WO2020024929A1 - 对电子身份证的业务适用范围进行升级的方法和终端设备 - Google Patents

对电子身份证的业务适用范围进行升级的方法和终端设备 Download PDF

Info

Publication number
WO2020024929A1
WO2020024929A1 PCT/CN2019/098318 CN2019098318W WO2020024929A1 WO 2020024929 A1 WO2020024929 A1 WO 2020024929A1 CN 2019098318 W CN2019098318 W CN 2019098318W WO 2020024929 A1 WO2020024929 A1 WO 2020024929A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
information
electronic
authentication server
terminal device
Prior art date
Application number
PCT/CN2019/098318
Other languages
English (en)
French (fr)
Inventor
赵晓娜
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19844644.5A priority Critical patent/EP3817322A4/en
Publication of WO2020024929A1 publication Critical patent/WO2020024929A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G06F21/645—Protecting data integrity, e.g. using checksums, certificates or signatures using a third party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of terminal equipment, and more particularly, to a method and terminal device for upgrading the scope of application of an electronic ID card, and a method and terminal device for applying for an electronic ID card.
  • CID Citizen Trusted Identity
  • the Citizen Trusted Identity (CTID) platform built by the First Research Institute of the Ministry of Public Security launched an online copy issuing system for ID cards. Based on the ID copy online issuance system, a unique ID copy can be generated online for each user, which can also be called electronic ID.
  • the electronic ID does not contain any private information, and is the only counterpart to the physical ID.
  • the Ministry of Public Security has also established a multi-factor and multi-authentication mode trusted identity authentication system, which is convenient for business platforms (such as e-commerce, financial, e-government service providers) to use the user's electronic ID to combine face images , Fingerprints and other information to complete the user's "real name + real person + evidence" real identity authentication.
  • business platforms such as e-commerce, financial, e-government service providers
  • users can use electronic ID cards for identity verification in business scenarios such as hotel check-in and ticket purchase.
  • the present application provides a method and terminal device for upgrading the service scope of an electronic ID card, and a method and terminal device for applying for an electronic ID card. Upgrade the business scope of the electronic ID card, or directly apply for an electronic ID card with a larger business scope for the user.
  • a method for upgrading the service scope of an electronic ID card includes: a terminal device receiving a trigger instruction, the trigger instruction being used to request an upgrade of the service scope of a user's electronic ID card; a terminal; The device determines that the terminal device provides a trusted security platform, and determines that the trusted security platform holds the certification information of the identity authentication server; the terminal device obtains the authority from the identity authentication server to upgrade the service scope of the electronic ID card based on the trusted security platform. ; The terminal device generates the upgrade information required to upgrade the business scope of the electronic ID card, and sends the upgrade information to the identity authentication server, so that the identity authentication server upgrades the business scope of the electronic ID card according to the upgrade information.
  • the terminal device obtains the authority to upgrade the service scope of the user's electronic ID based on the trusted security platform provided by the terminal device by applying from the identity authentication server, so that the user's The business scope of electronic ID cards will be upgraded.
  • the cost of specially deploying a trusted acceptance terminal in order to upgrade the business scope of the user's electronic ID card can be avoided, and the promotion of the electronic ID card can be reduced.
  • users no longer need to go to trusted acceptance terminals deployed at fixed outlets to upgrade the scope of business application of electronic ID cards, but instead complete the scope of business application of their electronic ID cards by operating terminal devices (such as mobile phones). Upgrades can be convenient for users.
  • the method before the terminal device determines that the trusted security platform stores the certification information of the identity authentication server, the method further includes: the terminal device determines that an electronic ID exists in the trusted security platform Application; or when the terminal device determines that there is no electronic ID application in the trusted security platform, download and install the electronic ID application to the trusted security platform.
  • the trusted security platform is a trusted execution environment TEE
  • the electronic ID application is a trusted application TA in the TEE
  • the trusted security platform is a security unit SE
  • the electronic ID application is a security application in SE.
  • the upgrade information includes user's face image information and physical ID information
  • the terminal device generates the upgrade information required to upgrade the business scope of the electronic ID card
  • sending the upgrade information to the identity authentication server includes: the terminal device generates the upgrade information through the client application CA in the REE, and sends the upgrade information to the identity authentication server through the CA, wherein at least one piece of information in the upgrade information is Obtained by the CA from the electronic ID application; or, the terminal device requests the electronic ID application to generate upgrade information through the CA, and the electronic ID application sends the upgrade information to the identity authentication server.
  • the upgrade information further includes signature information.
  • the signature information is a combination of the face image information and the physical identity information of the electronic ID application using the key of the trusted security platform. At least one item of information obtained by signing.
  • the upgrade information further includes electronic ID information, or the upgrade information further includes identification information of a service application scope corresponding to the electronic ID information and the electronic ID information.
  • the upgrade information is information that is encrypted by using a key of the identity authentication server.
  • the terminal device determines that the trusted security platform stores the certification information of the identity authentication server, including: the terminal device sends a query command to the trusted security platform through the CA in the REE, The query command is used to request whether the trusted security platform holds the certification information of the identity authentication server.
  • the query command carries information that can identify the identity of the identity authentication server.
  • the terminal device receives the query success response from the trusted security platform through the CA, and the query is successful. The response is used to indicate that the trusted security platform stores the authentication information of the authentication server.
  • the query success response carries information capable of indicating the certificate of the trusted security platform
  • the terminal device obtains an electronic ID from the identity authentication server based on the trusted security platform.
  • the right to upgrade the applicable scope of services includes: the terminal device sends a local upgrade authorization request to the identity authentication server, and the local upgrade authorization request carries information indicating the certificate of the trusted security platform; the terminal device receives the authorization response returned by the identity authentication server Message, authorization response message is used to instruct the identity authentication server to allow the business scope of the electronic ID card to be upgraded based on the trusted security platform.
  • the terminal device sending a local upgrade authorization request to the identity authentication server includes: the terminal device sends a local upgrade authorization request to the identity authentication server through a CA; and the terminal device receives the identity
  • the authorization response message returned by the authentication server includes: the terminal device receives the authorization response message returned by the identity authentication server through the CA; or, the terminal device sends a local upgrade authorization request to the identity authentication server, including: the terminal device uses the electronic ID application to authenticate to the identity
  • the server sends a local upgrade authorization request; and the terminal device receives the authorization response message returned by the identity authentication server, including: the terminal device receives the authorization response message from the identity authentication server through the electronic ID application.
  • the local upgrade authorization request also carries a random number and a signature of the random number, and the signature of the random number is randomly generated by the trusted security platform using the key pair of the trusted security platform.
  • the number is obtained by performing a signature operation, where the random number is generated by the trusted security platform or sent by the CA to the trusted security platform through a query command.
  • At least one of the information indicating the certificate of the trusted security platform, a random number, and a signature of the random number is encrypted using a key of an identity authentication server Processed information.
  • a terminal device receives a trigger instruction, which is used to request an application for an electronic ID card with a target service scope for a user, wherein the service scope is used to specify an electronic ID card.
  • Applicable services the terminal device determines that the terminal device provides a trusted security platform, and determines that the trusted security platform holds certification information of the identity authentication server; the terminal device obtains from the identity authentication server based on the trusted security platform to apply for the target business for the user Applicable scope of electronic ID; the terminal device generates application information required to apply for an electronic ID with a target business scope, and sends the application information to the identity authentication server, so that the identity authentication server provides the user with the information according to the application information. Generate an electronic ID with the scope of the target business.
  • the terminal device applies for an authorization from the identity authentication server based on the trusted security platform provided by the terminal device to apply for the electronic identity card with the target business application scope for the user, and then can apply for the user based on the trusted security platform Electronic ID with target business scope.
  • users using terminal equipment with a trusted security platform can directly apply for an electronic ID card with a larger scope of business application, which brings convenience to users.
  • the method before the terminal device determines that the trusted security platform stores the certification information of the identity authentication server, the method further includes: the terminal device determines that an electronic device exists in the trusted security platform. ID card application; or when the terminal device determines that there is no electronic ID card application in the trusted security platform, download and install the electronic ID card application into the trusted security platform.
  • the trusted security platform is a trusted execution environment TEE
  • the electronic ID application is a trusted application TA in the TEE
  • the trusted security platform is secure Unit SE
  • electronic ID application is a security application in SE.
  • the application information includes user's face image information and physical ID information
  • the terminal device generates application information required to apply for an electronic ID with a target service scope.
  • sending the application information to the identity authentication server including: the terminal device generates the application information through the client application CA in the REE, and sends the application information to the identity authentication server through the CA, wherein at least one piece of information in the application information is the CA slave Obtained by the electronic ID application; or, the terminal device requests the electronic ID application to generate application information through the CA, and the electronic ID application sends the application information to the identity authentication server.
  • the application information further includes signature information
  • the signature information is a combination of facial image information and physical identity information in an electronic ID application using a key of a trusted security platform. At least one item of information obtained by signing.
  • the application information further includes identification information of a target service application range.
  • the application information is information that is encrypted by using a key of the identity authentication server.
  • the terminal device determines that the trusted security platform stores the certification information of the identity authentication server, including: the terminal device sends a query command to the trusted security platform through the CA in the REE, The query command is used to request whether the trusted security platform holds the certification information of the identity authentication server.
  • the query command carries information that can identify the identity of the identity authentication server.
  • the terminal device receives the query success response from the trusted security platform through the CA, and the query is successful. The response is used to indicate that the trusted security platform stores the authentication information of the authentication server.
  • the query success response also carries information capable of indicating the certificate of the trusted security platform, and the terminal device obtains the trusted security platform based on the trusted security platform for the user from the identity authentication server.
  • Applying for the authority of the electronic identity card with the target service includes: the terminal device sends a local application authorization request to the identity authentication server, and the local application authorization request carries information that can indicate the certificate of a trusted security platform; the terminal device receives the information returned by the identity authentication server Authorization response message.
  • the authorization response message is used to instruct the identity authentication server to allow the user to apply for an electronic ID card with a target service scope based on a trusted security platform.
  • the terminal device sends a local application authorization request to the identity authentication server, including: the terminal device sends a local application authorization request to the identity authentication server through a CA; and the terminal device receives the identity
  • the authorization response message returned by the authentication server includes: the terminal device receives the authorization response message returned by the identity authentication server through the CA; or, the terminal device sends a local application authorization request to the identity authentication server, including: the terminal device uses the electronic ID application to authenticate to the identity
  • the server sends a local application for authorization request; and the terminal device receives the authorization response message returned by the identity authentication server, including: the terminal device receives the authorization response message from the identity authentication server through the electronic ID application.
  • the local application authorization request also carries a random number and a signature of the random number, and the signature of the random number is randomized by the trusted security platform using the key pair of the trusted security platform.
  • the number is obtained by performing a signature operation, where the random number is generated by the trusted security platform or sent by the CA to the trusted security platform through a query command.
  • At least one of the information indicating the certificate of the trusted security platform, the random number, and the signature of the random number is encrypted using a key of an identity authentication server Processed information.
  • the method further includes: the terminal device determines that the user has not opened the electronic ID card.
  • the present application provides a device for upgrading the service scope of an electronic ID card, which has the function of a terminal device in the method for implementing the first aspect or any possible implementation manner of the first aspect.
  • These functions can be implemented by hardware, or they can also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to these functions.
  • the device for upgrading the service scope of the electronic ID card described in the third aspect may be a terminal device, or may be a chip configured in the terminal device.
  • the present application provides a device for applying for an electronic identity card, which has the function of a terminal device in the method for implementing the second aspect or any possible implementation manner of the second aspect.
  • These functions can be implemented by hardware, or they can also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to these functions.
  • the device for applying for an electronic identification card according to the fourth aspect may be a terminal device, or may also be a chip configured in the terminal device.
  • the present application provides a terminal device, including: an input-output device for receiving a trigger instruction, the trigger instruction is used to request an upgrade of a service scope of a user's electronic ID card; and a processor is used for input and output.
  • the device receives the trigger instruction, it is determined that the terminal device provides a trusted security platform, and it is determined that the trusted security platform stores certification information of the identity authentication server; and the processor is further configured to store the identity authentication on the determined trusted security platform.
  • the server's certification information it obtains the authorization from the identity authentication server to upgrade the business scope of the electronic ID card based on the trusted security platform; the processor is also used to generate the upgrade of the business scope of the electronic ID card.
  • the transceiver is used to send the upgrade information generated by the processor to the identity authentication server, so that the identity authentication server can upgrade the service scope of the electronic ID card according to the upgrade information.
  • the processor is further configured to determine that an electronic ID application exists in the trusted security platform before determining that the trusted security platform stores the certification information of the identity authentication server; or When the processor determines that there is no electronic ID application in the trusted security platform, the processor is also used to download and install the electronic ID application to the trusted security platform.
  • the trusted security platform is a trusted execution environment TEE
  • the electronic ID application is a trusted application TA in the TEE
  • the trusted security platform is a security unit SE
  • the electronic ID application is a security application in SE.
  • the upgrade information includes user's face image information and physical identity information
  • the processor is configured to generate the upgrade information through the client application CA in the REE; Sending the upgrade information generated by the CA to the identity authentication server, at least one of the upgrade information is obtained by the CA from the electronic ID application; or, the processor is configured to request the electronic ID application to generate the upgrade information through the CA;
  • the device is used to send the upgrade information generated by the electronic ID application to the identity authentication server.
  • the upgrade information further includes signature information
  • the signature information is a combination of the face image information and the physical identity information of the electronic ID application using the key of the trusted security platform. At least one item of information obtained by signing.
  • the upgrade information further includes electronic ID information, or the upgrade information further includes identification information of a service application scope corresponding to the electronic ID information and the electronic ID information.
  • the upgrade information is information that is encrypted by using a key of the identity authentication server.
  • the processor is configured to send a query command to the trusted security platform through the CA in the REE, and the query command is used to request whether the trusted security platform has an identity authentication server.
  • Proof information the query command carries information capable of characterizing the identity of the authentication server; the processor is also used to receive a successful query response from the trusted security platform through the CA, and the successful query response is used to indicate that the trusted security platform stores the authentication server Proof information.
  • the query success response carries information capable of indicating the certificate of the trusted security platform
  • the transceiver is configured to send a local upgrade authorization request to the identity authentication server.
  • the upgrade authorization request carries information that can indicate the certificate of the trusted security platform; the transceiver is also used to receive the authorization response message returned by the identity authentication server, and the authorization response message is used to instruct the identity authentication server to allow the electronic identity based on the trusted security platform Upgrade the scope of application of the certificate.
  • the transceiver sends a local upgrade authorization request to the identity authentication server through the CA, and receives the authorization response message returned by the identity authentication server through the CA; or, the transceiver uses electronic identity
  • the identity application sends a local upgrade authorization request to the identity authentication server, and receives an authorization response message from the identity authentication server through the electronic identity application.
  • the local upgrade authorization request also carries a random number and a signature of the random number, and the signature of the random number is randomized by the trusted security platform using the key pair of the trusted security platform.
  • the number is obtained by performing a signature operation, where the random number is generated by the trusted security platform or sent by the CA to the trusted security platform through a query command.
  • At least one of the information that can indicate the certificate of the trusted security platform, the random number, and the signature of the random number is encryption processing using the key of the identity authentication server Post information.
  • the terminal device provided in this application includes a memory, a processor, and an input-output device.
  • the input-output device is used to detect a user operation to receive a trigger instruction.
  • the memory is used to store a computer program.
  • the processor is used to call and run the computer program from the memory.
  • the present application provides a terminal device, including: an input-output device for receiving a trigger instruction, the trigger instruction is used to request an electronic ID card with a target service scope for a user, wherein the service scope is used to specify Electronic ID card applicable services; processor, used to determine that the terminal device provides a trusted security platform when the input and output device receives the trigger instruction, and determines that the trusted security platform holds the certification information of the identity authentication server; the processor , And is also used to obtain the authorization from the identity authentication server to the user based on the trusted security platform to apply for the electronic identity card with the target business scope; the processor is also used to generate the application required to apply for the electronic identity card with the target business scope Information; the transceiver is further configured to send application information to the identity authentication server, so that the identity authentication server generates an electronic ID card with a target service scope for the user according to the application information.
  • the processor is further configured to determine that an electronic ID application exists in the trusted security platform before determining that the trusted security platform stores the certification information of the identity authentication server; or The processor is also used to download and install the electronic ID application to the trusted security platform in the case where it is determined that the electronic ID application does not exist in the trusted security platform.
  • the trusted security platform is a trusted execution environment TEE
  • the electronic ID application is a trusted application TA in the TEE
  • the trusted security platform is a security unit SE
  • the electronic ID application is a security application in SE.
  • the application information includes user's face image information and physical identity information
  • the processor is configured to generate the application information by using a client application CA in a rich execution environment REE
  • the transceiver is used to send the application information generated by the CA to the identity authentication server, and at least one piece of information in the application information is obtained by the CA from the electronic ID application; or, the processor is used to request the electronic ID application to generate the application information through the CA;
  • the transceiver is used to send the application information generated by the electronic ID application to the identity authentication server.
  • the application information further includes signature information.
  • the signature information is a combination of facial image information and physical identity information in an electronic ID application using a trusted security platform key. At least one item of information obtained by signing.
  • the application information further includes identification information of a target service application range.
  • the application information is information that is encrypted by using a key of the identity authentication server.
  • the processor is configured to send a query command to the trusted security platform through the CA in the REE, and the query command is used to request whether the trusted security platform has an identity authentication server.
  • Proof information the query command carries information capable of characterizing the identity of the authentication server; the processor is also used to receive a successful query response from the trusted security platform through the CA, and the successful query response is used to indicate that the trusted security platform stores the authentication server Proof information.
  • the query success response carries information capable of indicating a certificate of a trusted security platform
  • the transceiver is configured to send a local application authorization request to the identity authentication server. Carrying information capable of indicating the certificate of the trusted security platform; and, the transceiver is further configured to receive an authorization response message returned by the identity authentication server, where the authorization response message is used to instruct the identity authentication server to allow the user to apply for Electronic ID for the target business.
  • the transceiver is configured to send a local application authorization request to the identity authentication server through the CA, and receive the authorization response message returned by the identity authentication server through the CA; or the transceiver is configured to pass
  • the electronic ID application sends a local application authorization request to the identity authentication server, and receives an authorization response message from the identity authentication server through the electronic identity application.
  • the local application authorization request also carries a random number and a signature of the random number, and the signature of the random number is randomly generated by the trusted security platform using the key pair of the trusted security platform.
  • the number is obtained by performing a signature operation, where the random number is generated by the trusted security platform or sent by the CA to the trusted security platform through a query command.
  • At least one of the information indicating the certificate of the trusted security platform, a random number, and a signature of the random number is encrypted using a key of an identity authentication server Processed information.
