，此时CPU处于SVC模式且由CPU中REE(Rich Execution Environment，富执行环境)60通过总线控制LCD控制器80从而控制LCD显示屏90，应用61通过调用NDK接口最终将交易信息送入驱动器62(在图1中示例了显示驱动器、触摸驱动器等的多个驱动器，驱动器的个数和种类不受限制)，驱动器62通过TrustZone的SMC指令(Secure Monitor Call)进入TEE 60，此时CPU自动由SVC模式进入SecureMonitor模式，保存LCD控制器80中各寄存器值至REE 60的缓存中，同时LCD显示屏90此时的显示资源也会存储在REE的缓存中，TEE 70中的监视器72接收到SMC指令后启动对应的安全应用71(例如，网银TA，Trust Application)并送入交易信息，此时所有外设相关的寄存器都交由TEE 70控制(其中包括LCD控制器80的各寄存器也由TEE 70控制来显 示TUI)，安全应用71完成交易信息的显示(TUI)和用户确认(比如PIN码验证)，交易结果由TEE 70通过SMC指令返回给驱动器62，此时CPU自动切回SVC模式且所有外设相关的寄存器也都交还给REE 60控制(包括恢复REE 60对LCD控制器80中各寄存器的控制权)，LCD控制器80中各寄存器恢复保存在REE 60的缓存中的值，LCD显示屏90随即会加载之前储存在REE 60缓存中的资源，驱动器62再将交易结果返回给应用61准备好下一个界面后，LCD显示屏90显示该界面。具体流程参见图2。
图2是表示现有的基于REE和TEE而实现的手机转账过程。
首先，应用61发起显示交易界面命令，基于REE图形库LCD显示屏80显示交易界面。接着，用户通过应用输入交易信息，并将交易信息发送到驱动器62，驱动器62发送SMC指令和交易信息到监控器72，此时表示进入TEE，接着，监控器72启动对应于该应用61的安全应用(TA)71并送入交易信息，安全应用71将交易信息发送到TUI，LCD显示屏80显示TUI(包括交易信息)并要求用户输入PIN码。TUI获得PIN码后，发送到安全应用71，安全应用71将交易结果返回到监控器72，监控器72发送SMC指令和交易结果，此时，表示离开TEE。驱动器62将交易结果返回给应用61，接着，应用61恢复现场，使得LCD显示屏90显示交易界面，记者，应用71准备下一个界面，然后使得LCD显示屏90显示下一个界面。
具体的用户使用体验以手机转账为例，用户在安全应用的转账界面(A界面)中输入收款人、收款卡号、转账金额等信息，确认无误点击转账按钮后，LCD屏幕的控制权由安卓REE转给TEE，此时LCD屏幕显示收款人信息并要求输入PIN码确认，该界面即为TUI(B界面)，由TEE中TA负责交易信息的显示和用户确认，PIN码确认无误后，LCD屏幕的控制权由TEE交还给REE，首先REE会先恢复现场，即LCD屏幕首先会跳转回进入TUI之前的最后一个界面(本例中为REE的转账界面，即A界面)，等到提示转账成功界面准备好之后，再跳转到提示转账成功界面(C界面)，具体过程如图3所示。
图3中表示了手机转账中的用户界面显示示例。如图3所示，用户感受到的现象是A界面跳转B界面又回到A界面再跳转C界面，没有流畅感且影响用户体验。
也就是说，在现有技术中，对应用程序来说，在从TEE切换回REE的时候，由于采用的是一体式的切换方法，所有外设的控制权都统一由TEE交还给REE，导致在某些应用场景中的体验不够友好和流畅(例如上图中TUI返回REE过程时，A界面会重复显示的问题)。
发明内容
鉴于上述问题，本发明旨在提供一种丰富应用场景、提高用户体验的基于TEE和REE的分离式切换方法以及基于TEE和REE的分离式切换系统。
本发明的基于TEE和REE的分离式切换系统，包括TEE环境和REE环境，其特征在于，
在所述REE环境中具备驱动器，
在所述TEE环境中具备监控器，
其中，所述驱动器发送分离配置申请，
所述监控器具备寄存器分离配置模块，所述寄存器分离配置模块接受所述分离配置申请并且基于所述分离配置申请有选择性地使得外设对应的寄存器在某个应用从TEE环境返回REE后的规定时间内保持仍被TEE控制。
优选地，所述寄存器分离配置模块具备：
非分离配置区，用于管理非分离配置模式下的外设的对应的寄存器；以及
分离配置区，用于管理分离配置模式下的外设的对应的寄存器。
优选地，在所述非分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器由REE进行控制，
在所述分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器保持分离配置状态不变，即由TEE进行控制。
优选地，所述驱动器进一步用于发送取消分离配置请求，
所述寄存器分离配置模块接受所述取消分离配置请求并且基于所述取消分离配置请求使得外设对应的寄存器在某个应用从TEE环境返回REE后由REE控制。
优选地，所述外设包括：显示器、摄像头、NFC功能。
优选地，所述寄存器分离配置模块设置在对于各个外设进行统一控制的CPU中。
优选地，所述寄存器分离配置模块设置在各个外设的所属的控制器中。
本发明的基于TEE和REE的分离式切换方法，其特征在于，包括：
申请步骤，通过驱动器发送分离配置申请；
配置步骤，按照所述分离配置申请有选择性地使得外设对应的寄存器在某个应用从TEE环境返回REE后的规定时间内保持仍被TEE控制。