  • the terminal device provided in this application includes a memory, a processor, and an input-output device.
  • the input-output device is used to detect a user operation to receive a trigger instruction.
  • the memory is used to store a computer program.
  • the processor is used to call and run the computer program from the memory.
  • the terminal device may further include a transceiver for implementing interaction between the terminal device and the identity authentication server and the credential package application server.
  • the input-output device may be one or more sensors.
  • different sensors can be used to detect different user operations, or multiple different sensors can also be used to detect the same user operation.
  • the memory in the above terminal device may be one or more, and the processor may also be one or more.
  • the present application provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program runs on the computer, the computer executes the first aspect or any of the first aspect.
  • the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program.
  • the computer program runs on the computer, the computer causes the computer to execute the second aspect or any of the second aspect.
  • the present application provides a chip including a memory and a processor.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the terminal device installed with the chip executes the first aspect. And any possible implementation of its first aspect.
  • the present application provides a chip including a memory and a processor.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the terminal device installed with the chip executes the second aspect. And any possible implementation of its second aspect.
  • the memory may be one or more.
  • the processor may be one or more.
  • the foregoing memory and the memory may be physically independent units, or the memory may be integrated with the processor.
  • the present application provides a computer program product.
  • the computer program product includes a computer program.
  • the computer program runs on a computer, the computer causes the computer to execute the first aspect and any one of the possible implementation manners. method.
  • the present application provides a computer program product.
  • the computer program product includes a computer program that, when the computer program runs on a computer, causes the computer to execute the second aspect and any possible implementation of the second aspect. Way in the way.
  • the above computer program may be stored in whole or in part on a storage medium packaged with the processor, or may be partially or fully stored in a memory not packaged with the processor.
  • the terminal device upgrades the application scope of the user's electronic ID based on the trusted security platform provided by the terminal device by applying from the identity authentication server or applies the target business application for the user based on the trusted security platform.
  • the scope of the electronic ID card's authority so that the business scope of the user's electronic ID card can be upgraded based on the trusted security platform, or the user can directly apply for an electronic ID card with a larger business scope.
  • the cost of specially deploying a trusted acceptance terminal in order to upgrade the business scope of the user's electronic ID can be eliminated.
  • FIG. 1 is a flowchart of a method for upgrading an application scope of an electronic ID card provided by the present application.
  • FIG. 2 is a schematic diagram of upgrading a service scope of an electronic ID card based on a trusted security platform on a terminal device.
  • FIG. 3 is a schematic diagram of a user interface UI for performing management operations on an electronic ID card.
  • FIG. 4 is a schematic diagram of implementing a prompt box on a user interface UI.
  • FIG. 5 is another schematic diagram of a user interface UI for performing management operations on an electronic ID card.
  • FIG. 6 is a schematic diagram of a terminal device inquiring whether a trusted security platform has certification information of an identity authentication server.
  • FIG. 7 is a schematic diagram of a terminal device applying to an identity authentication server for a right to upgrade an application scope of an electronic ID card based on a trusted security platform.
  • FIG. 8 is a schematic diagram of a terminal device generating upgrade information and sending the upgrade information to an identity authentication server.
  • FIG. 9 is another schematic diagram of a user interface UI for performing management operations on an electronic ID card.
  • FIG. 10 is a flowchart of a method for applying for an electronic ID filed in the present application.
  • FIG. 11 is a schematic diagram of a terminal device applying for an electronic ID based on a trusted security platform proposed in the present application.
  • FIG. 12 is a schematic block diagram of an apparatus 700 for upgrading an application scope of an electronic ID card provided by the present application.
  • FIG. 13 is a schematic block diagram of an apparatus 800 for applying for an electronic ID filed in the present application.
  • FIG. 14 is a schematic structural diagram of a terminal device 900 applicable to an embodiment of the present application.
  • the technical solution of this application is applicable to a scenario where the service scope of the user's electronic ID card is upgraded, or it can also be applicable to a scenario where a user without an electronic ID card directly applies for an electronic ID card with a larger service scope.
  • the scope of business application refers to the scope of business that the electronic ID card can apply.
  • the applicable business of electronic ID card may include hotel check-in, ticket purchase, real-name registration of social software, securities account opening, government affairs processing, industrial and commercial registration, etc. If the more services an electronic ID can apply, it means that the scope of business of this electronic ID is wider. On the contrary, it indicates that the scope of business of this electronic ID is smaller.
  • the scope of business application can be graded. For example, it can be divided into two levels: the basic version and the enhanced version. Such services as hotel check-in, ticket purchase, and real name of Internet cafes are included in the scope of the basic version , Including such services as government affairs administration, industrial and commercial registration, remote account opening, etc. into the scope of the enhanced version.
  • the service scope is divided into three levels of low, medium, and high, or multiple levels such as a first level, a second level, a third level, and so on. The level mentioned here can be understood as the service scope corresponding to the high level covers the service scope corresponding to the low level.
  • this application can also include other ways to divide the scope of business, such as grading according to the type of business, consider the payment, registration, and other services related to basic needs such as clothing, food, clothing, clothing, clothing, clothing, clothing, and transportation as class I, and consider the authentication services related to dating and entertainment needs It is a type II, and the certification business involved in government affairs, industry and commerce needs is considered as a type III.
  • the user can apply to the identity authentication server according to these categories. For example, when the application is opened, it is clear that the scope of business includes Class I and Class II, Or, when requesting an upgrade, it is clear that the new service use scope includes category III and so on.
  • electronic ID cards can only be used for relatively simple services such as hotel check-in and ticket purchase. If users want to use electronic ID cards for government affairs and ICBC registration, they need to go to a trusted reception terminal deployed by the Ministry of Public Security at a fixed network. The cost of deploying a trusted acceptance terminal is relatively high and inconvenient for users.
  • this application proposes a method for upgrading the scope of business application of an electronic ID card, and a method for directly applying for an electronic ID card with a larger scope of business application for a user.
  • This method can avoid the cost of deploying a trusted acceptance terminal, and can complete the upgrade of the service scope of the user's electronic ID card through a trusted security platform provided locally by the terminal device, or directly for users without an electronic ID card. It is convenient for users to apply for an electronic ID card with a larger scope of business application.
  • the terminal device involved in this application may be any mobile or portable electronic device, including but not limited to a mobile phone, a mobile computer, a tablet computer, a personal digital assistant (PDA), a wearable device (wearable device), or Any two or more of the above.
  • PDA personal digital assistant
  • wearable device wearable device
  • the trusted security platform may be a trusted execution environment (TEE) or a secure element (SE) on the terminal device.
  • the physical carrier of the SE may be an embedded security unit (SE), a secure digital memory card (SD card), a universal integrated circuit card (UICC), and the like.
  • SE trusted execution environment
  • SE secure element
  • SD card secure digital memory card
  • UICC universal integrated circuit card
  • the trusted security platform mentioned here can be considered as a part of the terminal device, or it can be considered as an independent module outside the terminal device. For example, it can be a hardware part that is removed or pluggable from the terminal device.
  • TEE is relatively rich execution environment (REE).
  • REE is an open environment created on the terminal device for versatility and richness. It runs the operating system of the terminal device (for example, Android OS, IOS) and can be downloaded to third parties after the device is manufactured.
  • TEE is a concept proposed by the Global Platform (GP) organization for the REE of intelligent mobile terminals. It is a running environment that coexists with REE but is isolated from each other. Trusted operating systems (Trusted OS) running in TEE can provide security services for operating systems (ie, Rich OS) running in REE.
  • Trusted OS Trusted operating systems
  • Rich OS Rich OS
  • a combination of hardware and software can be used to ensure the secure transmission, storage, and processing of various sensitive data in the TEE, to ensure the confidentiality, integrity and data access authority end-to-end security of TA execution. Because TEE has its own execution space, its security level is higher than Rich OS. The above SE is more secure than TEE.
  • TEE runs a series of trusted applications (TAs). Because TEE can provide security services for these TAs, such as application execution integrity, secure storage, secure interaction with input and output devices, and key management. , Encryption algorithms, and secure communication with client applications (CAs) in REE, etc. Therefore, TA is different from CA in REE, TA is a trusted application, and CA is a common application or a general application. In addition, the TA runs in the TEE and can provide security-related services to the CA in the REE or other TAs in the TEE. The CA runs in the REE, and can call or access the TA in the TEE through the client application access interface (API) of the TEE, that is, the interface through which the REE accesses the TEE.
  • API client application access interface
  • scenario 1 the scenarios for upgrading the application scope of the electronic ID card (hereinafter referred to as scenario 1) and the scenario of directly applying for an electronic identity card with a larger service scope for the user (hereinafter referred to as scenario 2) are described in detail.
  • a certificate package application may be an application on the REE side of a terminal device (for example, a mobile phone), such as applications such as Alipay, WeChat, and Huawei Wallet, and may be used to accommodate and manage electronic ID applications.
  • the electronic ID application may be an application on the trusted execution environment TEE or security unit SE side of the terminal device.
  • the client application CA is an application that corresponds to the electronic ID application on the REE side and can interact with the electronic ID application on the TTE or SE side.
  • the client application CA can communicate through the TEE client application program access interface (API), that is, the TEE Client API.
  • SE API SE access interface
  • SE API SE access interface
  • the credential package application can use the client application CA to implement management of the electronic ID application (for example, activation / application, upgrade, cancellation / deletion, etc.).
  • client application CA on the REE side and the electronic ID application on the TEE / SE side can be provided by the electronic ID service provider.
  • the embodiments of the present application may also involve a credential package application server (denoted as S1), a trusted security platform server (denoted as S2), and an identity authentication server (denoted as S3).
  • S1 is a party that issues a certificate (for example, a public key certificate of a trusted security platform, etc.), and can also download an electronic ID application to the trusted security platform through S2 for an electronic ID service provider. Data related to electronic ID applications.
  • FIG. 1 is a flowchart of a method for upgrading an application scope of an electronic ID card provided by the present application.
  • the premise of the technical solution shown in FIG. 1 may be that the trusted security platform (or the trusted security platform server) on the terminal device and the identity authentication server preset each other's certification information (for example, a certificate), for example, identity
  • the authentication server stores the certificate information of the trusted security platform in advance
  • the trusted security platform (which may be an electronic ID application) stores the certificate information of the identity authentication server in advance.
  • the trusted security platform may also pre-store the certificate information of the trusted security platform server.
  • the technical solution of the present application may also be based on the premise that the trusted security platform stores the credential package application in advance.
  • the credential application server stores the credential security platform certificate information
  • the credential information of the identity authentication server stores the credential application server certificate in advance
  • Information, certificate information of the trusted security platform (optional).
  • each subject may also pre-store a root certificate of a certification authority (CA).
  • CA certification authority
  • the above-mentioned certificate information may be a public key certificate (a certificate issued by a certification center).
  • the terminal device receives a trigger instruction.
  • the trigger instruction is used to request an upgrade of the service scope of the user's electronic ID card.
  • the scope of business of an electronic ID card is used to designate the applicable services of the electronic ID card.
  • the services described in this application can include services that can be processed using electronic ID cards, such as hotel stays, ticket purchases, socializing among users, Internet cafe registration, government affairs processing, securities account opening, and business registration.
  • electronic ID cards such as hotel stays, ticket purchases, socializing among users, Internet cafe registration, government affairs processing, securities account opening, and business registration.
  • different business scopes of electronic ID cards can handle different businesses. For example, if an electronic ID card applied by a user can only handle hotel check-in, ticket purchase, social networking between users, and Internet cafe registration for some basic services, the scope of application of this electronic ID card is relatively small. If this electronic ID card can handle not only these basic services, but also government affairs, securities account opening, and industrial and commercial registration, then the scope of application of this electronic ID card is relatively large.
  • the business scope of electronic ID cards may continue to expand. Therefore, the business scope of the user's electronic ID may also need to be upgraded to apply for a larger business scope.
  • the trigger instruction may be input by a user through a touch screen, a voice, or the like of the terminal device.
  • a credential package application or a client application CA provides a user with an entrance that can trigger an upgrade of an opened electronic ID card through a user interface (UI), which can be implemented in the form of a button or the like.
  • UI user interface
  • the UI provided by the electronic ID application in the trusted security platform can also be used to provide the user with an entry for the upgrade operation.
  • the terminal device determines that the terminal device provides a trusted security platform, and determines that the trusted security platform stores certification information of the identity authentication server.
  • the certification information of the identity authentication server is used to indicate the trusted identity of the identity authentication server.
  • the certification information may be a certificate of the identity authentication server.
  • the trusted security platform involved in this application may be TEE or SE. Therefore, in step 120, based on the trigger instruction, the terminal device determines whether a TEE or SE exists locally in the terminal device. If the terminal device determines that TEE and / or SE exist locally, the terminal device further determines whether an electronic ID application exists in the TEE or SE. If the trusted security platform is TEE, the electronic ID application here refers to the TA running in TEE. If the trusted security platform is SE, the electronic ID application here refers to a security application applet running in the SE.
  • the terminal device may first detect whether the terminal device provides TEE according to a preset procedure, and in the case where the terminal device provides TEE, it does not continue to detect whether to provide SE. Only if the terminal equipment does not provide TEE, it is further judged whether the terminal equipment provides SE. Alternatively, the terminal device may judge whether the terminal device provides the SE first by default, and then judge whether to provide the TEE if the SE is not provided.
  • the terminal device in a case where the terminal device provides a trusted security platform (that is, TEE or SE) locally or an electronic ID application exists in the trusted security platform, the terminal device needs to determine whether the trusted security platform holds an identity authentication server. Proof information.
  • a trusted security platform that is, TEE or SE
  • the terminal device needs to determine whether the trusted security platform holds an identity authentication server. Proof information.
  • the CA running in the REE on the terminal device sends a query command to the electronic ID application (specifically TA) running in the TEE.
  • the query command is used to query the electronic identity Whether the authentication application holds the authentication information of the identity authentication server.
  • the electronic ID application determines that the authentication information of the identity authentication server is stored, it returns a query success result to the CA.
  • the query success result is used to indicate that the trusted security platform stores the authentication information of the identity authentication server.
  • the terminal device also determines that the authentication information of the identity authentication server is stored on the trusted security platform.
  • the trusted security platform provided by the terminal device is SE, it is similar to the trusted security platform TTE.
  • the CA sends a query command to the security program applet in the SE.
  • the applet returns a query success response to the CA when the certification information of the authentication server is stored. In this way, the terminal device can also determine that the trusted security platform stores the certification information of the identity authentication server.
  • the terminal device obtains the authority to upgrade the service scope of the electronic ID card based on the trusted security platform from the identity authentication server.
  • the terminal device determines that the trusted security platform has the certification information of the identity authentication server, it applies to the identity authentication server for the authority to upgrade the service scope of the electronic ID card based on the trusted security platform. After obtaining the permission of the identity authentication server, the terminal device has obtained the authority to upgrade the service scope of the user's electronic ID based on the local trusted security platform.
  • the terminal device applies to the identity authentication server for the authority to upgrade the service scope of the electronic ID card based on the trusted security platform, and there are multiple feasible solutions.
  • the CA running in the REE on the terminal device receives a query success response from the electronic ID application, and the query success response carries information capable of indicating the certificate of the trusted security platform.
  • the CA After receiving the successful response to the query, the CA sends a local upgrade authorization request to the identity authentication server.
  • the local upgrade authorization request is used to request the application scope of the electronic ID card to be upgraded based on the trusted security platform provided by the terminal device.
  • the local upgrade authorization request The certificate information that can indicate the trusted security platform is carried so that the identity authentication server verifies the trusted security platform.
  • the identity authentication server will agree to upgrade the scope of application of the electronic ID card based on the trusted security platform provided by the terminal device.
  • a local upgrade authorization request may also be sent to the identity authentication server through an electronic ID application running in the TEE on the terminal device, so as to request permission to upgrade the business scope of the electronic ID based on the trusted security platform.
  • the terminal device may apply to the identity authentication server through the credential package application server for the authority to upgrade the application scope of the electronic ID card based on the trusted security platform.
  • the terminal device may apply to the identity authentication server through the credential package application server for the authority to upgrade the application scope of the electronic ID card based on the trusted security platform.
  • the terminal device sends the upgrade information required for upgrading the service scope of the user's electronic ID to the identity authentication server, so that the identity authentication server can upgrade the scope of the user's electronic ID according to the upgrade information.
  • the upgrade information is used by the identity authentication server to upgrade the service scope of the user's electronic ID.
  • the upgrade information includes at least the user's face image information and physical identity information. The process of upgrading the user's electronic ID based on the upgrade information by the identity authentication server will be described in detail below.
  • the terminal device is based on the trusted security platform provided on the terminal device, such as TEE or SE, to upgrade the service scope of the electronic ID card, without the need to rely on the trusted acceptance of the fixed network deployment.
  • the terminal can avoid the cost of deploying a trusted acceptance terminal, and at the same time, it can also bring convenience to users.
  • Figure 1 illustrates the process of upgrading the scope of application of an electronic identity card based on a trusted security platform from the perspective of a terminal device.
  • Figure 2 illustrates the perspective of the internal implementation of the terminal device.
  • FIG. 2 is a flowchart of upgrading a service scope of an electronic ID card based on a trusted security platform on a terminal device according to the present application.
  • a terminal device receives a trigger instruction through a client application CA in the REE, and the trigger instruction is used to request an upgrade of a service scope of a user's electronic ID.
  • the terminal device receives the trigger instruction based on the CA in the REE, that is, the CA receives the trigger instruction.
  • FIG. 3 is a schematic diagram of a user interface UI for performing management operations on an electronic ID card.
  • the terminal device starts the CA by detecting the user's "click”, "touch” and other operations, and enters the management interface of the electronic ID card. After entering the management interface, the management interface can prompt the user to select the services that need to be handled.
  • the services provided by CA include two services: upgrading the scope of application of electronic ID cards and applying for electronic ID cards. For users who have applied for an electronic ID card, if they need to upgrade the business scope of the electronic ID card, they can choose the "upgrade business scope" business. If the user has not applied for an electronic ID card and wants to apply for an electronic ID card, he can select "Apply for an electronic ID card". The former applies to scenario one, and the latter applies to scenario two.
  • the management interface presents a prompt interface, and the prompt interface is used to prompt the user to select the required service scope.
  • the CA or electronic ID application can also present the user with one of the above-mentioned entrances according to the actual situation. For example, if the user has not yet activated the electronic ID function, after the user opens the credential package application or CA, the user is presented with the function button of "Apply for an electronic ID" described above.
  • the user will be presented with the above "upgraded business scope" Function buttons.
  • the application scope of the electronic ID card is divided into three categories in advance, namely, the business scope A, the business scope B, and the business scope C.
  • the user can view the services included in the scope of application of each service by clicking the "view" button. For example, if the user chooses to view the service scope B, a prompt box as shown in FIG. 4 may pop up on the management interface provided by the CA, and FIG. 4 is a schematic diagram of implementing the prompt box on the user interface UI.
  • the text information in the prompt box is used to describe the services that can be handled by the electronic ID card with business scope B.
  • the terminal device detects the user's click operation, and triggers the upgrade process of the business scope of the electronic ID card.
  • the trigger instruction in the embodiment of the present application may be triggered by the terminal device by detecting a user's click operation.
  • the electronic ID application may number each service applicable range, and the user manually enters the number of the selected service applicable range.
  • FIG. 5 is another schematic diagram of a user interface UI for performing management operations on an electronic ID card. As shown in FIG.
  • the service scope A corresponds to number 0
  • the service scope B corresponds to number 1
  • the service scope C corresponds to number 2. If the user selects business scope B, enter “1” in the input box provided on the management interface to indicate that the user has applied to upgrade the business scope of the electronic ID to business scope B.
  • the terminal device detects a user's input operation and triggers an upgrade process of the business scope of the electronic ID card.
  • the click operation or input operation of the user may be detected by a CA on the terminal device.
  • the CA detects a user's click operation or input operation, it receives a trigger instruction, thereby triggering the upgrade of the business scope of the electronic ID card.
  • the CA may determine whether the user has opened the electronic ID card after receiving the trigger instruction of the user to upgrade the service scope of the electronic ID card. If it is determined that the user has opened an electronic ID card, the CA executes step 202 and subsequent processes. If it is determined that the user has not activated the electronic ID card, the user may be prompted to activate the electronic ID card first.
  • the CA may query the certificate package application server whether the user has opened the electronic ID card.
  • the query can also be performed through a trusted security platform on the terminal device.
  • the CA determines that the terminal device provides a trusted security platform locally, and determines whether an electronic ID application exists in the trusted security platform.
  • the trusted security platform can be TEE or SE. Therefore, if the CA determines that TEE or SE is provided on the terminal device, the CA considers that the terminal device provides a trusted security platform locally. Further, the CA determines whether an electronic ID application exists in the trusted security platform.
  • the client application needs to determine whether its corresponding trusted application (TA) exists in the TEE.
  • TA trusted application
  • the electronic ID application is specific.
  • the client application needs to determine whether its corresponding applet applet exists in the SE. It can also be said that when the trusted security platform is SE, the electronic ID application is specifically an applet.
  • the electronic ID application application TA in the TEE or the electronic ID application applet in the SE is collectively referred to as an electronic ID application.
  • electronic ID application is a trusted application.
  • CA determines whether a terminal device provides a trusted security platform locally and whether an electronic ID application exists in the trusted security platform.
  • TEE Take the trusted security platform as an example. For example, by initializing the TEE environment (TEE context) operation, it is determined whether a TEE exists locally or whether the TEE is available. After the TEE context is initialized, it is determined whether an electronic ID application TA exists in the TEE through an open session operation. Alternatively, the CA determines whether an electronic ID application TA exists after obtaining the TA list from an audit security domain (SD) through a TA query operation (get list of TA).
  • SD audit security domain
  • get list of TA TA query operation
  • GP Global Platform Organization
  • TEE TEE Management Framework Standard issued by the GP, which is used to obtain a list of all TAs directly or indirectly associated with a security domain in the TEE, such as audit SD (via TA (Uniform unique identity (UUID)), so that the CA can determine whether there is a UUID for an electronic ID application based on the obtained UUID, and consider that the TA exists when it exists.
  • UUID Uniform unique identity
  • OMAPI open mobile interface
  • a terminal device accesses the SE through an open mobile interface (OMAPI)
  • the functions provided by the interface standard can be used for judgment.
  • OMAPI is released by SIM Alliance (SIMalliance) and has been transferred to GP.
  • SIM Alliance SIMalliance
  • getReaders SIM / SD / eSE slot
  • a session can be created by creating a session function openSession () with each SE to query whether there is an SE stored electronic ID application applet, and the specific process can refer to the OMAPI standard.
  • the CA determines that there is no electronic ID application in the trusted security platform, it downloads and installs the electronic ID application to the trusted security platform, for example, it can request the identity authentication server through the trusted security platform, and Download the electronic ID application through a trusted and secure platform, or download the electronic ID application directly from the authorized authentication server.
  • step 203 is performed.
  • the CA determines that an electronic ID application exists in the trusted security platform, it directly performs step 203.
  • the terminal device queries whether the trusted security platform stores certification information of the identity authentication server.
  • the client application CA may query whether the trusted security platform has the certification information of the identity authentication server through the following steps 2031-2033.
  • the CA sends a query command to the electronic ID application, and the query command is used to request whether the electronic ID application stores certification information of the identity authentication server.
  • the query command carries information capable of indicating the identity of the identity authentication server. For example, the ID or name of the authentication server.
  • the certification information of the identity authentication server may be information capable of characterizing a certificate of the identity authentication server.
  • it may be a certificate of an authentication server (for example, a public key certificate).
  • the electronic ID application inquires whether it has the identification information of the identity authentication server (for example, the certificate of the identity authentication server).
  • the identity authentication server for example, the certificate of the identity authentication server.
  • the electronic ID application returns a query response to the CA.
  • the query response carries a query result, and the query result is used to indicate whether the electronic ID application holds certification information of the identity authentication server.
  • the electronic ID application may return a query success response to the CA.
  • the query success response carries information used to indicate that the electronic ID application holds the certification information of the authentication server, for example, query result information (success) and / or information capable of characterizing the certificate of the authentication server (for example, identity The public key certificate of the authentication server, or the certificate serial number, trusted security platform identifier, terminal device identifier, and other information associated with the public key certificate).
  • the query result in the query response is used to indicate that the electronic ID application does not save the certification information of the identity authentication server.
  • steps 2031-2033 may also have other implementation manners, refer to manner 1, manner 2 and manner 3 in FIG. 6, respectively.
  • FIG. 6 is a schematic diagram of a terminal device inquiring whether a trusted security platform stores certification information of an identity authentication server.
  • the query command sent by the CA to the electronic ID application in addition to carrying information that can indicate the identity of the identity authentication server, also carries a random number (hereinafter referred to as R1).
  • R1 can be generated by the CA or generated on the REE side.
  • the above-mentioned signature operation may be calculating a hash value of the random number, and then encrypting the hash value with a key (for example, a private key of a trusted security platform or a private key applied by an electronic ID card).
  • a key for example, a private key of a trusted security platform or a private key applied by an electronic ID card.
  • other prior art methods can also be used for signature calculation.
  • the electronic ID application returns a query response to the CA.
  • a query success response is returned to the CA.
  • the query success response also carries the R1 signature.
  • the query command may not carry a random number. That is, the CA does not send random numbers to the e-ID application.
  • step 2032 after the electronic ID application receives the query command, if it is determined that the authentication information of the identity authentication server is stored, the electronic ID application can generate a random number (hereinafter referred to as R2) and perform a signature operation on R2. To get the signature of R2.
  • R2 a random number
  • step 2033 the query response returned by the electronic ID application to the CA not only carries the information capable of characterizing the certificate of the identity authentication server, but also carries the signatures of R2 and R2.
  • R2 since R2 is generated by the electronic ID application, the electronic ID application needs to send R2 to the CA while returning the signature of R2 to the CA.
  • the electronic ID application since R1 is generated on the CA side, the electronic ID application only needs to return the signature of R1.
  • a key of a trusted security platform may be used to perform a signature operation on R to obtain a signature of R1 or a signature of R2.
  • the query response may also carry information capable of indicating the certificate of the trusted security platform (hereinafter referred to as trusted security platform information), so that the identity authentication server determines the availability of the certificate based on the information. Trust the security platform's certificate to verify the above R signature.
  • the trusted security platform information may be the certificate serial number of the trusted security platform, the identity of the trusted security platform, and the identification information of the terminal device.
  • the trusted security platform information referred to herein may be a TEE certificate serial number, a TEE identification, an identification of a terminal device, and the like.
  • the CA sends a query command to the electronic ID application.
  • step 2031 in mode 2 reference may be made to step 2031 in mode 1, and details are not described herein again.
  • the electronic ID application determines that the authentication information of the identity authentication server is stored.
  • the electronic ID application obtains authorization from the identity authentication server based on the trusted security platform provided by the terminal device to upgrade the business scope of the electronic ID, and returns a query success response to the CA.
  • the query success response may carry at least one of information capable of characterizing a certificate of the identity authentication server and a local upgrade authorization result (success).
  • the CA sends a query request to the electronic ID application, and the query request is used to query whether the electronic ID application has certification information of an identity authentication server.
  • step 2302 the electronic ID application uses a key of the trusted security platform to perform a signing operation on R1 to obtain a signature of R1. Or, if the query command does not carry the random number R1, in step 2032, the electronic ID application generates a random number R2 after querying the certification information of the identity authentication server, and signs the R2 with the key of the trusted security platform. Operation to get the signature of R2.
  • the electronic ID application queries the certificate information of the identity authentication server, it encrypts at least one of the trusted security platform information and the signature of the random number by using the key of the certificate package application server to obtain encrypted data.
  • the electronic ID application sends a query success response to the CA, and the query success response carries the encrypted data.
  • the CA receives a successful response from the electronic ID application, which indicates that the electronic ID application has stored the certification information of the identity authentication server.
  • the CA can send it to the credential package application server via the credential package application, so that the credential package application server can decrypt the encrypted data and decrypt the The data (the data before encryption in step 2032 above) is verified (such as checking the signature of the random number mentioned above).
  • step 203 the CA can check whether the authentication information of the identity authentication server is stored in the trusted security platform by querying the trusted security platform.
  • the terminal device performs step 204 and subsequent steps.
  • the trusted security platform information and possible random number information involved in this query process are to facilitate the identity authentication server to confirm whether the terminal device has a legitimate trusted security platform in the subsequent step 204 , And then decide whether to allow the business scope of the electronic ID card to be authorized based on the trusted security provided locally by the terminal device.
  • the terminal device sends a local upgrade authorization request to the identity authentication server, and receives a local upgrade authorization response message from the identity authentication server.
  • step 204 the terminal device applies to the identity authentication server for the authority to upgrade the application scope of the user's electronic ID based on the trusted security platform, which can be implemented by referring to various methods shown in FIG.
  • FIG. 7 is a schematic diagram of a terminal device applying to an identity authentication server for a right to upgrade an application scope of an electronic ID card based on a trusted security platform.
  • the terminal device sends a local upgrade authorization request to the identity authentication server through the CA.
  • the CA sends a local upgrade authorization request to the identity authentication server, and the identity authentication server receives the local upgrade authorization request.
  • the CA learns whether the electronic ID application holds the identification information of the identity authentication server, for example, it can be determined after receiving the query response in the method 1 of step 203 above. If the electronic ID application holds the authentication information of the authentication server, the CA sends a local upgrade authorization request to the authentication server.
  • the local upgrade authorization request is used to request the identity authentication server to upgrade the service scope of the electronic ID card based on the local trusted security platform of the terminal device.
  • the local upgrade authorization request carries trusted security platform information.
  • the local upgrade authorization request also carries a random number R and a signature of the random number R.
  • the signature of the random number R and the random number R may be the signatures of R1 and R1 in step 203, or may be the signatures of R2 and R2.
  • the local upgrade authorization request may also carry identification information of the terminal device.
  • At least one of the above-mentioned trusted security platform information, a random number and a signature of a random number (for example, a signature of R1 and R1, or a signature of R2 and R2) and the identification information of the terminal device may be a key using an identity authentication server (E.g., public key or symmetric key) encrypted data.
  • an identity authentication server E.g., public key or symmetric key
  • the identity authentication server verifies the information carried in the local upgrade authorization request to determine whether the local upgrade authorization request is permitted.
  • the local upgrade authorization is permitted, that is, whether to agree to upgrade the service scope of the user's electronic ID based on the trusted security platform on the terminal device.
  • the identity authentication server receives the local upgrade authorization request and verifies information carried in the local upgrade authorization request (for example, trusted security platform information, a random number, and a signature of a random number).
  • the identity authentication server obtains the certificate of the trusted security platform according to the information of the trusted security platform, and verifies the certificate of the trusted security platform by using the root certificate of the preset authentication center.
  • the identity authentication server can directly obtain the public key certificate, or the trusted security platform information contains the serial number of the public key certificate and the identity of the trusted security platform
  • the identity authentication server can find the corresponding public key certificate according to the information (it should be noted that the identity authentication server has pre-stored the association relationship between the information and the public key certificate). Then, the identity authentication server can verify the legitimacy of the public key certificate by using the existing technical means (for example, using a root certificate to verify whether the signature on the public key certificate is legitimate). After that, the identity authentication server uses the public key certificate to verify the signature of the random number R.
  • the signature verification is performed by using the prior art method, and the public key corresponding to the public key certificate is used to decrypt the R signature to obtain its hash value. Calculate the hash value of the received random number R, and compare the decrypted hash value with the calculated hash value. If the verification is passed, the identity authentication server agrees to upgrade the scope of application of the electronic ID card based on the trusted security platform provided by the terminal device. If the verification fails, you do not agree.
  • the identity authentication server returns a local upgrade authorization response to the CA.
  • the local upgrade authorization response is used to instruct the identity authentication server to agree or disagree to upgrade the business scope of the electronic ID card based on the trusted security platform provided by the terminal device.
  • the identity authentication server When the identity authentication server agrees to upgrade the service scope of the electronic identity card based on the trusted security platform, the identity authentication server returns an authorization response message to the CA.
  • the authorization response message is used to instruct the identity authentication server to allow the The business scope of the electronic ID card is upgraded.
  • the local upgrade authorization response may carry indication information, which is used to instruct the identity authentication server to agree to upgrade the service scope of the electronic ID card based on the trusted security platform.
  • the identity authentication server In the case that the identity authentication server does not agree to upgrade the service scope of the electronic ID card based on the trusted security platform, the identity authentication server returns a negative response message to the CA.
  • the local upgrade authorization response may carry indication information, which is used to indicate that the identity authentication server does not agree to upgrade the applicable scope of the electronic ID card based on the trusted security platform.
  • the terminal device sends a local upgrade authorization request to the identity authentication server through the electronic ID application.
  • the CA requests the electronic ID application to directly send a local upgrade authorization request to the identity authentication server after querying the credential security platform to store the certification information of the identity authentication server.
  • Step 2 of the above Mode 2 in FIG. 6 is drawn with a dashed line in Mode 2 of FIG. 7, which indicates that Mode 2 in FIG. 7 can execute the mode in FIG. 6 on a terminal device.
  • steps 2031 and 2032 of 2 go to step 2041.
  • the CA sends a query command to the electronic ID application, and the query command carries information capable of characterizing the identity of the identity authentication server.
  • the query command may also carry a random number R.
  • the electronic ID application responds to the query command to query whether the trusted security platform has the certification information of the identity authentication server.
  • steps 2031-2032 reference may be made to steps 2031-2032 in Mode 1 or Mode 2 shown in FIG. 6 above.
  • the specific carrying information is similar, and is not repeated here.
  • the electronic ID application sends a local upgrade authorization request to the identity authentication server when it finds that the credible and secure platform holds the authentication information of the identity authentication server.
  • the local upgrade authorization request carries trusted security platform information.
  • the electronic ID application performs a signature operation on R1 to obtain a signature of R1, and carries the signatures of R1 and R1 in a local upgrade authorization request sent to the identity authentication server.
  • the electronic ID application may generate a random number R2 by itself, and perform a signature operation on R2 to obtain a signature of R2.
  • the local upgrade authorization request carries the signatures of R2 and R2.
  • step 2041 of the method 2 the information carried in the local upgrade authorization request is similar to the information carried in the local upgrade authorization request in step 2041 of the foregoing method 1, and details are not described again.
  • the electronic ID application receives a local upgrade authorization response from the identity authentication server.
  • the identity authentication server verifies the information carried in the local upgrade authorization request. If the verification is passed, the identity authentication server returns a local upgrade authorization response to the electronic ID application. If the verification fails, the identity authentication server returns a local upgrade negative response to the electronic ID application.
  • the electronic ID application sends a query response to the CA, as shown in step 2033 in the above manner 2 described in FIG. 6, or forwards the received local upgrade authorization response to the CA to notify the CA of the authorization result.
  • the content carried in the local upgrade authorization response in step 2042 in this method 2 is similar to the local upgrade authorization response in step 2042 in method 1 above, and details are not described again.
  • the electronic identity authentication application directly sends or receives messages to or from the identity authentication server. It can also be understood that the sent messages are generated by the electronic identity authentication application. Therefore, in the specific implementation It is also possible that the electronic identity authentication application transparently transmits the generated local upgrade authorization request to the client application CA, and then sends the client application CA to the identity authentication server, and then receives the response from the identity authentication server through the client application CA.
  • the terminal device requests the certificate package application server to send a local upgrade authorization request to the identity authentication server through the CA.
  • Method 3 may require a premise, that is, the electronic ID application is preset with a certificate of the credential package application server and a certificate of the identity authentication server (optional), and the credential package application server is preset with a certificate and authentication of a trusted security platform The root certificate of the central CA and the certificate of the identity authentication server.
  • the identity authentication server is preset with the certificate of the certificate package application server and the certificate of the trusted security platform (optional).
  • This third aspect may be based on the third aspect in step 203. That is, the CA starts executing the following step 2041 after receiving the query response in step 2033 from the electronic ID application.
  • the query success response carries encrypted data.
  • the encrypted data may be one or more of the signature of the secure server information and the random numbers R and R using the key (for example, a public key or a symmetric key) of the certificate package application server of the electronic ID application. owned.
  • the CA sends a local upgrade authorization request to the certificate package application server.
  • the local upgrade authorization request carries the encrypted data.
  • the credential package application server obtains the encrypted data carried in the local upgrade authorization request, decrypts the encrypted data, and verifies the trusted security platform information. Alternatively, after the encrypted application data is decrypted by the credential package application server, the decrypted data is encrypted again by using the key of the identity authentication server.
  • step 2042 For details of the two processing methods in step 2042, see the following description.
  • the credential package application server uses its own key (ie, the credential application server's key) to decrypt the encrypted data to obtain a trusted secure platform information and / or a random number signature. Then, the credential package application server verifies the trusted security platform information, and uses the trusted security platform information to verify the signature of the random number to obtain the verification result. The verification result is used to indicate whether the trusted security platform is trusted.
  • the credential package application server may send instruction information (denoted as instruction information # 1) to the identity authentication server, and the instruction information # 1 is used to indicate that The Trust Security Platform is credible. Conversely, the credential package application server may send indication information # 2 to the identity authentication server, and the indication information # 2 is used to indicate that the trusted security platform is untrusted.