优选地，在所述请求步骤中，通过驱动器发送分离配置请求，根据设定使得某些外设的申请标记为分离配置模式，将其余的外设的申请标记为非分离配置模式。
优选地，在所述非分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器由REE进行控制，
在所述分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器保持分离配置状态不变即仍旧由TEE进行控制。
优选地，在所述配置步骤之后进一步具备：
取消步骤，通过驱动器发送取消分离配置请求，基于所述取消分离配置请求使得外设对应的寄存器在某个应用从TEE环境返回REE后由REE控制。
本发明的计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现上述的基于TEE和REE的分离式切换方法。
本发明的计算机设备，包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现上述的基于TEE和REE的分离式切换方法。
根据本发明的基于TEE和REE的分离式切换方法以及基于TEE和REE的分离式切换系统，能够解决应用从TEE切换回REE时候，所有外设的控制权都统一交还给REE的问题，应用开发者可以根据需要选择选择哪些外设交还给REE控制，哪些外设一定时间内依旧由TEE控制，由此，能够丰富了应用场景，优化了用户体验。
附图说明
图1是现有的可信TUI的框架示意图。
图2是表示现有的基于REE和TEE而实现的手机转账过程。
图3中表示了手机转账中的用户界面显示示例。
图4是表示本发明的基于TEE和REE的分离式切换系统的构造框图。
图5是表示本发明的一实施例的基于TEE和REE的分离式切换系统的构造框图。
图6是表示本发明一实施例的分离式切换方法的流程图。
图7中表示了利用本发明一实施例的分离式切换方法实现手机转账的用户界面显示示例。
具体实施方式
下面介绍的是本发明的多个实施例中的一些，旨在提供对本发明的基本了解。并不旨在确认本发明的关键或决定性的要素或限定所要保护的范围。
本发明的主要构思在于，取消了应用在REE和TEE之间切换时对所有外设寄存器的一体式管理方法，采用分离式方法，即通过在监控器中集成寄存器分离配置模块，达到可以选择性地将某些外设在应用从TEE返回REE后的一段时间内依旧由TEE控制的目的，而并非像原方案那样将所有的外设全部交还给REE控制。
以TUI为例的情况下本发明如下述这样实现：当驱动器通过SMC指令进入TEE时(意味着LCD显示内容准备从安卓跳转至TUI)，LCD的控制权由REE交给TEE，LCD显示TUI，当TEE通过SMC指令返回交易结果给驱动器时(意味着LCD显示内容准备从TEE跳转回安卓)，此时保持TEE对LCD的控制权，LCD依旧显示TUI(即LCD的控制权仍然交给TEE，除此以外的外设控制权交还给安卓)，直到安卓下一个界面资源已经准备好，通知CPU将LCD的控制权交还给REE，同时LCD加载刚刚准备好的界面资源。由此，能够解决TUI跳转回安卓时LCD会加载不必要界面的问题，优化了显示体验。
为了实现上述内容，本发明的重要一点是，在TEE的监控器中集成一个寄存器分离配置模块，由此达到可以选择性的将某些外设在应用从TEE返回REE后的一段时间内依旧由TEE控制的目的。
接着，对于本发明的基于TEE和REE的分离式切换系统进行说明。
图4是表示本发明的基于TEE和REE的分离式切换系统的构造框图。
如图1所示，本发明的一实施方式的基于TEE和REE的分离式切换系统包括REE环境100和TEE环境200。
在REE环境100中具备驱动器110，在图1中示例了4个驱动器，驱动器 1～驱动器4，将它们都统一称为驱动器110。在本发明中，驱动器110用于发送分离配置申请。
在TEE环境200中具备监控器210。另外，在图1中海油监控器210进行控制的各外设的寄存器300，这里寄存器300表示为一个，实际上它代表各外设对应的寄存器，它们可以是多个。另外，这里的外设是指但不限定于显示器、摄像头、NFC功能。
在监控器210中设置寄存器分离配置模块211，寄存器分离配置模块211接受所述分离配置申请并且基于分离配置申请有选择性地使得外设对应的寄存器300在某个应用从TEE环境返回REE后的规定时间内保持仍被TEE控制。
其中，寄存器分离配置模块211具备：非分离配置区212，用于管理非分离配置模式下的外设的对应的寄存器；以及分离配置区213，用于管理分离配置模式下的外设的对应的寄存器300。
在所述非分离配置模式下，当某个应用在从TEE环境200返回REE环境100时，外设的寄存器300由REE进行控制；在所述分离配置模式下，当某个应用在从TEE环境200返回REE环境100时，外设的寄存器300保持分离配置状态不变，即仍旧由TEE进行控制。
本发明的一实施方式的基于TEE和REE的分离式切换系统的交互过程主要有3个步骤：
(1)申请配置区
在应用从REE环境100进入TEE环境200时，通过驱动器110发送申请指令给监控器210中的寄存器分离配置模块211，根据需要将某些外设申请标记为分离配置模式，其余的外设申请为非分离配置模式。
(2)按配置区控制外设