  • the identity authentication server when it receives the local upgrade authorization request sent by the identity authentication server in the subsequent step 2043, or when it receives the local upgrade request in the subsequent step 205, it is determined according to the instruction information # 1 or the instruction information # 2. Whether to agree with the terminal device to upgrade the service scope of the user's electronic ID based on the trusted security platform. If the identity authentication server receives indication information # 1 from the credential package application server, the identity authentication server will agree to upgrade the business scope of the electronic ID card based on the trusted security platform on the terminal device. If the identity authentication server receives indication information # 2 from the credential package application server, the identity authentication server does not agree to upgrade the business scope of the electronic identity card based on the trusted security platform on the terminal device.
  • the certificate package application server After the certificate package application server decrypts the encrypted data, it uses the key of the identity authentication server (such as the pre-stored public key corresponding to the public key certificate of the identity authentication server) to encrypt the decrypted data twice, and Send the secondary encrypted data to the identity authentication server, the identity authentication server decrypts the secondary encrypted data, and then checks the trusted security platform information obtained after decryption, and verifies the signature of the random number to determine Whether the trusted security platform can be trusted, and then, when receiving a local upgrade authorization request, determine whether to allow the local upgrade authorization request.
  • the identity authentication server such as the pre-stored public key corresponding to the public key certificate of the identity authentication server
  • the identity authentication server may also choose to transparently transmit the information carried in the local upgrade request to the identity authentication server, and the identity authentication server decrypts these information for verification.
  • the certificate package application server sends a local upgrade authorization request to the identity authentication server.
  • the local upgrade authorization request in step 2043 carries the above instruction information 1 or instruction information 2.
  • the identity authentication server can directly determine whether to agree to upgrade the service scope of the electronic ID card based on the trusted security platform provided by the terminal device according to the instruction information 1 or the instruction information 2.
  • the local upgrade authorization request in step 2043 carries the data after secondary encryption.
  • the identity authentication server After the identity authentication server uses its own key to decrypt the secondary encrypted data, it checks the trusted security platform information. In the case of verification, it is agreed to upgrade the scope of application of the electronic ID card based on the trusted and secure platform provided by the terminal device. Disagree without checking.
  • the identity authentication server When the identity authentication server agrees to upgrade the scope of application of the electronic ID based on the trusted security platform provided by the terminal device, it sends a local upgrade authorization response to the certificate package application server.
  • the identity authentication server returns a local upgrade authorization response to the terminal device (such as the client application CA), and the terminal device forwards the local upgrade authorization response to the certificate package application server. This is shown in step 2045 labeled in FIG. 7.
  • the credential package application server decrypts the encrypted data sent by the terminal device and directly verifies the decrypted data. If the verification succeeds, the terminal device is directly granted Local upgrade authority.
  • the credential package application server needs to reach an agreement with the identity authentication server in advance, that is, the cooperation between the credential package application service provider and the identity authentication service provider is first reached, and the credential package application service is provided.
  • This kind of authority allows the company to authenticate and grant local upgrade authority to the trusted security platform on the terminal device in a similar role as a proxy.
  • random numbers and their signatures involved in the above steps 203 and 204 are an implementation method that plays a certain role in preventing replay attacks.
  • other information can also be used instead of random numbers, such as using CA and Count of the number of interactions between TAs.
  • steps 201-204 describe the process by which the terminal device applies for the authority to upgrade the application scope of the electronic ID card based on the trusted security platform provided locally from the identity authentication server, and obtains the authorization process.
  • steps 205-209 are the process of upgrading the business scope of the electronic ID card based on the authority to upgrade the business scope of the electronic ID card based on the trusted security platform.
  • the terminal device generates upgrade information required for upgrading the service scope of the electronic ID card, and sends the upgrade information to the identity authentication server.
  • Step 205 is implemented in various ways as shown in FIG. 8.
  • FIG. 8 is a schematic diagram of a terminal device generating upgrade information and sending the upgrade information to an identity authentication server.
  • the CA sends a local upgrade command to the electronic ID application.
  • the local upgrade command is used to request the electronic ID application to generate upgrade information.
  • the upgrade information includes at least the user's face image information and physical identity information.
  • An optional implementation is that a part of the upgrade information can be carried in the local upgrade command.
  • the CA can generate a part of the upgrade information on the REE side and obtain another part of the upgrade information from the electronic ID application. .
  • the CA obtains face image information on the REE side, and obtains physical identity information from an electronic ID application.
  • the CA obtains physical identity information on the REE side, and obtains face image information from an electronic identity application.
  • the CA can generate a part of the upgrade information on the REE side and send a local upgrade command to the electronic ID application.
  • the local upgrade command is used to request the electronic ID application to generate another part of the upgrade information (and all the upgrade information) Encryption or signing).
  • the electronic ID application In response to the local upgrade command, the electronic ID application generates another part of the upgrade information requested by the CA, and after generating another part of the upgrade information, feeds back the local upgrade command response to the CA, and the local upgrade command response carries the upgrade. Another part of the information.
  • the CA and the electronic ID application may also perform encryption or signature processing on the partially obtained upgrade information, respectively.
  • the CA uses the public or symmetric key of the identity authentication server to encrypt part of the upgrade information it has obtained
  • the electronic ID application uses the private key of the trusted security platform to sign the part of the upgrade information it has obtained.
  • all the upgrade information can also be encrypted or signed by the electronic ID application.
  • the local upgrade command may not carry any upgrade information.
  • the electronic ID application is required to obtain all the upgrade information and then return it to the CA through the local upgrade response.
  • an electronic ID application can read physical ID information through near field communication (NFC), or receive physical ID information entered by the user through a user interface (UI), or take pictures uploaded by the user To identify the physical identity information; and to collect face image information in real time through the camera on the terminal device.
  • NFC near field communication
  • UI user interface
  • the electronic ID application performs encryption processing or signature processing on reading the user's physical ID information and / or collecting the user's face image information.
  • an electronic ID application may use a private or symmetric key of a trusted security platform to sign face image information and / or physical ID information.
  • the electronic ID application uses the public key or symmetric key of the identity authentication server to encrypt the face image information and / or the physical ID information.
  • the CA sends a local upgrade request to the identity authentication server, and the local upgrade request carries the upgrade information.
  • the upgrade information further includes electronic ID information.
  • the upgrade information also includes electronic ID information and the current business scope identification corresponding to the electronic ID.
  • the electronic ID information (which may include the electronic ID and the corresponding identifier of the current business scope of application) may be obtained locally on the terminal device, or may be obtained from the certificate package application server. For example, if the electronic ID information is stored on a terminal device (for example, a trusted security platform), it can be obtained directly. If the electronic ID information is stored on the certificate package application server, you need to go through the following step 2053 -2054 acquisition.
  • the CA sends an electronic ID information acquisition request to the certificate package application server.
  • the electronic ID information acquisition request is used to request to obtain the user's current electronic ID information from the credential package application server.
  • the CA receives a response message from the credential package application server, and obtains electronic ID information from the response message.
  • the upgrade information may further include identification information of the terminal device.
  • the identification information of the terminal device can facilitate the identity authentication server to determine the result of the local upgrade authorization applied through the above steps 201-204, and may also be used to determine the certificate of the trusted security platform on the terminal device, or to perform the above-mentioned electronic ID information. Relevance check.
  • the electronic ID information obtained above (and its corresponding current business scope of application) is used to confirm with the identity authentication server that the upgrade operation is performed on the electronic ID to ensure that in some cases For example, when a user activates multiple electronic ID cards on one terminal device, or when multiple users activate electronic ID cards on the same terminal device, the service scope of the specified electronic ID card can be upgraded.
  • the electronic ID application generates upgrade information (ie, all information included in the upgrade information). After the electronic ID application generates the upgrade information, the electronic ID application directly sends a local upgrade request to the identity authentication server.
  • the local upgrade request carries the upgrade information.
  • the CA sends a local upgrade command to the electronic ID application.
  • the local upgrade command is used to request the electronic ID application to generate upgrade information.
  • the content carried by the local upgrade command is the same as the local upgrade command described in step 2051 in Mode 1 above, and details are not described herein again.
  • Method 2 differs from Method 1 above in that the electronic ID application may not return a local upgrade response to the CA, or the returned local upgrade response does not include all or part of the upgrade information described in Method 1.
  • the electronic ID application sends a local upgrade request to the identity authentication server, and the local upgrade request carries the upgrade information.
  • the local upgrade request also carries the signature information.
  • the electronic ID card is encrypted with face image information and / or physical ID information
  • the upgrade information carried in the local upgrade request is encrypted data.
  • the upgrade information further includes electronic ID information.
  • the upgrade information also includes electronic ID information and the current business scope identification corresponding to the electronic ID. Specifically, it can be obtained by the client application CA from the credential package application server before step 2051 of this method 2, which is similar to steps 2053-2054 in the above method 1, and will not be described again.
  • the CA sends the upgrade information to the credential package application server, and the credential package application server sends a local upgrade request to the identity authentication server.
  • the CA sends the face image information and entity ID information obtained through the above manner 1 to the credential package application server.
  • the electronic ID application sends the encapsulated upgrade information to the CA, and the CA sends the upgrade information to the certificate package application server.
  • the public key or symmetric key of the certificate package application server may be used to pair the face image information and / or The entity ID information is encrypted.
  • the certificate package application server sends a local upgrade request to the identity authentication server, and the local upgrade request carries the upgrade information.
  • the upgrade information is used by the identity authentication server to upgrade the service scope of the electronic ID card.
  • the credential package application server may transparently transmit the upgrade information to the identity authentication server directly.
  • the credential package application server may verify the face image information and the physical identity information, and then send the verification result to the identity authentication server.
  • the face image information and the physical identity information cannot be all obtained by the CA from the REE side.
  • the face image information and physical identity information will be sent to the authentication server for verification. If the user indicated by the face image information and the user indicated by the physical ID information are the same user, if the check is passed, the identity server will upgrade the service scope of the electronic ID card. Otherwise, the check fails and no upgrade is performed.
  • REE has lower security than TEE. Therefore, the security of ordinary applications (ie, client application CA) running in REE cannot be guaranteed. Therefore, at least one of the upgrade information is not obtained from the REE side to improve the reliability of the check.
  • the CA sends the acquired face image information and physical identity information to the credential package application server.
  • the credential package application server encapsulates face image information, physical identity information, and electronic identity information into a local upgrade request and sends it to the identity authentication server.
  • the CA does not need to obtain electronic ID information from the credential application server.
  • the identity authentication server checks the upgrade information, and if the verification is passed, the service scope of the electronic ID card is upgraded.
  • the identity authentication server checks whether the user indicated by the face image information and the user indicated by the physical identity information are the same user. If it is the same user, the identity authentication server upgrades the current business scope of the user's electronic ID.
  • the identity authentication server After the identity authentication server upgrades the service scope of the user's electronic ID card, it can send a local upgrade success response to the terminal device.
  • the identity authentication server needs to first check the signature information using a key of the trusted security platform (such as a public key or a symmetric key) to check the face image information and / or physical identity information.
  • a key of the trusted security platform such as a public key or a symmetric key
  • the credential package application server transmits the encrypted data encrypted using the key (for example, the public key) of the identity authentication server to the identity authentication server, and the identity authentication server needs to decrypt the encrypted data (Such as decryption by using its own private key), and then check the face image information and the entity ID information.
  • the credential package application server has already verified the face image information and / or physical identity information, and sent the verification result directly to the identity authentication server, and the identity authentication server may The verification result of the application server determines whether to upgrade the business scope of the electronic ID card. If the verification result indicates that the verification is passed, the service scope of the user's electronic ID is upgraded. If the verification result indicates that the verification is not approved, the service scope of the user's e-ID is not upgraded. Further, in the case that the verification fails, the identity authentication server may return the upgrade failure information to the terminal device.
  • the identity authentication server sends an upgrade notification to the credential package application server or the terminal device.
  • the identity authentication server when the CA or TA of the terminal device sends a local upgrade request (ie, upgrade information) to the identity authentication server, the identity authentication server returns an upgrade notification to the terminal device.
  • the terminal device then forwards the upgrade notification to the credential package application server, so that the credential package application server updates and saves the upgraded service scope identifier.
  • the terminal device sends a local upgrade request to the authentication server through the credential package application server or the local upgrade request sent by the CA or TA of the terminal device to the authentication server carries the identification information of the credential package application server (for example, the credential package application In the case of the name of the server or uniform resource locator (URL)), the identity authentication server sends an upgrade notification directly to the certificate package application server after the service scope of the electronic ID card is upgraded.
  • the upgrade notification is used for Notify the credential package application server to update the business scope of the user's electronic ID.
  • the upgrade notification carries an identifier of the applicable scope of the upgraded service.
  • the identity authentication server will identify the upgraded business application scope identification with the electronic ID information and / or terminal device identification Make an association.
  • the credential package application server updates the service application scope of the user's electronic ID from the first service application scope to the second service application scope.
  • the scope of application of the first business is the scope of application before the upgrade
  • the scope of application of the second business is the scope of application after the upgrade.
  • the scope of application of the second business is larger than the scope of application of the first business.
  • the identity authentication server may directly send an upgrade notification to the credential package application server to notify the credential package application server to update the business application scope of the electronic ID card.
  • the terminal device can synchronously update the business scope of the user ’s electronic ID, for example, the CA or the electronic ID application updates the business scope of the electronic ID in the form of UI See step 209 in FIG. 2.
  • FIG. 9 is another schematic diagram of a user interface UI for performing management operations on an electronic ID card.
  • the CA displays a prompt message to the user, prompting the business scope of the electronic ID card after the upgrade is completed.
  • the CA prompts "the current business scope of your electronic ID is: business scope B" on the management interface, and provides "OK” and "Modify” buttons on the management interface.
  • CA detects that the user clicks the "OK” button to record the scope of business application B as the current scope of application of the user's electronic ID.
  • the CA detects that the user clicks the "modify” button, and returns to the management interface shown in FIG.
  • step 208 and the management interface referred to in the text may also be provided by the electronic ID application, and accordingly, updating the upgraded service scope record may also be performed by the electronic ID application.
  • the above is the process for upgrading the service scope of the user's electronic ID based on the trusted security platform provided locally by the terminal device proposed in this application.
  • the scope of business of electronic ID cards varies. If a user wants to expand the scope of services applicable to his electronic ID card to use the electronic ID card to handle more services, he can use the method described in scenario 1 to apply the service scope of his electronic ID card. Upgrade. For example, before the upgrade, the user's electronic ID could only handle hotel check-in and ticket purchases. After the upgrade, in addition to the hotel check-in and ticket purchase, this user's electronic ID can also be used for business registration, securities account opening and other services.
  • a user does not yet have an electronic ID card, he can apply for an electronic ID card with a target service scope when he applies for an electronic ID card. For example, if the user wishes to apply for an electronic ID card that can be used for businesses such as business registration and securities account opening, then the user can directly apply for an electronic ID card with the scope of the business application.
  • This scenario is even the second scenario mentioned below.
  • FIG. 10 is a flowchart of a method for applying for an electronic ID card according to the present application.
  • the terminal device receives a trigger instruction.
  • the trigger instruction is used to request an electronic ID card with a target service scope for the user.
  • the target service scope refers to the scope of service selected by the user for the electronic ID card that he / she applied for.
  • the electronic ID application can divide the business scope that the electronic ID can be applied into multiple levels, and each level corresponds to a business scope. Among them, the larger scope of business application can cover the smaller scope of business application.
  • a user applies for an electronic ID card, he can choose a suitable business application scope for the electronic ID card to be applied for according to business needs.
  • the scope of application of the above target service may also be default, or determined by the terminal device based on whether a trusted security platform is provided locally. For example, in a later process, if the terminal determines that there is no trusted security platform locally, the scope of application of the target service The lowest level, otherwise it is higher than the lowest level.
  • step 510 For the process of receiving the trigger instruction by the terminal device in step 510, refer to step 201 in scenario 1.
  • a user selects “application for an electronic ID card” on the management interface provided by the electronic ID application, and selects to apply for an “application for an electronic ID card” service.
  • the terminal device receives the trigger instruction by detecting the user's click operation, thereby triggering the business process of applying for an electronic ID card for the user. Further, after detecting the user's trigger instruction, the terminal device may present a prompt interface to the user for the user to select a service scope of the electronic ID card.
  • the terminal device determines the applicable scope of the target service selected by the user by detecting user operations, and thus directly applies for the user to obtain the electronic ID with the applicable scope of the target service based on the trusted security platform.
  • obtaining the user's click operation is only an example of receiving a trigger instruction by a terminal device, and those skilled in the art may also use existing technical means to receive (or detect) the user's trigger instruction.
  • the trigger instruction is used to trigger the upgrade of the service scope of the electronic ID card.
  • the trigger instruction is used to trigger an application for an electronic ID card with a target service scope.
  • the terminal device determines that the terminal device provides a trusted security platform, and determines that the trusted security platform stores certification information of the identity authentication server.
  • step 520 reference may be made to step 220 in scenario 1, and details are not described herein again.
  • the terminal device obtains, from the identity authentication server, the authority to apply for an electronic ID card with a target service scope for the user based on the trusted security platform.
  • the terminal device determines that the trusted security platform holds the certification information of the identity authentication server, it applies to the identity authentication server for the user's authority to apply for an electronic identity card with a target business scope based on the trusted security platform. After obtaining the permission of the identity authentication server, the terminal device obtains the authority.
  • the CA running in the REE on the terminal device requests the electronic ID application to query whether the certification information of the identity authentication server is stored in step 520.
  • the CA After receiving the query success response returned by the electronic ID application, the CA sends a local application authorization request to the identity authentication server.
  • the local application authorization request is used to request the identity authentication server to apply for an electronic ID card with a target business scope for the user based on a trusted security platform.
  • the local application authorization request carries trusted security platform information.
  • the local application authorization request also carries a signature of the random numbers R and R. Further, information such as identification information of the terminal device may also be carried.
  • one or more of the trusted security platform information and the signatures of R and R may be data that is encrypted using a key (for example, a public key or a symmetric key) of the identity authentication server.
  • a key for example, a public key or a symmetric key
  • the identity authentication server verifies the information carried in the local application authorization request to determine whether the local application authorization is permitted. If the verification succeeds, the identity authentication server agrees to apply for an electronic ID card for the user based on the trusted security platform provided by the terminal device. If the verification fails, the identity authentication server does not agree to apply for an electronic ID for the user based on the trusted security platform.
  • the verification process can refer to the description in scenario 1.
  • the identity authentication server If the authentication succeeds, the identity authentication server returns a local application authorization response to the terminal device, and the terminal device has obtained the authority to apply for an electronic ID card for the user based on the trusted security platform.