在申请成功后，在应用进入TEE环境200之后，分离配置模式下的外设相关寄存器300都由分离配置区213接管，非分离配置模式下的外设相关寄存器300都由非分离配置区212接管。在从TEE 200返回REE 100时，非分离配置模式下的外设的各个寄存器300统一恢复REE现场(即这些寄存器的非分离配置状态被取消，对应的外设控制权交还给REE 100，各寄存器重新恢复进入TEE 200之前的值)，分离配置模式下的外设寄存器300保持分离配置状态不变(这些寄存器对 应的外设仍然由TEE控制)。
(3)取消分离模式
直到应用通过驱动器110发送取消分离配置状态的指令给监控器210后，寄存器分离配置模块211将对应的外设相关寄存器300的分离配置状态取消，这些外设的寄存器300控制权被交还给REE，从而外设也交由REE控制。
接着，以基于TUI的网银交易为例对于本发明的基于TEE和REE的分离式切换系统及其分离式切换方法进行说明。
图5是表示本发明的一实施例的基于TEE和REE的分离式切换系统的构造框图。
如图5所示，在CPU中设置REE(即安卓)10和TEE(即可信区域)20。其中，在REE 10中包括应用11(例如网银App)和驱动器12。作为驱动器12可以存在显示驱动器13、触摸驱动器14等的驱动器。在TEE 20中，包括安全应用21和监控器22，其中监控器22中设置寄存器分离配置模块23，在寄存器分离配置模块23中设置非分离配置区24和分离配置区25。CPU通过总线与LCD控制器30以及LCD显示屏40连接。
另外，上述描述中的分离式切换系统是在CPU中实现，即如图5所示寄存器分离配置模块23设置在CPU中，作为一个变形例，可以迁移到具体的外设所属控制器中实现，无需CPU统一控制的同时，更进一步满足具体外设的特有控制需求，例如，可以将寄存器分离配置模块23设置在各个外设的所属的控制器中(未图示)。
上述以显示屏为例讲述本专利的方法，其他的外设，如摄像头、NFC等也可通过该方法实现各自所需的分离延时控制需求接着，对于利用图5所示的分离式切换系统而实现的分离式切换方法进行说明。
图6是表示本发明一实施例的分离式切换方法的流程图。
如图6所示，具备包括下述步骤：
用户打开网银APP(即应用11)，进入交易界面，此时CPU进入SVC模式且LCD显示屏40由REE通过总线控制显示安卓中的交易界面(例如通过调用REE图形库进行显示)，用户输入交易信息(收款人，首款卡号，金额等)；
网银APP通过驱动器112将LCD分离配置申请发送给监控器22的寄存器分离配 置模块23，申请通过后寄存器分离配置模块23将LCD相关的寄存器设置为分离配置状态(目的是为了交易完成后在TUI返回REE后的短暂时间内，LCD仍然由TEE控制保持显示TUI，但除了LCD以外的其它资源和外设都交还给REE，等REE准备好下一个界面资源后再通知Monitor取消其分离配置状态)，其他外设的各寄存器都申请配置为非分离配置状态，申请成功后对应各外设的相关寄存器都被设置为非分离配置状态，然后通知网银APP申请成功；
网银APP将用户输入的交易信息送入驱动器12，驱动器12发送SMC指令和交易信息给TEE中的监控器22，此时CPU进入安全监控器模式，LCD的控制权由REE交给TEE，监控器22启动对应的TA(安全应用)21并送入交易信息，LCD显示屏加载TUI资源(显示交易信息)并要求用户确认信息无误后输入PIN码确认，TA 21验证PIN码的正确性，TA21将验证结果返回给监控器，监控器通过SMC指令将交易结果发给REE的驱动器12(此时因为LCD显示屏相关的寄存器为分离配置状态，仍然由TEE控制，LCD显示屏依旧显示TUI；而其它外设相关寄存器因为是非分离配置状态，都将从被TEE控制变为被REE控制)；
网银APP11根据收到的交易结果准备下一个界面资源(此时LCD显示屏依旧显示TUI，除了LCD以外的所有资源都已经由TEE交给REE)，下一个界面资源准备好了之后，通知驱动器12发送将LCD显示屏切换回REE的命令给寄存器分离配置模块23，寄存器分离配置模块23接收到命令后取消LCD显示屏的寄存器的分离配置状态并将LCD显示屏的控制权交还给REE控制后通知网银APP设置成功；
网银APP11接收到通知后(此时LCD显示屏的控制权已经由TEE交还给了REE)，LCD显示屏加载已经准备好了的界面资源。
图7中表示了利用本发明一实施例的分离式切换方法实现手机转账的用户界面显示示例。根据以上方法，在手机转账的情况下可以做到A界面再跳转到C界面的流畅体验(不会像现有技术中那样从A界面到B界面后先回到A界面再跳至C界面)。
如上所述，根据本发明的基于TEE和REE的分离式切换方法以及基于TEE和REE的分离式切换系统，够解决应用从TEE切换回REE时候，所有外设的控制权都统一交还给REE的问题，应用开发者可以根据需要选择选择哪些外设交还 给REE控制，哪些外设一定时间内依旧由TEE控制，由此，能够丰富了应用场景，优化了用户体验。
本发明还提供一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现上述基于TEE和REE的分离式切换方法。
本发明还提供一种计算机设备，包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现上述的基于TEE和REE的分离式切换方法。
以上例子主要说明了本发明的的分离式切换系统以及的分离式切换方法。尽管只对其中一些本发明的具体实施方式进行了描述，但是本领域普通技术人员应当了解，本发明可以在不偏离其主旨与范围内以许多其他的形式实施。因此，所展示的例子与实施方式被视为示意性的而非限制性的，在不脱离如所附各权利要求所定义的本发明精神及范围的情况下，本发明可能涵盖各种的修改与替换。

Claims (13)

  1. 一种基于TEE和REE的分离式切换系统，包括TEE环境和REE环境，其特征在于，
    在所述REE环境中具备驱动器，
    在所述TEE环境中具备监控器，
    其中，所述驱动器用于发送分离配置申请，
    所述监控器具备寄存器分离配置模块，所述寄存器分离配置模块接受所述分离配置申请并且基于所述分离配置申请有选择性地使得外设对应的寄存器在某个应用从TEE环境返回REE后的规定时间内保持仍被TEE控制。
  2. 如权利要求1所述的基于TEE和REE的分离式切换系统，其特征在于，所述寄存器分离配置模块具备：
    非分离配置区，用于管理非分离配置模式下的外设的对应的寄存器；以及
    分离配置区，用于管理分离配置模式下的外设的对应的寄存器。
  3. 如权利要求2所述的基于TEE和REE的分离式切换系统，其特征在于，
    在所述非分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器由REE进行控制，
    在所述分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器保持分离配置状态不变，即由TEE进行控制。
  4. 如权利要求1所述的基于TEE和REE的分离式切换系统，其特征在于，
    所述驱动器进一步用于发送取消分离配置请求，
    所述寄存器分离配置模块接受所述取消分离配置请求并且基于所述取消分离配置请求使得外设对应的寄存器在某个应用从TEE环境返回REE后由REE控制。
  5. 如权利要求1所述的基于TEE和REE的分离式切换系统，其特征在于，
    所述外设包括：显示器、摄像头、NFC功能。
  6. 如权利要求1～5任意一项所述的基于TEE和REE的分离式切换系统，其特征在于，
    所述寄存器分离配置模块设置在对于各个外设进行统一控制的CPU中。
  7. 如权利要求1～5任意一项所述的基于TEE和REE的分离式切换系统，其特征在于，
    所述寄存器分离配置模块设置在各个外设的所属的控制器中。
  8. 一种基于TEE和REE的分离式切换方法，其特征在于，包括：
    申请步骤，通过驱动器发送分离配置申请；
    配置步骤，按照所述分离配置申请有选择性地使得外设对应的寄存器在某个应用从TEE环境返回REE后的规定时间内保持仍被TEE控制。
  9. 如权利要求8所述的基于TEE和REE的分离式切换方法，其特征在于，
    在所述请求步骤中，通过驱动器发送分离配置请求，根据设定使得某些外设的申请标记为分离配置模式，将其余的外设的申请标记为非分离配置模式。
  10. 如权利要求8所述的基于TEE和REE的分离式切换方法，其特征在于，在所述非分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器由REE进行控制，
    在所述分离配置模式下，当某个应用在从TEE环境返回REE环境时，外设的寄存器保持分离配置状态不变即仍旧由TEE进行控制。
  11. 如权利要求8所述的基于TEE和REE的分离式切换方法，其特征在于，在所述配置步骤之后进一步具备：
    取消步骤，通过驱动器发送取消分离配置请求，基于所述取消分离配置请求使得外设对应的寄存器在某个应用从TEE环境返回REE后由REE控制。
  12. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现权利要求8～11任意一项所述的基于TEE和REE的分离式切换方法。
  13. 一种计算机设备，包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现权利要求8～11任意一项所述的基于TEE和REE的分离式切换方法。
PCT/CN2019/087734 2018-06-19 2019-05-21 基于tee和ree的分离式切换方法及其系统 WO2019242446A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810627707.3 2018-06-19
CN201810627707.3A CN109214215B (zh) 2018-06-19 2018-06-19 基于tee和ree的分离式切换方法及其系统