  • the terminal device sends the application information required for applying for the electronic ID card to the identity authentication server, so that the identity authentication server generates an electronic ID card with a target service scope for the user according to the application information.
  • the application information is used for the identity authentication server to authenticate the user and generate an electronic ID for the user with a target business application scope.
  • the application information includes at least the user's face image information and physical identity information. Further, some or all of the information in the application information may also be data that has been signed using the key of the trusted security platform, and / or data that has been encrypted using the key of the identity authentication server. Optionally, the application information may further include identification information of the terminal device, local application authorization result information, and the like. Different from scenario 1, the application information does not include electronic ID information.
  • the identity authentication server checks the application information. If the check is passed, the identity authentication server generates an electronic ID for the user with the applicable scope of the target business. Further, the identity authentication server sends the generated electronic ID to a trusted security platform of the terminal device for storage.
  • the terminal device applies for an authorization from the identity authentication server based on the trusted security platform provided by the terminal device to apply for the permission of the user with an electronic identity card with a target service scope.
  • the user applies for an electronic ID with the scope of application of the target business. In this way, users can directly apply for an electronic ID card with a larger scope of business applications, and they no longer need to rely on a trusted acceptance terminal deployed at a fixed network, reducing deployment costs, and can bring convenience to users.
  • FIG. 11 is a schematic diagram of a terminal device applying for an electronic ID based on a trusted security platform proposed in the present application.
  • a terminal device receives a trigger instruction through a client application CA in a rich execution environment REE, and the trigger instruction is used to request an electronic ID card with a target service scope for a user.
  • the CA running in the REE on the terminal device can provide the user with an entry for managing related information of his electronic ID.
  • the user enters the management interface of the electronic ID card by opening the CA without opening the electronic ID card.
  • the management of the electronic ID card includes the application of the electronic ID card and the subsequent management of the application for the electronic ID card, for example, the application scope of the applied electronic ID card is upgraded as required.
  • the management interface provided by the CA may refer to step 201 in scenario 1.
  • the CA determines that the terminal device provides a trusted security platform locally, and determines whether an electronic ID application exists in the trusted security platform.
  • step 602 reference may be made to step 202 in scenario 1, which is not described in detail here.
  • the terminal device queries whether the trusted security platform stores certification information of the identity authentication server.
  • the terminal device queries whether the trusted security platform stores the certification information of the identity authentication server. For details, refer to the description in scenario one above, and details are not described herein again.
  • the terminal device sends a local application authorization request to the identity authentication server, and receives a local application authorization response response from the identity authentication server.
  • the terminal device sends a local application authorization request to the identity authentication server, similar to the terminal device described in scenario one sending a local upgrade authorization request to the identity authentication server.
  • the terminal device receives a local application authorization response from the identity authentication server, which is similar to the scenario where the terminal device receives a local upgrade authorization response from the identity authentication server. See the implementations in scenario one.
  • the CA on the terminal device sends a local application authorization request to the identity authentication server, and the local application authorization request carries trusted security platform information.
  • the trusted security platform information may be encrypted data after the electronic ID application uses the key of the identity authentication server to perform an encryption operation.
  • the local application authorization information also carries a signature of the random numbers R and R.
  • the signature of R and R may also be encrypted data after the encryption operation is performed by using the key of the identity authentication server.
  • the identity authentication server receives the local application authorization request and checks the trusted security platform information carried in the local application authorization request. If the trusted security platform information is encrypted data that is encrypted using the key of the identity authentication server, the identity authentication server first uses its own private key to decrypt the encrypted data, and then uses the root certificate of the locally preset certification center CA Check the trusted security platform information obtained after decryption.
  • the identity authentication server uses the trusted security platform information to verify the signature of R. For the verification process, refer to scenario 1, which is not described in detail here.
  • the terminal device generates application information required for applying for an electronic ID card with a target service scope, and sends the application information to the identity authentication server.
  • the application information can be generated jointly by the CA and the electronic ID application, or can be generated by the electronic ID application alone. If it is the former, at least one of the generated application information is obtained from the electronic ID application, that is to say, the application information cannot be all generated by the CA on the REE side, and at least one of the face image information or physical ID information comes from the electronic ID application.
  • the application information includes at least the user's face image information and physical identity information.
  • the terminal device may send the application information to the identity authentication server in multiple ways. For example, after the CA generates the application information, it sends a local application request to the identity authentication server, and the local application request carries the application information.
  • the CA sends a local application command to the electronic ID application, and the electronic ID application generates application information (including face image information and physical ID information), and sends a local application request to the identity authentication server.
  • the local application request carries the local application request.
  • Application Information may further include signature information, which is obtained by the electronic ID application using one or more of the face image information and the entity ID information using a trusted security platform key.
  • the application information may further include identification information of the applicable scope of the target service.
  • the CA After the CA generates the application information, it sends a local application request to the credential package application server, and the local application request carries the application information.
  • the credential package application server may verify the application information, and then send the verification result to the identity authentication server.
  • the certificate package application server may transparently transmit the local application request to the identity authentication server.
  • the identity authentication server checks the application information, and if the verification is passed, generates an electronic ID card for the user with a target service scope.
  • the identity authentication server checks whether the user indicated by the face image information and the user indicated by the physical identity information are the same user. If it is the same user, the identity authentication server generates an electronic ID for the user with a target business scope. If they are not the same user, the identity authentication server returns a rejection message to the terminal device. The rejection message is used to instruct the identity authentication server to refuse to open and issue an electronic ID card for the user.
  • the application information includes an electronic ID application
  • the key of the trusted security platform (such as a private key or a symmetric key) is used to sign the face image information and / or the physical ID information.
  • the identity authentication server uses a preset key of the trusted security platform (for example, a public key or a symmetric key) to verify the signature information.
  • the identity authentication server sends a notification of successful application to the terminal device or the credential package application server.
  • the identity authentication server when the CA or TA of the terminal device sends a local application request to the identity authentication server, the identity authentication server returns a notification of successful application to the terminal device.
  • the application success notification is used to indicate that the user's electronic ID application is successful.
  • the application success notification carries the electronic ID generated by the identity authentication server for the user and identification information of the business scope of the electronic ID.
  • the identity authentication server associates the user's electronic identity card, identification information of the service scope of the electronic identity card with the terminal device, The logos are linked.
  • the CA receives the notification of the successful application, saves the electronic ID information, and records the business scope of the electronic ID.
  • the CA can also notify the user of the successful application of the electronic ID through the management interface, and provide the user with the function of viewing the applicable scope of the applied electronic ID.
  • the local application request sent by the CA or TA of the terminal device to the authentication server may also carry identification information of the credential package application server (for example, the name or URL of the credential package application), so that the authentication server can directly send a notification of the successful application Apply server to credential package.
  • the notification of successful application carries the identification information of the electronic ID card and the applicable scope of its business.
  • the credential package application server records the business application scope of the user's electronic ID.
  • the credential package application server After receiving the notification of successful application, the credential package application server records the electronic ID information of the user and the business scope of the electronic ID.
  • a CA or an electronic ID application can also record the business application scope of the electronic ID applied for by the user in a UI form. See step 609 in FIG. 11, which is not repeated here.
  • This step 608 is optional, that is, in the second scenario, the electronic ID card and the applicable scope of its services can be recorded only on the terminal device side, without recording on the certificate packet server side.
  • the terminal device can apply for an electronic ID card with a target service scope for the user based on the trusted security platform provided on the terminal device.
  • an electronic ID card with a larger scope of application can be applied for the user at different stages, respectively.
  • the smaller scope of application of the electronic ID card is upgraded, thereby expanding the scope of application of the electronic ID card.
  • an electronic ID card with a larger target service scope is directly applied for the user.
  • the device for upgrading the application scope of the electronic ID card and the device for applying for an electronic ID card provided in this application are described below.
  • FIG. 12 is a block diagram of an apparatus 700 for upgrading an application scope of an electronic ID card provided by the present application.
  • the input / output unit 701 is configured to receive a trigger instruction, and the trigger instruction is used to request an upgrade of a service scope of a user's electronic ID card;
  • a processing unit 702 configured to determine, according to a trigger instruction received by the input-output unit 701, that the device 700 provides a trusted security platform, and determine that the trusted security platform stores certification information of an identity authentication server;
  • the processing unit 702 is further configured to obtain, from the identity authentication server, a right to upgrade the service scope of the electronic ID card based on the trusted security platform;
  • the processing unit 702 is further configured to generate upgrade information required for upgrading the service scope of the electronic ID card
  • the transceiver unit 703 is configured to send the upgrade information generated by the processing unit 702 to the identity authentication server, so that the identity authentication server upgrades the service scope of the electronic ID card according to the upgrade information.
  • processing unit 702 is further configured to determine that an electronic ID application exists in the trusted security platform before determining that the trusted security platform stores the certification information of the identity authentication server; or,
  • the determining unit 702 determines that an electronic ID application does not exist in the trusted security platform, the determining unit 702 is further configured to download and install an electronic ID application to the trusted security platform.
  • the trusted security platform is a trusted execution environment TEE
  • the electronic ID application is a trusted application TA in the TEE
  • the trusted security platform is a security unit SE
  • the electronic ID application is in a SE Security applications.
  • the upgrade information includes user's face image information and physical identity information
  • the processing unit 702 is configured to generate the upgrade information through a client application CA in the REE
  • the transceiver unit 703 is configured to use the CA generated Sending the upgrade information to an identity authentication server, wherein at least one piece of information in the upgrade information is obtained by the CA from an electronic ID application; or
  • the processing unit 702 is configured to request the electronic ID application to generate the upgrade information through the CA; the receiving and sending unit 703 is configured to send the upgrade information generated by the electronic ID application to an identity authentication server.
  • the upgrade information further includes signature information
  • the signature information is information obtained by the electronic ID application signing at least one of the face image information and the entity ID information using a key of the trusted security platform.
  • the upgrade information further includes electronic ID information, or the upgrade information further includes identification information of a service application scope corresponding to the electronic ID information and the electronic ID information.
  • the upgrade information is information that is encrypted by using a key of the identity authentication server.
  • the processing unit 702 is configured to send a query command to the trusted security platform through the CA in the REE, and the query command is used to request whether the trusted security platform holds certification information of the identity authentication server, and the query command carries Information characterizing the identity of the authentication server;
  • the processing unit 702 is configured to receive a query success response from the trusted security platform through the CA, and the query success response is used to indicate that the trusted security platform stores certification information of the identity authentication server.
  • the query success response carries information that can indicate a trusted security platform certificate
  • the transceiver unit 703 is configured to send a local upgrade authorization request to the identity authentication server, and the local upgrade authorization request carries the trusted security platform capable of indicating Information of the certificate;
  • the transceiver unit 703 is further configured to receive an authorization response message returned by the identity authentication server, where the authorization response message is used to instruct the identity authentication server to allow the service scope of the electronic ID card to be upgraded based on a trusted security platform.
  • the transceiver unit 703 is further configured to send a local upgrade authorization request to the identity authentication server through the CA; and the transceiver unit 703 is further configured to receive the authorization response message returned by the identity authentication server through the CA; or,
  • the transceiving unit 703 is further configured to send a local upgrade authorization request to the identity authentication server through the electronic identity application; and the transceiving unit 703 receives the authorization response message from the identity authentication server through the electronic identity application.
  • the local upgrade authorization request also carries a random number and a signature of the random number, where the signature of the random number is obtained by the trusted security platform using a key of the trusted security platform to perform a signature operation on the random number, where the random number
  • the number is generated by the trusted security platform or sent by the CA to the trusted security platform through a query command.
  • At least one of the information that can indicate the certificate of the trusted security platform, the random number, and the signature of the random number is information that is encrypted by using the key of the identity authentication server.
  • the apparatus 700 may correspond to the foregoing method 100 for upgrading the service scope of an electronic ID card and the terminal devices described in the embodiments thereof.
  • the apparatus 700 may be a terminal device in the foregoing method 100 and its embodiments, or may also be a chip configured in the terminal device.
  • Each unit in the apparatus 700 is respectively configured to perform each operation and / or processing procedure performed by the terminal device in the foregoing method 100 and each embodiment thereof. To avoid redundant description, detailed descriptions are omitted.
  • FIG. 13 is a block diagram of an apparatus 800 for applying for an electronic ID filed in the present application.
  • the input-output unit 801 is configured to receive a trigger instruction, and the trigger instruction is used to request an electronic ID card with a target service scope for the user;
  • a processing unit 802 configured to determine, according to the trigger instruction received by the input-output unit 801, that the device 800 provides a trusted security platform, and determine that the trusted security platform stores certification information of an identity authentication server;
  • the processing unit 802 is further configured to obtain, from an identity authentication server, a right to apply for an electronic identity card based on a trusted security platform;
  • the processing unit 802 is further configured to generate application information required for applying for an electronic ID card with a target service scope
  • the transceiver unit 803 is configured to send the application information generated by the processing unit 802 to the identity authentication server, so that the identity authentication server generates an electronic ID card with a target service scope for the user according to the application information.
  • processing unit 802 is further configured to determine that an electronic ID application exists in the trusted security platform before it is determined that the trusted security platform stores the certification information of the identity authentication server; or
  • the processing unit 802 is further configured to download and install the electronic ID application to the trusted security platform when it is determined that the electronic ID application does not exist in the trusted security platform.
  • the trusted security platform is the trusted execution environment TEE
  • the electronic ID application is the trusted application TA in the TEE
  • the trusted security platform is the security unit SE
  • the electronic ID application is the security in the SE. application.
  • the application information includes user's face image information and physical identity information
  • the processing unit 802 is configured to generate the application information through the client application CA in the REE
  • the transceiver unit 803 is configured to use the CA to generate the application information Send to the identity authentication server, wherein at least one of the application information is obtained by the CA from the electronic ID application; or,
  • the processing unit 802 is configured to request the electronic ID application to generate application information through the CA; the transceiver unit 803 is configured to send the application information generated by the electronic ID application to the identity authentication server.
  • the application information further includes signature information
  • the signature information is information obtained by performing an signature process on at least one of the face image information and the physical identity information by the electronic ID application using a key of the trusted security platform.
  • the application information further includes identification information of a target service application range.
  • the application information is information obtained by performing encryption processing using a key of the identity authentication server.
  • the processing unit 802 is configured to send a query command to the trusted security platform through the CA in the REE, and the query command is used to request to query whether the trusted security platform holds the certification information of the identity authentication server, and the query command carries an identifier capable of identifying Information about the identity of the authentication server;
  • processing unit 802 is further configured to receive a query success response from the trusted security platform through the CA, and the query success response is used to indicate that the trusted security platform stores certification information of the identity authentication server.
  • the query success response carries information capable of indicating a certificate of a trusted security platform
  • the transceiver unit 803 is configured to send a local application authorization request to the identity authentication server, where the local application authorization request carries information of the certificate capable of indicating the trusted security platform;
  • the transceiver unit 803 is further configured to receive an authorization response message returned by the identity authentication server, where the authorization response message is used to instruct the identity authentication server to allow the user to apply for an electronic identity card with a target service scope based on a trusted security platform.
  • the transceiver unit 803 sends a local application authorization request to the identity authentication server through the CA; and the transceiver unit 803 is further configured to receive the authorization response message returned by the identity authentication server through the CA; or,
  • the transceiver unit 803 is configured to send a local application authorization request to the identity authentication server through the electronic identity application; and the transceiver unit 803 is further configured to receive an authorization response message from the identity authentication server through the electronic identity application.
  • the local application authorization request also carries a random number and a signature of the random number, and the signature of the random number is obtained by the trusted security platform using a key of the trusted security platform to perform a signature operation on the random number, where the random number It is generated by the trusted security platform or sent by the CA to the trusted security platform through a query command.
  • At least one of the information capable of indicating the certificate of the trusted security platform, the random number, and the signature of the random number is information that is encrypted by using a key of the identity authentication server.
  • the apparatus 800 may correspond to the foregoing method 500 for applying for an electronic ID card and the terminal devices described in the embodiments thereof.
  • the apparatus 800 may be a terminal device in the foregoing method 500 and its various embodiments, or may be a chip configured in the terminal device.
  • each unit in the apparatus 800 is respectively configured to perform each operation and / or processing flow performed by the terminal device in the foregoing method 500 and each embodiment thereof. To avoid redundant description, detailed descriptions are omitted.
  • FIG. 14 is a schematic structural diagram of a terminal device 900 applicable to an embodiment of the present application.
  • the structure shown in FIG. 14 should not be limited to the terminal device in this application, and the terminal device 900 may include more or less components than those shown in FIG. 14, or a combination of some components, etc. .
  • the transceiver 910 is configured to establish a communication channel, so that a terminal device can connect to a remote server through the communication channel, and download media data from the remote server.
  • the transceiver 910 may include a communication module such as a wireless local area network (wireless LAN) module, a Bluetooth module, a near field communication (NFC) module, a baseband module, and the like.
  • Radio frequency (RF) circuit for wireless local area network communication, Bluetooth communication, NFC communication, infrared communication and / or cellular communication system communication.
  • the RF circuit is used to receive and send signals during information transmission or communication. For example, the downlink information of the base station is received and processed by the processor 920, or the uplink data is sent to the base station.
  • the radio frequency circuit includes well-known circuits for performing these functions, including but not limited to antenna systems, radio frequency transceivers, one or more amplifiers, tuners, one or more oscillators, digital signal processors, codecs (Codec) chipset, subscriber identity module (SIM) card, memory and so on.
  • the radio frequency circuit can also communicate with the network and other devices through wireless communication.
  • the wireless communication may use any one of communication standards or protocols, including but not limited to wireless local area networks (WLAN), global mobile communication (GSM) systems, code division multiple access, and code division multiple access.
  • CDMA compact Code division multiple access
  • WCDMA wideband code division multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • LTE frequency division dual Frequency division division duplex
  • TDD time division duplex
  • UMTS universal mobile communication system
  • WiMAX worldwide interconnected microwave access
  • the information, data, and / or signaling interaction between the terminal device and the identity authentication server and the credential package application server may be implemented through the transceiver 910.
  • the terminal device may send a local upgrade authorization request, a local application authorization request, etc. to the identity authentication server through the transceiver 910, and may also send the upgrade information or application information generated by the processor 920 to the identity authentication server through the transceiver 910.
  • the terminal device can also receive messages such as a local authorization response and a query success response from the identity authentication server.
  • the terminal device reading the user's physical identity information through the NFC channel can also be implemented through the transceiver 910. No longer enumerated here.
  • the processor 920 is a control center of the terminal device, and uses various interfaces and lines to connect various parts of the entire terminal device. By running or executing software programs and / or modules stored in the memory and calling data stored in the memory, Perform various functions of the terminal device and / or process data. For example, in the embodiment of the present application, the upgrade information, the generation of application information, determining whether the terminal device provides a trusted security platform, judging whether the credential security platform has the certification information of the identity authentication server, and performing the verification on the trusted security platform information Encryption and / or signing operations, etc. may be performed by the processor.