Publications (1)

Publication Number Publication Date
WO2019242446A1 true WO2019242446A1 (zh) 2019-12-26

Family

ID=64989430

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/087734 WO2019242446A1 (zh) 2018-06-19 2019-05-21 基于tee和ree的分离式切换方法及其系统

Country Status (3)

Country Link
CN (1) CN109214215B (zh)
TW (1) TWI694701B (zh)
WO (1) WO2019242446A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107980134A (zh) * 2017-08-10 2018-05-01 福建联迪商用设备有限公司 智能终端信息安全输入的方法及其系统
CN109214215B (zh) * 2018-06-19 2021-10-26 中国银联股份有限公司 基于tee和ree的分离式切换方法及其系统
CN112307481B (zh) * 2019-07-26 2023-10-10 杭州海康威视数字技术股份有限公司 一种系统可信启动方法、电子设备及计算机可读存储介质
CN113192237B (zh) * 2020-01-10 2023-04-18 阿里巴巴集团控股有限公司 支持tee和ree的物联网设备以及实现tee和ree间通信的方法
CN112101949B (zh) * 2020-09-18 2022-12-16 支付宝(杭州)信息技术有限公司 安全的服务请求处理方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104252388A (zh) * 2013-06-27 2014-12-31 中国银联股份有限公司 移动设备中的非可信环境与可信环境之间的切换
CN105528554A (zh) * 2015-11-30 2016-04-27 华为技术有限公司 用户界面切换方法和终端
WO2016116271A1 (de) * 2015-01-20 2016-07-28 Giesecke & Devrient Gmbh Laufzeitumgebung für mobiles endgerät, die ein bereitstellen eines sicherheits-dienstes ermöglicht
CN109214215A (zh) * 2018-06-19 2019-01-15 中国银联股份有限公司 基于tee和ree的分离式切换方法及其系统

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102281782B1 (ko) * 2014-11-14 2021-07-27 삼성전자주식회사 무선 통신 시스템에서 단말의 어플리케이션을 원격으로 관리하는 방법 및 장치
US9621547B2 (en) * 2014-12-22 2017-04-11 Mcafee, Inc. Trust establishment between a trusted execution environment and peripheral devices
CN105590201B (zh) * 2015-04-23 2019-05-10 中国银联股份有限公司 移动支付装置及移动支付系统
US10891397B2 (en) * 2015-04-30 2021-01-12 Huawei Technologies Co., Ltd. User interface display method for terminal, and terminal
CN104809413A (zh) * 2015-05-13 2015-07-29 上海瓶钵信息科技有限公司 基于TrustZone技术的移动平台可信用户界面框架
CN107077565B (zh) * 2015-11-25 2019-11-26 华为技术有限公司 一种安全指示信息的配置方法及设备
CN105930731B (zh) * 2015-12-21 2018-12-28 中国银联股份有限公司 一种安全应用ta交互的方法及装置
WO2017156784A1 (zh) * 2016-03-18 2017-09-21 华为技术有限公司 一种通知消息处理方法、装置及终端
CN105809036B (zh) * 2016-04-01 2019-05-10 中国银联股份有限公司 一种tee访问控制方法以及实现该方法的移动终端
EP3447992B1 (en) * 2016-11-14 2020-09-23 Huawei Technologies Co., Ltd. Message pushing method and terminal
CN109840436A (zh) * 2017-11-29 2019-06-04 阿里巴巴集团控股有限公司 数据处理方法、可信用户界面资源数据的应用方法及装置
CN112400170A (zh) * 2018-06-24 2021-02-23 海克斯伍安全公司 配置、实施和监控可信执行环境的分离

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104252388A (zh) * 2013-06-27 2014-12-31 中国银联股份有限公司 移动设备中的非可信环境与可信环境之间的切换
WO2016116271A1 (de) * 2015-01-20 2016-07-28 Giesecke & Devrient Gmbh Laufzeitumgebung für mobiles endgerät, die ein bereitstellen eines sicherheits-dienstes ermöglicht
CN105528554A (zh) * 2015-11-30 2016-04-27 华为技术有限公司 用户界面切换方法和终端
CN109214215A (zh) * 2018-06-19 2019-01-15 中国银联股份有限公司 基于tee和ree的分离式切换方法及其系统

Also Published As

Publication number Publication date
TW202002595A (zh) 2020-01-01
CN109214215A (zh) 2019-01-15
CN109214215B (zh) 2021-10-26
TWI694701B (zh) 2020-05-21

Similar Documents

Publication Publication Date Title
WO2019242446A1 (zh) 基于tee和ree的分离式切换方法及其系统
KR102194071B1 (ko) 인가된 로그인을 위한 방법 및 장치
CN109308241B (zh) 监听应用程序启动流程方法、装置、终端设备和存储介质
KR20140061448A (ko) 선언 및 동의에 기초하는 액세스 중개
EP3467667B1 (en) System-on-chip and terminal
US9886595B2 (en) Priority-based application execution method and apparatus of data processing device
EP3014856B1 (en) Coerced encryption on connected devices
US9384041B2 (en) Information processing system for ending a first program when a second program ends
US20170109520A1 (en) Mapping process changes
US10181016B2 (en) Information processing device, information processing method, and program
US20120300247A1 (en) Image processing system including image forming apparatus having touch panel
US20160006742A1 (en) Information processing apparatus and control method thereof
KR101813379B1 (ko) 클라우드 스토리지 단말기 및 클라우드 스토리지 제공 방법
JP2014116008A (ja) データ処理装置において優先順位に基づいてアプリケーションを実行する方法及び装置
JP7315750B2 (ja) サーバシステム、クライアント装置及びプログラム
US9384022B1 (en) Automating display modes of files within a virtual machine
US20220263976A1 (en) Image forming apparatus, information processing method, and recording medium
JP2015011566A (ja) 情報処理装置、情報処理装置の制御方法、及びプログラム
JP2008250382A (ja) コンピュータプログラム、情報処理装置および情報処理方法
CN113485728A (zh) 一种服务器软件升级方法、装置、服务器及存储介质
CN111984340A (zh) 应用程序的启动方法及装置、可读存储介质、电子设备
CN114090132A (zh) 应用程序启动方法、应用程序启动装置和设备
JP2021152936A (ja) コンピュータシステムおよびプログラム
US20170324842A1 (en) Method for remotely controlling server and associated computer program product
KR101579805B1 (ko) 프리젠테이션 공유 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19823622

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19823622

Country of ref document: EP

Kind code of ref document: A1