  • the processor may be composed of an integrated circuit (IC).
  • the processor 920 may include only a central processing unit (CPU), or a combination of a GPU, a digital signal processor (DSP), and a control chip (for example, a baseband chip) in the terminal device 900.
  • the CPU may be a single operation core, or may include a multiple operation core.
  • the memory 930 may be used to store software programs and modules, and the processor 920 executes various functional applications and data processing of the terminal device 900 by running the software programs and modules stored in the memory 930.
  • the memory 930 may mainly include a storage program area and a storage data area, where the storage program area may store an operating system, an application program required for at least one function (for example, a sound playback function, an image playback function, etc.), and the like.
  • the storage data area may store data (for example, audio data, image data, phone book, etc.) created according to the use of the terminal device 900.
  • the memory 930 may include volatile memory, such as nonvolatile dynamic random access memory (NVRAM), phase change random access memory (PRAM), and magnetic resistance Random access memory (magetoresistive RAM, MRAM), etc., may also include non-volatile memory, such as one or more disk storage devices, electronically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), flash memory devices, such as NOR flash memory or NAND flash memory.
  • NVRAM nonvolatile dynamic random access memory
  • PRAM phase change random access memory
  • MRAM magnetic resistance Random access memory
  • MRAM magnetic resistance Random access memory
  • non-volatile memory such as one or more disk storage devices, electronically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), flash memory devices, such as NOR flash memory or NAND flash memory.
  • the non-volatile memory stores an operating system and application programs executed by the processor unit. The processor loads the running program and data from
  • the above-mentioned operating system includes various components and / or drivers for controlling and managing general system tasks, such as memory management, storage device control, power management, etc., and facilitating communication between various software and hardware.
  • the operating system may be an Android system of Google, an iOS system developed by Apple, a Windows operating system developed by Microsoft, or the like, or an embedded operating system such as Vxworks.
  • the above applications include any applications installed on the terminal device, including but not limited to browsers, email, instant messaging services, word processing, keyboard virtualization, widgets, encryption, digital rights management, speech recognition, speech Copying, positioning (e.g., functions provided by a global positioning system), music playback, etc.
  • the terminal device involves storage of data, for example, storage of application programs and user data, presetting of certificates of various servers (for example, credential package application server, identity authentication server), and secure storage of CTID. Wait.
  • the input device 940 may be used to implement interaction between a user and a terminal device, and / or input information into the terminal device.
  • the input device 940 may receive numeric or character information input by a user to generate a signal input related to user settings or function control.
  • the input device 940 may be a touch panel 941, or may also be other human-computer interaction interfaces, such as physical input keys, a microphone, or other external information capture devices, such as a camera (FIG. 14 Not shown) and so on.
  • the touch panel is also called a touch screen or a touch screen, and can collect the operation actions that the user touches or approaches.
  • the touch panel may include a touch detection device and a touch controller.
  • the touch detection device detects a user's touch operation, converts the detected touch operation into an electrical signal, and transmits the electrical signal to a touch controller; the touch controller receives the electrical signal from the touch detection device, and It is converted into contact coordinates and sent to the processor 920.
  • the touch controller may also receive a command sent by the processor 920 and execute it.
  • various types such as resistive, capacitive, infrared and surface acoustic wave can be used to implement the touch panel.
  • the physical input keys used by the input device 940 may include, but are not limited to, physical keyboards, function keys (e.g., volume control keys, switch keys, etc.), trackballs, mice, joysticks, etc.
  • function keys e.g., volume control keys, switch keys, etc.
  • trackballs mice, joysticks, etc.
  • An input device in the form of a microphone may collect voices input by a user or the environment and convert them into commands in the form of electrical signals executable by the processor 920.
  • the terminal device 900 may implement interaction with the user through the input device 940.
  • the terminal device may receive a trigger instruction through the touch panel 951, or receive physical identity information manually input by a user through the touch panel 951.
  • a client application CA running in a REE and an electronic ID application running in a TEE or SE collect a user's face image information through a camera.
  • the output device 950 may be used to display information input by the user or information provided to the user and various menus of the terminal device 900, and may also accept user input.
  • the output device 950 includes, but is not limited to, an image output unit and a sound output unit.
  • the image output unit is used to output text, pictures and / or video.
  • the image output unit may include a display panel.
  • the display panel 951 may be in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), a field emission display (FED), or the like.
  • the image output unit may include a reflective display, for example, an electrophoretic display, or a display using an interferometric modulation of light.
  • the image output unit may include a single display or multiple displays of different sizes.
  • the touch panel 941 used by the input device 940 can also be used as the display panel 951 of the output device 950 at the same time. For example, after the touch panel detects a touch or a close gesture operation on the touch panel, it is transmitted to the processor 920 to determine the type of the touch event, and then the processor 920 provides a corresponding vision on the display panel 951 according to the type of the touch event. Output.
  • the input device 940 and the output device 950 are implemented as two separate components to implement the input and output functions of the electronic device, in some embodiments, the touch panel 941 and the display panel 951 may be integrated into one.
  • the image output unit may display various graphical user interfaces (GUIs) as virtual control components, including but not limited to windows, scrolling axes, icons, and scrapbooks, for users to touch by means of Do it.
  • GUIs graphical user interfaces
  • the management interface and the prompt box shown in FIG. 3, FIG. 4, FIG. 5, and / or FIG. 9 in the embodiment of the present application may be displayed by the display panel 951 in the output device 950.
  • the sensors 960 may be one or more.
  • the sensor 960 may include a light sensor, a motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor.
  • the ambient light sensor may adjust the brightness of the display panel 951 according to the brightness of the ambient light.
  • the proximity sensor may close the display panel 951 when the terminal device 900 moves to the ear. And / or backlight.
  • an acceleration sensor can detect the magnitude of acceleration in various directions (usually three axes), and can detect the magnitude and direction of gravity when it is stationary. Games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tap), etc.
  • the terminal device 900 may be configured with other sensors such as a gravity sensor (also referred to as a gravity sensor), a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, which are not described herein again.
  • a gravity sensor also referred to as a gravity sensor
  • a gyroscope also referred to as a barometer
  • a hygrometer a thermometer
  • an infrared sensor and the like
  • the input device and the output device may also be implemented by sensors, and the terminal device may detect the operation of the user on the touch panel 941 by the sensor to receive the trigger instruction.
  • the terminal device 900 may further include an audio circuit 970, which may provide an audio interface between the user and the terminal device 900.
  • the audio circuit 970 may transmit the received converted signal of the audio data to the speaker 971, and the speaker 971 converts the signal into a sound signal and outputs the signal.
  • the microphone 972 converts the collected sound signal into a signal, which is received by the audio circuit 970 and converted into audio data, and then the audio data is output to the transceiver 910 to be sent to another terminal device, or the audio data is output to the processing 920 for further processing.
  • the terminal device 900 also includes a power source 980 (for example, a battery) that supplies power to various components.
  • a power source 980 for example, a battery
  • the power supply 980 may be logically connected to the processor 920 through a power management system, so as to implement functions such as management of charging, discharging, and power consumption through the power management system.
  • the terminal device 900 shown in FIG. 14 may be used to implement the method for upgrading the application scope of the electronic ID card provided by this application, and may also be used to implement the method for applying for an electronic ID card provided by this application.
  • the terminal device 900 detects a user operation through an input device 940 (for example, the touch panel 941) to receive a trigger instruction for requesting to upgrade the service scope of the user's electronic ID card.
  • the input device 940 sends the received trigger instruction to the processor 920.
  • the processor 920 determines whether the terminal device 900 provides a trusted security platform by invoking and running a software program and / or module stored in the memory 930, and determines that the terminal device 900 provides a trusted security platform, and determines the trusted security Whether the platform keeps authentication information of the authentication server.
  • the terminal device In the case that the credible security platform stores the certification information of the identity authentication server, the terminal device generates the upgrade information required for upgrading the service scope of the electronic ID card through the processor 920, and sends the upgrade information through the transceiver 910 To the identity authentication server, so that the identity authentication server upgrades the service scope of the user's electronic ID according to the upgrade information.
  • the terminal device 900 receives the trigger instruction input by the user through the input device 940 (for example, the touch panel 941) to request the user to apply for an electronic ID card with a target service scope.
  • the input device 940 sends the received trigger instruction to the processor 920.
  • the processor 920 determines whether the terminal device 900 provides a trusted security platform by invoking and running a software program and / or module stored in the memory 930, and determines that the terminal device 900 provides a trusted security platform, and determines the trusted security Whether the platform keeps authentication information of the authentication server.
  • the terminal device In the case that the credible and secure platform stores the certification information of the identity authentication server, the terminal device generates, through the processor 920, the application information required for the user to apply for an electronic ID card with a target service application scope, and applies the application through the transceiver 910 The information is sent to the identity authentication server, so that the identity authentication server generates an electronic ID card with a target service scope for the user according to the application information.
  • the terminal device 900 may correspond to the terminal device described in the foregoing method embodiment, and each device and / or device of the terminal device 900 is respectively configured to perform operations and / or processing procedures performed by the terminal device in the foregoing method embodiment.
  • each device and / or device of the terminal device 900 is respectively configured to perform operations and / or processing procedures performed by the terminal device in the foregoing method embodiment.
  • detailed descriptions are omitted.
  • the apparatus 700 shown in FIG. 12 may be the terminal device 900 shown in FIG. 14.
  • the input function of the input-output unit 701 may be implemented by the input device 940 in FIG. 14, and the output function of the input-output unit 701 may be implemented by the output device 950 in FIG. 14.
  • the processing unit 702 may be implemented by the processor 920 in FIG. 14.
  • the transceiver unit 703 may be implemented by the transceiver 910 in FIG. 14.
  • the apparatus 800 shown in FIG. 13 may also be a terminal device 900 shown in FIG. 14.
  • the input function of the input-output unit 801 may be implemented by the input device 940 in FIG. 14, and the output function of the input-output unit 801 may be implemented by the output device 950 in FIG. 14.
  • the processing unit 802 may be implemented by the processor 920 in FIG. 14.
  • the transceiver unit 803 may be implemented by the transceiver 910 in FIG. 14.
  • the device 700 may be a chip arranged in the terminal device 900.
  • the input / output unit 701 and the transceiver unit 703 may be input / output interfaces / input / output circuits on the chip.
  • the processing unit 701 may be a processor of a chip.
  • the terminal device 900 can implement the functions possessed by the terminal device in scenario 1 through the chip, the input device 940, the output device 950, and the transceiver 910.
  • the input device 940 receives a trigger instruction for requesting to upgrade the service scope of the user's electronic ID card, and inputs the trigger instruction to the processor of the chip through the input interface / input circuit of the chip.
  • the processor of the chip After receiving the trigger instruction, the processor of the chip generates upgrade information, and then outputs the upgrade information to the transceiver 910 through the output interface / output circuit, and the transceiver 910 sends the upgrade information to the identity authentication server.
  • the processor of the chip may be independent of the processor 920 in the terminal device, or may also be implemented by the processor 920 in the terminal device.
  • the device 800 may be a chip configured in the terminal device 900.
  • the input / output unit 801 and the transceiver unit 803 may be input / output interfaces / input / output circuits on the chip.
  • the processing unit 801 may be a processor of a chip.
  • the terminal device 900 can implement the functions possessed by the terminal device in scenario 2 through the chip, the input device 940, the output device 950, and the transceiver 910.
  • the input device 940 receives a trigger instruction for requesting an application for an electronic ID card with a target service scope, and inputs the trigger instruction to the processor of the chip through the input interface / input circuit of the chip.
  • the processor of the chip After receiving the trigger instruction, the processor of the chip generates application information, and then outputs the application information to the transceiver 910 through the output interface / output circuit of the chip, and the transceiver 910 sends the application information to the final identity authentication server.
  • the processor of the chip may be independent of the processor 920 in the terminal device, or may also be implemented by the processor 920 in the terminal device.
  • the present application provides a computer-readable storage medium that stores a computer program, and when the computer program is run on a computer, the computer executes the method 100 and the method in any possible implementation manner thereof. The corresponding operation and / or processing performed by the terminal device.
  • the present application provides a computer-readable storage medium.
  • a computer program is stored in the computer-readable storage medium.
  • the computer program runs on a computer, the computer executes the method 500 and any possible implementation method by a terminal. The corresponding operation and / or processing performed by the device.
  • the present application provides a chip including a memory and a processor.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the terminal device installed with the chip executes the method 100 and any possible implementation thereof.
  • the present application provides a chip, including a memory and a processor.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the terminal device installed with the chip executes the method 500 and any possible implementation thereof.
  • the application provides a computer program product.
  • the computer program product includes a computer program.
  • the computer program runs on a computer, the computer causes the computer to perform the corresponding operations performed by the terminal device in the method 100 and any possible implementation methods and And / or processing.
  • the present application provides a computer program product.
  • the computer program product includes a computer program.
  • the computer program runs on a computer, the computer causes the computer to perform the corresponding operations performed by the terminal device in the method 500 and any possible implementation methods and And / or processing.
  • the above computer program may be stored in whole or in part on a storage medium packaged with the processor, or may be partially or fully stored in a memory not packaged with the processor.
  • the devices and methods disclosed in the embodiments provided in this application may also be implemented in other ways.
  • the device embodiments described above are merely schematic.
  • the division of the units is only a logical function division, and there may be another division manner in actual implementation.
  • multiple units or components may be combined or integrated into another system, or some features may be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, which may be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated.
  • the components displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. According to actual needs, some or all of the units may be selected to achieve the objective of the technical solution of this embodiment.
  • the functional units in the embodiments of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of this application is essentially a part that contributes to the existing technology or a part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiments of the present application.
  • the aforementioned storage media include: U disks, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or compact discs, and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Stored Programmes (AREA)

Abstract

本申请提供一种对电子身份证的业务适用范围进行升级的方法，能够以较低的成本对电子身份证的业务适用范围进行升级。该方法包括：终端设备接收触发指令，触发指令用于请求对用户的电子身份证的业务适用范围进行升级；终端设备确定本地提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息；终端设备从身份认证服务器获得基于可信安全平台对电子身份证的业务适用范围进行升级的权限；终端设备生成对电子身份证的业务适用范围进行升级所需的升级信息，并向身份认证服务器发送升级信息，以使身份认证服务器根据升级信息对电子身份证的业务适用范围进行升级。

Description

对电子身份证的业务适用范围进行升级的方法和终端设备
本申请要求于2018年8月3日提交中国国家知识产权局、申请号为201810876556.5、申请名称为“对电子身份证的业务适用范围进行升级的方法和终端设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及终端设备领域，更具体地，涉及一种对电子身份证的适用范围进行升级的方法和终端设备、一种申请电子身份证的方法和终端设备。
背景技术
近年来，在线对用户进行实名认证变得越来越普遍和必不可少，同时对用户身份信息的隐私保护也备受关注。公安部第一研究所搭建的居民可信身份认证(citizen trusted identity,CTID)平台推出身份证网上副本签发系统。基于该身份证网上副本签发系统，可以为每个用户在网上生成一个唯一的身份证网上副本，也可以称为电子身份证。电子身份证不包含任何隐私信息，与实体身份证唯一对应。另外，公安部还建立了一个多因子和多认证模式的可信身份认证系统，便于业务平台(例如，电子商务、金融、电子政务等服务提供商)借助用户的电子身份证，结合人脸图像、指纹等信息，完成对用户的“实名+实人+实证”的真实身份认证。例如，用户可以使用电子身份证办理酒店入住、车票购买等业务场景中的身份认证。
但是，由于电子身份证的使用正处于起步和探索的阶段，其业务适用范围仍然非常有限。例如，目前电子身份证仅适用于用户之间的社交、网吧、酒店入住以及车票购买等简单场景下的实名认证。如果想要扩大电子身份证的业务适用范围，例如，将电子身份证用于政务办理、工商注册登记等，目前有一种实现是由公安部在固定网点部署可信受理终端，用户通过这些可信受理终端对电子身份证的业务适用范围进行升级。而在固定网点部署可信受理终端，部署成本高，而且用户使用也不方便。
发明内容
本申请提供一种对电子身份证的业务适用范围进行升级的方法和终端设备、一种申请电子身份证的方法和终端设备，通过利用终端设备上逐渐成熟的可信安全平台，能够以较低的成本对电子身份证的业务适用范围进行升级，或直接为用户申请具有较大业务适用范围的电子身份证。
第一方面，提供了一种对电子身份证的业务适用范围进行升级的方法，该方法包括：终端设备接收触发指令，触发指令用于请求对用户的电子身份证的业务适用范围进行升级；终端设备确定终端设备提供可信安全平台，并确定该可信安全平台保存有 身份认证服务器的证明信息；终端设备从身份认证服务器获得基于可信安全平台对电子身份证的业务适用范围进行升级的权限；终端设备生成对电子身份证的业务适用范围进行升级所需的升级信息，并向身份认证服务器发送升级信息，以使身份认证服务器根据升级信息对电子身份证的业务适用范围进行升级。
本申请的技术方案，终端设备通过从身份认证服务器申请得到基于终端设备提供的可信安全平台对用户的电子身份证的业务适用范围进行升级的权限，从而可以基于该可信安全平台对用户的电子身份证的业务适用范围进行升级。一方面，可以免去为了对用户的电子身份证的业务适用范围进行升级而专门部署可信受理终端的成本，降低电子身份证的推广难度。另一方面，用户不再需要前往固定网点部署的可信受理终端办理电子身份证的业务适用范围的升级，而是通过操作终端设备(例如，手机)完成对自己的电子身份证的业务适用范围进行升级，可以为用户提供方便。
结合第一方面，在第一方面的某些实现方式中，终端设备确定可信安全平台保存有身份认证服务器的证明信息之前，该方法还包括：终端设备确定可信安全平台中存在电子身份证应用；或者终端设备在确定可信安全平台中不存在电子身份证应用的情况下，下载并安装电子身份证应用到该可信安全平台中。
结合第一方面，在第一方面的某些实现方式中，可信安全平台为可信执行环境TEE，电子身份证应用为TEE中的可信应用TA，或者，可信安全平台为安全单元SE，电子身份证应用为SE中的安全应用。
结合第一方面，在第一方面的某些实现方式中，升级信息包括用户的人脸图像信息和实体身份证信息，终端设备生成对电子身份证的业务适用范围进行升级所需的升级信息，并向身份认证服务器发送所述升级信息，包括：终端设备通过REE中的客户端应用CA生成升级信息，并通过CA向身份认证服务器发送该升级信息，其中，升级信息中的至少一项信息是CA从电子身份证应用获取的；或者，终端设备通过CA请求电子身份证应用生成升级信息，并由电子身份证应用向身份认证服务器发送该升级信息。
结合第一方面，在第一方面的某些实现方式中，升级信息还包括签名信息，签名信息是电子身份证应用使用可信安全平台的密钥对人脸图像信息和实体身份证信息中的至少一项进行签名处理得到的信息。
结合第一方面，在第一方面的某些实现方式中，升级信息还包括电子身份证信息，或者，升级信息还包括电子身份证信息和电子身份证信息对应的业务适用范围的标识信息。
结合第一方面，在第一方面的某些实现方式中，升级信息是使用身份认证服务器的密钥进行加密处理后的信息。
结合第一方面，在第一方面的某些实现方式中，终端设备确定可信安全平台保存有身份认证服务器的证明信息，包括：终端设备通过REE中的CA向可信安全平台发送查询命令，查询命令用于请求查询可信安全平台是否保存有身份认证服务器的证明信息，查询命令中携带能够表征身份认证服务器的身份的信息；终端设备通过CA从可信安全平台接收查询成功响应，查询成功响应用于指示可信安全平台保存有身份认证服务器的证明信息。
结合第一方面，在第一方面的某些实现方式中，查询成功响应中携带能够指示可信安全平台的证书的信息，以及，终端设备从身份认证服务器获得基于可信安全平台对电子身份证的业务适用范围进行升级的权限，包括：终端设备向身份认证服务器发送本地升级授权请求，本地升级授权请求中携带能够指示可信安全平台的证书的信息；终端设备接收身份认证服务器返回的授权应答消息，授权应答消息用于指示身份认证服务器允许基于可信安全平台对电子身份证的业务适用范围进行升级。
结合第一方面，在第一方面的某些实现方式中，终端设备向身份认证服务器发送本地升级授权请求，包括：终端设备通过CA向身份认证服务器发送本地升级授权请求；以及，终端设备接收身份认证服务器返回的授权应答消息，包括：终端设备通过CA接收身份认证服务器返回的授权应答消息；或者，终端设备向身份认证服务器发送本地升级授权请求，包括：终端设备通过电子身份证应用向身份认证服务器发送本地升级授权请求；以及，终端设备接收身份认证服务器返回的授权应答消息，包括：终端设备通过电子身份证应用从身份认证服务器接收授权应答消息。
结合第一方面，在第一方面的某些实现方式中，本地升级授权请求中还携带随机数和随机数的签名，随机数的签名是可信安全平台使用可信安全平台的密钥对随机数进行签名运算得到的，其中，随机数是可信安全平台生成的，或者是CA通过查询命令发送给可信安全平台的。
结合第一方面，在第一方面的某些实现方式中，该能够指示可信安全平台的证书的信息、随机数和随机数的签名中的至少一项是使用身份认证服务器的密钥进行加密处理后的信息。
第二方面，提供了一种申请电子身份证的方法，终端设备接收触发指令，触发指令用于请求为用户申请具有目标业务适用范围的电子身份证，其中，业务适用范围用于指定电子身份证能够适用的业务；终端设备确定该终端设备提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息；终端设备从身份认证服务器获得基于可信安全平台为用户申请具有目标业务适用范围的电子身份证的权限；终端设备生成申请具有目标业务适用范围的电子身份证所需的申请信息，并向身份认证服务器发送申请信息，以使所述身份认证服务器根据申请信息为该用户生成具有目标业务适用范围的电子身份证。
本申请的技术方案，终端设备通过从身份认证服务器申请得到基于终端设备提供的可信安全平台为用户申请具有目标业务适用范围的电子身份证的权限，进而可以基于该可信安全平台为用户申请具有目标业务适用范围的电子身份证。这样，使用具有可信安全平台的终端设备的用户可以直接申请得到一个具有较大的业务适用范围的电子身份证，为用户带来方便。
结合第二方面，在第二方面的某些实现方式中，终端设备确定所述可信安全平台保存有身份认证服务器的证明信息之前，该方法还包括：终端设备确定可信安全平台中存在电子身份证应用；或者终端设备在确定可信安全平台中不存在电子身份证应用的情况下，下载并安装电子身份证应用到该可信安全平台中。
结合第二方面，在第二方面的某些实现方式中，该可信安全平台为可信执行环境TEE，电子身份证应用为TEE中的可信应用TA，或者，该可信安全平台为安全单元 SE，电子身份证应用为SE中的安全应用。
结合第二方面，在第二方面的某些实现方式中，该申请信息包括用户的人脸图像信息和实体身份证信息，终端设备生成申请具有目标业务适用范围的电子身份证所需的申请信息，并向身份认证服务器发送申请信息，包括：终端设备通过REE中的客户端应用CA生成申请信息，并通过CA向身份认证服务器发送申请信息，其中，申请信息中的至少一项信息是CA从电子身份证应用获取的；或者，终端设备通过CA请求电子身份证应用生成申请信息，并由电子身份证应用向身份认证服务器发送申请信息。
结合第二方面，在第二方面的某些实现方式中，申请信息还包括签名信息，签名信息是电子身份证应用使用可信安全平台的密钥对人脸图像信息和实体身份证信息中的至少一项进行签名处理得到的信息。
结合第二方面，在第二方面的某些实现方式中，申请信息还包括目标业务适用范围的标识信息。
结合第二方面，在第二方面的某些实现方式中，申请信息是使用身份认证服务器的密钥进行加密处理后的信息。
结合第二方面，在第二方面的某些实现方式中，终端设备确定可信安全平台保存有身份认证服务器的证明信息，包括：终端设备通过REE中的CA向可信安全平台发送查询命令，查询命令用于请求查询可信安全平台是否保存有身份认证服务器的证明信息，查询命令中携带能够表征身份认证服务器的身份的信息；终端设备通过CA从可信安全平台接收查询成功响应，查询成功响应用于指示可信安全平台保存有身份认证服务器的证明信息。
结合第二方面，在第二方面的某些实现方式中，查询成功响应中还携带能够指示可信安全平台的证书的信息，以及，终端设备从身份认证服务器获得基于可信安全平台为该用户申请具有目标业务的电子身份证的权限，包括：终端设备向身份认证服务器发送本地申请授权请求，本地申请授权请求中携带能够指示可信安全平台的证书的信息；终端设备接收身份认证服务器返回的授权应答消息，授权应答消息用于指示身份认证服务器允许基于可信安全平台为该用户申请具有目标业务适用范围的电子身份证。
结合第二方面，在第二方面的某些实现方式中，终端设备向身份认证服务器发送本地申请授权请求，包括：终端设备通过CA向身份认证服务器发送本地申请授权请求；以及，终端设备接收身份认证服务器返回的授权应答消息，包括：终端设备通过CA接收身份认证服务器返回的授权应答消息；或者，终端设备向身份认证服务器发送本地申请授权请求，包括：终端设备通过电子身份证应用向身份认证服务器发送本地申请授权请求；以及，终端设备接收身份认证服务器返回的授权应答消息，包括：终端设备通过电子身份证应用从身份认证服务器接收授权应答消息。
结合第二方面，在第二方面的某些实现方式中，本地申请授权请求中还携带随机数和随机数的签名，随机数的签名是可信安全平台使用可信安全平台的密钥对随机数进行签名运算得到的，其中，随机数是可信安全平台生成的，或者是CA通过查询命令发送给可信安全平台的。
结合第二方面，在第二方面的某些实现方式中，该能够指示可信安全平台的证书的信息、随机数和随机数的签名中的至少一项是使用身份认证服务器的密钥进行加密处理后的信息。
结合第二方面，在第二方面的某些实现方式中，在终端设备接收触发指令之后，该方法还包括：终端设备确定用户未开通电子身份证。
第三方面，本申请提供一种对电子身份证的业务适用范围进行升级的装置，该装置具有实现上述第一方面或第一方面的任意可能的实现方式的方法中终端设备的功能。这些功能可以通过硬件实现，或者也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与这些功能相对应的单元。
可选地，第三方面所述的对电子身份证的业务适用范围进行升级的装置可以是终端设备，或者，也可以是配置在终端设备中的芯片。
第四方面，本申请提供一种申请电子身份证的装置，该装置具有实现上述第二方面或第二方面的任意可能的实现方式的方法中终端设备的功能。这些功能可以通过硬件实现，或者也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与这些功能相对应的单元。
可选地，第四方面所述的申请电子身份证的装置可以是终端设备，或者也可以是配置在终端设备中的芯片。
第五方面，本申请提供一种终端设备，包括：输入输出设备，用于接收触发指令，触发指令用于请求对用户的电子身份证的业务适用范围进行升级；处理器，用于在输入输出设备接收到触发指令的情况下确定终端设备提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息；处理器，还用于在确定可信安全平台保存有所述身份认证服务器的证明信息的情况下，从身份认证服务器获得基于可信安全平台对电子身份证的业务适用范围进行升级的权限；处理器，还用于生成对电子身份证的业务适用范围进行升级所需的升级信息；收发器，用于将处理器生成的升级信息发送给身份认证服务器，以使身份认证服务器根据升级信息对电子身份证的业务适用范围进行升级。
结合第五方面，在第五方面的某些实现方式中，处理器在确定可信安全平台保存有身份认证服务器的证明信息之前，还用于确定可信安全平台中存在电子身份证应用；或者，处理器在确定可信安全平台中不存在电子身份证应用的情况下，还用于下载并安装电子身份证应用到可信安全平台中。
结合第五方面，在第五方面的某些实现方式中，可信安全平台为可信执行环境TEE，电子身份证应用为TEE中的可信应用TA，或者，可信安全平台为安全单元SE，电子身份证应用为SE中的安全应用。
结合第五方面，在第五方面的某些实现方式中，升级信息包括用户的人脸图像信息和实体身份证信息，处理器用于通过REE中的客户端应用CA生成所述升级信息；收发器用于将所述CA生成的升级信息发送给身份认证服务器，升级信息中的至少一项信息是CA从电子身份证应用获取的；或者，处理器用于通过CA请求电子身份证应用生成升级信息；收发器用于将电子身份证应用生成的升级信息发送给身份认证服务器。
结合第五方面，在第五方面的某些实现方式中，升级信息还包括签名信息，签名信息是电子身份证应用使用可信安全平台的密钥对人脸图像信息和实体身份证信息中的至少一项进行签名处理得到的信息。
结合第五方面，在第五方面的某些实现方式中，升级信息还包括电子身份证信息，或者，升级信息还包括电子身份证信息和电子身份证信息对应的业务适用范围的标识信息。
结合第五方面，在第五方面的某些实现方式中，升级信息是使用身份认证服务器的密钥进行加密处理后的信息。
结合第五方面，在第五方面的某些实现方式中，处理器用于通过REE中的CA向可信安全平台发送查询命令，查询命令用于请求查询可信安全平台是否保存有身份认证服务器的证明信息，查询命令中携带能够表征身份认证服务器的身份的信息；处理器还用于通过CA从可信安全平台接收查询成功响应，查询成功响应用于指示可信安全平台保存有身份认证服务器的证明信息。
结合第五方面，在第五方面的某些实现方式中，查询成功响应中携带能够指示可信安全平台的证书的信息，以及，收发器，用于向身份认证服务器发送本地升级授权请求，本地升级授权请求中携带能够指示可信安全平台的证书的信息；收发器，还用于接收身份认证服务器返回的授权应答消息，授权应答消息用于指示身份认证服务器允许基于可信安全平台对电子身份证的所述业务适用范围进行升级。
结合第五方面，在第五方面的某些实现方式中，收发器通过CA向身份认证服务器发送本地升级授权请求，并通过CA接收身份认证服务器返回的授权应答消息；或者，收发器通过电子身份证应用向身份认证服务器发送本地升级授权请求，并通过电子身份证应用从身份认证服务器接收授权应答消息。
结合第五方面，在第五方面的某些实现方式中，本地升级授权请求中还携带随机数和随机数的签名，随机数的签名是可信安全平台使用可信安全平台的密钥对随机数进行签名运算得到的，其中，随机数是所述可信安全平台生成的，或者是CA通过查询命令发送给可信安全平台的。
结合第五方面，在第五方面的某些实现方式中，能够指示可信安全平台的证书的信息、随机数和随机数的签名中的至少一项是使用身份认证服务器的密钥进行加密处理后的信息。
或者，本申请提供的终端设备包括存储器、处理器和输入输出设备，输入输出设备用于检测用户操作以接收触发指令，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，使得终端设备执行上述第一方面及其第一方面任意可能的实现方式中的方法。
第六方面，本申请提供一种终端设备，包括：输入输出设备，用于接收触发指令，触发指令用于请求为用户申请具有目标业务适用范围的电子身份证，其中，业务适用范围用于指定电子身份证能够适用的业务；处理器，用于在输入输出设备接收到触发指令的情况下确定终端设备提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息；处理器，还用于从身份认证服务器获得基于可信安全平台为用户申请具有目标业务适用范围的电子身份证的权限；处理器，还用于生成申请具有目标 业务适用范围的电子身份证所需的申请信息；收发器，还用于向身份认证服务器发送申请信息，以使身份认证服务器根据申请信息为用户生成具有目标业务适用范围的电子身份证。
结合第六方面，在第六方面的某些实现方式中，处理器还用于在确定可信安全平台保存有身份认证服务器的证明信息之前，确定可信安全平台中存在电子身份证应用；或者，处理器还用于在确定可信安全平台中不存在电子身份证应用的情况下，下载并安装电子身份证应用到可信安全平台中。
结合第六方面，在第六方面的某些实现方式中，可信安全平台为可信执行环境TEE，电子身份证应用为TEE中的可信应用TA，或者，可信安全平台为安全单元SE，电子身份证应用为SE中的安全应用。
结合第六方面，在第六方面的某些实现方式中，申请信息包括用户的人脸图像信息和实体身份证信息，处理器用于通过富执行环境REE中的客户端应用CA生成所述申请信息；收发器用于将CA生成的申请信息发送给身份认证服务器，申请信息中的至少一项信息是CA从电子身份证应用获取的；或者，处理器用于通过CA请求电子身份证应用生成申请信息；收发器用于将电子身份证应用生成的申请信息发送给身份认证服务器。
结合第六方面，在第六方面的某些实现方式中，申请信息还包括签名信息，签名信息是电子身份证应用使用可信安全平台的密钥对人脸图像信息和实体身份证信息中的至少一项进行签名处理得到的信息。
结合第六方面，在第六方面的某些实现方式中，申请信息还包括目标业务适用范围的标识信息。
结合第六方面，在第六方面的某些实现方式中，申请信息是使用身份认证服务器的密钥进行加密处理后的信息。
结合第六方面，在第六方面的某些实现方式中，处理器用于通过REE中的CA向可信安全平台发送查询命令，查询命令用于请求查询可信安全平台是否保存有身份认证服务器的证明信息，查询命令中携带能够表征身份认证服务器的身份的信息；处理器还用于通过CA从可信安全平台接收查询成功响应，查询成功响应用于指示可信安全平台保存有身份认证服务器的证明信息。
结合第六方面，在第六方面的某些实现方式中，查询成功响应中携带能够指示可信安全平台的证书的信息，收发器用于向身份认证服务器发送本地申请授权请求，本地申请授权请求中携带能够指示所述可信安全平台的证书的信息；以及，收发器还用于接收身份认证服务器返回的授权应答消息，授权应答消息用于指示身份认证服务器允许基于可信安全平台为用户申请具有目标业务适用范围的电子身份证。
结合第六方面，在第六方面的某些实现方式中，收发器用于通过CA向身份认证服务器发送本地申请授权请求，并通过CA接收身份认证服务器返回的授权应答消息；或者，收发器用于通过电子身份证应用向身份认证服务器发送本地申请授权请求，并通过电子身份证应用从身份认证服务器接收授权应答消息。
结合第六方面，在第六方面的某些实现方式中，本地申请授权请求中还携带随机数和随机数的签名，随机数的签名是可信安全平台使用可信安全平台的密钥对随机数 进行签名运算得到的，其中，随机数是可信安全平台生成的，或者是CA通过查询命令发送给可信安全平台的。
结合第六方面，在第六方面的某些实现方式中，该能够指示可信安全平台的证书的信息、随机数和随机数的签名中的至少一项是使用身份认证服务器的密钥进行加密处理后的信息。
或者，本申请提供的终端设备包括存储器、处理器和输入输出设备，输入输出设备用于检测用户操作以接收触发指令，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，使得终端设备执行上述第二方面及其第二方面任意可能的实现方式中的方法。
可选地，终端设备还可以包括收发器，用于实现终端设备和身份认证服务器、证件包应用服务器之间的交互。
可选地，输入输出设备可以为一个或多个传感器。当传感器有多个时，不同的传感器可用于检测不同的用户操作，或者，多个不同的传感器也可用于检测相同的用户操作。
可选地，以上终端设备中的存储器可以为一个或多个，处理器也可以为一个或多个。
第七方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，当该计算机程序在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意可能的实现方式中的方法。
第八方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当该计算机程序在计算机上运行时，使得计算机执行上述第二方面或第二方面的任意可能的实现方式中的方法。
第九方面，本申请提供一种芯片，包括存储器和处理器，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片的终端设备执行上述第一方面及其第一方面的任意可能的实现方式中的方法。
第十方面，本申请提供一种芯片，包括存储器和处理器，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片的终端设备执行上述第二方面及其第二方面的任意可能的实现方式中的方法。
可选地，该存储器可以为一个或多个。该处理器可以为一个或多个。
可选的，上述的存储器与存储器可以是物理上相互独立的单元，或者，存储器也可以和处理器集成在一起。
第十一方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序，当该计算机程序在计算机上运行时，使得计算机执行上述第一方面及其任意一种可能的实现方式中的方法。
第十二方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序，当该计算机程序在计算机上运行时，使得计算机执行上述第二方面及其第二方面任意一种可能的实现方式中的方法。
可选地，上述计算机程序可以全部或部分存储在与处理器封装在一起的存储介质上，也可以部分或全部存储在不与处理器封装在一起的存储器上。
本申请的技术方案，终端设备通过从身份认证服务器申请得到基于终端设备提供的可信安全平台对用户的电子身份证的业务适用范围进行升级或基于该可信安全平台为用户申请具有目标业务适用范围的电子身份证的权限，从而可以基于该可信安全平台对用户的电子身份证的业务适用范围进行升级，或直接为用户申请具有较大的业务适用范围的电子身份证。一方面，可以免去为了对用户的电子身份证的业务适用范围进行升级而专门部署可信受理终端的成本。另一方面，用户不再需要前往固定网点部署的可信受理终端办理电子身份证的业务适用范围的升级，而是通过操作终端设备(例如，手机)就完成对自己的电子身份证的业务适用范围进行升级。对于不具有电子身份证的用户而言，通过终端设备上的可信安全平台，可以直接申请得到具有较大的业务适用范围的电子身份证，从而能够为用户提供方便。
附图说明
图1是本申请提出的对电子身份证的业务适用范围进行升级的方法流程图。
图2是基于终端设备上的可信安全平台对电子身份证的业务适用范围进行升级的示意图。
图3是对电子身份证进行管理操作的用户界面UI示意图。
图4是用户界面UI上实现提示框的示意图。
图5是对电子身份证进行管理操作的另一个用户界面UI示意图。
图6是终端设备查询可信安全平台是否保存有身份认证服务器的证明信息的示意图。
图7是终端设备向身份认证服务器申请基于可信安全平台对电子身份证的业务适用范围进行升级的权限的示意图。
图8是终端设备生成升级信息并向身份认证服务器发送升级信息的示意图。
图9是对电子身份证进行管理操作的又一用户界面UI示意图。
图10是本申请提出的申请电子身份证的方法流程图。
图11是本申请提出的终端设备基于可信安全平台申请电子身份证的示意图。
图12是本申请提出的对电子身份证的业务适用范围进行升级的装置700的示意性框图。
图13是本申请提出的申请电子身份证的装置800的示意性框图。
图14是适用于本申请实施例的终端设备900的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请的技术方案，适用于对用户的电子身份证的业务适用范围进行升级的场景或者，也可以适用于为没有电子身份证的用户直接申请一个具有较大业务适用范围的电子身份证的场景。其中，业务适用范围是指电子身份证能够适用的业务的范围。例如，电子身份证能够适用的业务可以包括酒店入住、车票购买、社交类软件的实名登记、证券开户、政务办理、工商注册登记等。如果一个电子身份证所能适用的业务越 多，表明这个电子身份证的业务适用范围越大。反之，则表明这个电子身份证的业务适用范围越小。
需要说明的是，在本申请中，业务适用范围可以是分级的，例如，分为初级版和增强版这两个等级，将酒店入住、车票购买、网吧实名等这类业务纳入初级版的范围，将政务办理、工商注册、远程开户等这类业务纳入增强版的范围。又例如，将业务适用范围分为低、中、高三个等级，或者分为第一等级、第二等级、第三等级……等多个等级。这里所说的等级可以理解成高等级对应的业务适用范围覆盖低等级对应的业务适用范围。另外，本申请还可以包括其他划分业务适用范围的方式，例如按照业务类型分级，将衣食住行穿这些基本需求涉及的支付、注册等业务认为是I类，将交友、娱乐等需求涉及的认证业务认为是II类，将政务、工商等需求涉及的认证业务认为是III类等。用户在申请开通电子身份证时，或者，请求对已开通的电子身份证进行升级时，可以根据这些类别向身份认证服务器提出申请，如在申请开通时明确业务适用范围包括I类和II类，或者，在请求升级时明确新的业务使用范围包括III类等等。
如果电子身份证的业务适用范围较小，用户使用它所能办理的业务将是有限的。例如，电子身份证只能用于办理酒店入住、车票购买等相对简单的业务。而如果用户想将电子身份证用于政务办理、工行注册登记等业务，需要到公安部在固定网点部署的可信受理终端上进行办理。部署可信受理终端的成本是比较高的，而且对于用户而言也不方便。
为此，本申请提出一种对电子身份证的业务适用范围进行升级的方法，和一种为用户直接申请具有较大的业务适用范围的电子身份证的方法。该方法可以免去部署可信受理终端的成本，能够通过终端设备本地提供的可信安全平台，完成对用户的电子身份证的业务适用范围的升级，或者，可以为没有电子身份证的用户直接申请具有较大的业务适用范围的电子身份证，为用户带来方便。
本申请中涉及的终端设备可以是任何移动或便携式电子设备，包括但不限于移动电话、移动电脑、平板电脑、个人数字助理(personal digital assistant,PDA)、可穿戴式设备(wearable device)，或者是以上任意两项或两项以上的组合。
本申请中涉及到终端设备上的可信安全平台，该可信安全平台可以是终端设备上的可信执行环境(trusted execution environment,TEE)或安全单元(secure element,SE)。其中SE的物理载体可以是嵌入式安全单元(embedded SE)、安全数字内存卡(Secure Digital Memory Card,SD卡)、通用集成电路卡(universal integrated circuit card,UICC)等。这里所说的可信安全平台可以认为是终端设备的一部分，也可以认为是终端设备之外的独立模块，例如，可以是从终端设备上移除或可插拔的硬件部分。
其中，TEE是相对富执行环境(rich execution environment,REE)而言的。REE是终端设备上针对多功能性和丰富性创建的开放环境，运行着终端设备的操作系统(例如，Android OS,IOS)，可以在设备生产以后向第三方开放下载。TEE是全球平台(global platform,GP)组织针对智能移动终端的REE提出的概念，是一个与REE并存但相互孤立的运行环境。TEE中运行可信操作系统(trusted operating systems,Trusted OS)，能为REE中运行的操作系统(也即,Rich OS)提供安全服务。可通过一组硬件和软件的组合，保证各种敏感数据在TEE中安全传输、存储、处理，保证TA执行的机密性、 完整性和数据访问权限端到端的安全。由于TEE具有自身的执行空间，其安全级别要高于Rich OS。而上述SE的安全性高于TEE。
TEE中运行的是一系列的可信应用(trusted application，TA)，由于TEE可以为这些TA提供安全服务，例如，应用执行的完整性、安全存储、与输入输出设备的安全交互、密钥管理、加密算法、与REE中客户端应用(client application，CA)安全通信等，因此，TA不同于REE中的CA，TA是可信应用，而CA是普通应用或一般应用。另外，TA运行在TEE中，能为REE中的CA或TEE中的其它TA提供安全相关服务的应用。CA运行在REE中，可通过TEE的客户端应用程序访问接口(application programming interface,API)，也即，REE访问TEE的接口，来调用或访问TEE中的TA。
下面分别针对电子身份证的业务适用范围进行升级的场景(以下记作场景一)和直接为用户申请具有较大的业务适用范围的电子身份证的场景(以下记作场景二)作详细说明。
在本申请实施例中，可能会涉及到终端设备上的证件包应用、客户端应用CA以及电子身份证应用。其中，证件包应用可以是终端设备(例如，手机)的REE侧的应用，如支付宝、微信、华为钱包等应用，可用于容纳与管理电子身份证应用。电子身份证应用可以是终端设备的可信执行环境TEE或安全单元SE侧的应用。客户端应用CA是在REE侧与电子身份证应用对应的、可以与TTE侧或SE侧的电子身份证应用交互通信的应用。以TEE为例，客户端应用CA可通过TEE客户端应用程序访问接口(application programming interface,API)，也即TEE Client API进行通信。以SE为例，客户端应用CA可以通过SE访问接口(SE Access API，例如，Open Mobile API)进行通信。
证件包应用可通过该客户端应用CA实现对电子身份证应用的管理(例如，开通/申请、升级、注销/删除等)。REE侧的客户端应用CA和TEE/SE侧的电子身份证应用都可以由电子身份证服务商提供。
另外，本申请实施例中还可能涉及到证件包应用服务器(记作S1)、可信安全平台服务器(记作S2)、身份认证服务器(记作S3)。其中，S2是向可信安全平台下发证书(例如，可信安全平台的公钥证书等)的一方，也可以通过S2为电子身份证服务商向可信安全平台中下载电子身份证应用或电子身份证应用相关的数据。
场景一
参见图1，图1是本申请提出的对电子身份证的业务适用范围进行升级的方法流程图。
图1所示的技术方案的前提可以是，终端设备上的可信安全平台(或者说是可信安全平台服务器)与身份认证服务器互相预置对方的证明信息(例如，证书)，例如，身份认证服务器预存有可信安全平台的证书信息，可信安全平台(确切地可以是电子身份证应用)预存有身份认证服务器的证书信息。另外，若可信安全平台需要通过可信安全平台服务器与身份认证服务器交互信息，则可信安全平台和身份认证服务器可能还预存可信安全平台服务器的证书信息。若可信安全平台上的电子身份证应用需要通过证件包应用和证件包应用服务器与身份认证服务器平台交互信息，本申请的技术 方案的前提还可以是，可信安全平台预先存储有证件包应用服务器的证书信息、身份认证服务器的证书信息(可选的)，证件包应用服务器预先存储有可信安全平台证书信息、身份认证服务器的证书信息，身份认证服务器预先存储有证件包应用服务器的证书信息、可信安全平台的证书信息(可选的)。以上前提下，每个主体可能都还预存有认证中心(certification authority，CA)的根证书，上述的证书信息可以是公钥证书(由认证中心颁发的证书)。
110、终端设备接收触发指令。
触发指令用于请求对用户的电子身份证的业务适用范围进行升级。
一个电子身份证的业务适用范围用于指定该电子身份证所能适用的业务。本申请中所述的业务可以包括酒店入住、车票购买、用户之间社交、网吧登记、政务办理、证券开户以及工商注册登记等使用电子身份证可以办理的业务。其中，电子身份证的不同业务适用范围所能办理的业务不同。例如，如果一个用户申请的电子身份证仅能办理酒店入住、车票购买、用户之间社交和网吧登记一些基础业务，那么这个电子身份证的业务适用范围较小。而如果这个电子身份证除了可以办理这些基础业务，还可以办理政务办理、证券开户以及工商注册登记等业务，那么这个电子身份证的业务适用范围较大。
随着电子身份证的不断推广和普及，电子身份证的业务适用范围可能会不断扩大。因此，用户的电子身份证的业务适用范围也可能随之需要升级，以申请到一个更大的业务适用范围。
本申请实施例中，触发指令可以是用户通过终端设备的触控屏、语音等形式输入的。例如，证件包应用或客户端应用CA通过用户界面(user interface，UI)向用户提供可触发对已开通的电子身份证进行升级的入口，该入口可以以按钮等形式实现。当然，也可以通过可信安全平台内的电子身份证应用提供的UI向用户提供进行升级操作的入口。
120、终端设备基于触发指令，确定终端设备提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息。
在本申请实施例中，身份认证服务器的证明信息用于表明身份认证服务器的可信身份，例如，证明信息可以是身份认证服务器的证书。
上文已经提到，本申请中涉及的可信安全平台可以是TEE或SE。因此，在步骤120中，基于触发指令，终端设备确定终端设备本地是否存在TEE或SE。如果终端设备确定本地存在TEE和/或SE，终端设备进一步确定TEE或SE中是否存在电子身份证应用。如果可信安全平台为TEE，这里的电子身份证应用是指运行在TEE中的TA。如果可信安全平台为SE，这里的电子身份证应用是指运行在SE中的安全应用applet。
当然，如果终端设备同时提供TEE和SE，终端设备可以按照预设程序，首先检测终端设备是否提供TEE，在终端设备提供TEE的情况下，不再继续检测是否提供SE。只有在终端设备不提供TEE的情况下，再进一步判断终端设备是否提供SE。或者，终端设备也可以默认先判断终端设备是否提供SE，在不提供SE的情况下，再判断是否提供TEE。
进一步地，在终端设备本地提供可信安全平台(即，TEE或SE)或该可信安全平 台中存在电子身份证应用的情况下，终端设备需要确定可信安全平台是否保存有身份认证服务器的证明信息。
以终端设备上提供的可信安全平台为TEE为例，终端设备上运行在REE中的CA向运行在TEE中的电子身份证应用(具体为TA)发送查询命令，查询命令用于查询电子身份证应用是否保存有身份认证服务器的证明信息。电子身份证应用在确定保存有身份认证服务器的证明信息的情况下，向CA返回查询成功结果，查询成功结果用于指示可信安全平台保存有身份认证服务器的证明信息。CA获取到该查询成功结果，终端设备也就确定了可信安全平台上保存有身份认证服务器的证明信息。
终端设备提供的可信安全平台为SE的情况下，与可信安全平台为TTE类似。CA将查询命令发送给SE中的安全程序applet。applet在保存有身份认证服务器的证明信息的情况下，向CA返回查询成功响应。这样，终端设备也可以确定可信安全平台保存有身份认证服务器的证明信息。
130、终端设备从身份认证服务器获得基于该可信安全平台对电子身份证的业务适用范围进行升级的权限。
终端设备在确定可信安全平台保存有身份认证服务器的证明信息的情况下，向身份认证服务器申请基于可信安全平台对电子身份证的业务适用范围进行升级的权限。在得到身份认证服务器的许可之后，终端设备就获得了基于本地的可信安全平台对用户的电子身份证的业务适用范围进行升级的权限。
具体地，终端设备向身份认证服务器申请基于可信安全平台对电子身份证的业务适用范围进行升级的权限，有多种可行的方案。例如，通过步骤120，终端设备上运行在REE中的CA从电子身份证应用接收到查询成功响应，查询成功响应中携带能够指示可信安全平台的证书的信息。CA接收到查询成功响应之后，向身份认证服务器发送本地升级授权请求，本地升级授权请求用于请求基于终端设备提供的可信安全平台对电子身份证的适用范围进行升级，其中，本地升级授权请求中携带该能够指示可信安全平台的证书信息，以便身份认证服务器对可信安全平台进行验证。如果验证通过，身份认证服务器将同意基于终端设备提供的可信安全平台对电子身份证的业务适用范围进行升级。又例如，也可以通过终端设备上运行在TEE中的电子身份证应用向身份认证服务器发送本地升级授权请求，以请求获得基于可信安全平台对电子身份证的业务适用范围进行升级的权限。或者，终端设备还可以在确定终端设备提供可信安全平台之后，通过证件包应用服务器向身份认证服务器申请基于可信安全平台对电子身份证的业务适用范围进行升级的权限。对于终端设备从身份认证服务器获取基于可信安全平台对电子身份证的业务适用范围进行升级的权限的多种方案，下文会进行详细介绍。
140、终端设备向身份认证服务器发送对用户的电子身份证的业务适用范围进行升级所需的升级信息，以使身份认证服务器根据升级信息对用户的电子身份证的适用范围进行升级。
其中，升级信息用于身份认证服务器对用户的电子身份证的业务适用范围进行升级。升级信息至少包括用户的人脸图像信息和实体身份证信息。关于身份认证服务器根据升级信息对用户的电子身份证进行升级的过程，下文会作详细介绍。
在本申请的技术方案中，终端设备基于终端设备上提供的可信安全平台，例如TEE或SE，对电子身份证的业务适用范围进行升级，而不再需要借助于固定网点部署的可信受理终端，可以免去部署可信受理终端的成本，同时，也可以为用户带来方便。
上面图1是从终端设备的角度对基于可信安全平台对电子身份证的业务适用范围进行升级的过程进行说明，下面图2将从终端设备内部实现的角度进行说明。
参见图2，图2是本申请提出的基于终端设备上的可信安全平台对电子身份证的业务适用范围进行升级的流程图。
图2所示的技术方案可能基于的前提，如上述图1所示的技术方案，这里不再赘述。
201、终端设备通过REE中的客户端应用CA接收触发指令，触发指令用于请求对用户的电子身份证的业务适用范围进行升级。
终端设备基于REE中的CA接收触发指令，即就是CA接收触发指令。
如上文所述，客户端应用CA可以容纳在证件包应用中。CA为用户管理电子身份证提供一个入口。参见图3，图3是对电子身份证进行管理操作的用户界面UI示意图。
终端设备通过检测用户的“点击”、“触摸”等操作启动CA，进入电子身份证的管理界面。进入管理界面之后，管理界面可以提示用户选择需要办理的业务。例如，CA提供的业务包括对电子身份证的业务适用范围进行升级和申请电子身份证两种业务。对于已经申请过电子身份证的用户而言，如果需要对电子身份证的业务适用范围进行升级，可以选择“升级业务适用范围”业务。如果用户未申请过电子身份证，想要申请一个电子身份证，可以选择“申请电子身份证”。前者适用于场景一，后者适用于场景二。以场景一为例，如果用户通过“点击”等操作方式，选择“升级业务适用范围”，管理界面呈现提示界面，提示界面用于提示用户选择需要的业务适用范围。当然，在具体实现时，CA或电子身份证应用也可以根据实际情况向用户呈现上述其中一种入口。例如，若用户还未开通电子身份证功能，则在用户打开证件包应用或CA后，向用户呈现上述“申请电子身份证”的功能按钮。若用户已开通电子身份证功能且该电子身份证具备初级或较低等级的业务适用范围，则在用户打开证件包应用或CA或电子身份证应用后，向用户呈现上述“升级业务适用范围”的功能按钮。如图3所示，假定电子身份证应用将电子身份证的业务适用范围预先划分为3类，分别为业务适用范围A、业务适用范围B和业务适用范围C。进一步地，用户通过点击“查看”按钮，可以查看每个业务适用范围所包括的业务。例如，用户选择查看业务适用范围B，CA提供的管理界面上可以弹出如图4所示的提示框，图4是用户界面UI上实现提示框的示意图。如图4所示，提示框中的文字信息用于说明具有业务适用范围B的电子身份证所能办理的业务。如果用户想要选择业务适用范围B，点击“业务适用范围B”按钮。终端设备检测到用户的点击操作，触发电子身份证的业务适用范围的升级流程。本申请实施例中的触发指令，可以是终端设备通过检测用户的点击操作而触发的。或者，电子身份证应用可以对每个业务适用范围进行编号，用户手动输入选择的业务适用范围的编号。如图5所示，图5是对电子身份证进行管理操作的另一个用户界面UI示意图。如图5中所示，业务适用范围A对应编号0，业务适用范围B对应编号1，业务适用范围C对应编号2。如果用户选择业务适用范围B，则在管理界面上提供的输入框中输 入数字“1”，以表示用户申请将电子身份证的业务适用范围升级为业务适用范围B。终端设备检测用户的输入操作，触发电子身份证的业务适用范围的升级流程。
上述用户的点击操作或输入操作可以是由终端设备上的CA来进行检测的。CA在检测到用户的点击操作或输入操作的情况下，即接收到触发指令，从而触发电子身份证的业务适用范围的升级。
需要说明的是，这里所说的点击操作或输入操作仅仅是作为示例，本领域技术人员可以想到其他方式或参考现有技术的技术手段来获取用户的触发指令。
可选地，CA可以在接收到用户的对电子身份证的业务适用范围进行升级的触发指令之后，判断该用户是否已经开通电子身份证。如果确定该用户已开通电子身份证，则CA执行步骤202以及后续流程。如果确定该用户还未开通电子身份证，则可以提示用户先开通电子身份证。
具体地，CA在接收到对电子身份证的业务适用范围进行升级的触发指令后，可以向证件包应用服务器查询该用户是否已经开通电子身份证。或者，也可以通过终端设备上的可信安全平台进行查询。
202、CA基于触发指令，确定终端设备本地提供可信安全平台，并确定可信安全平台中是否存在电子身份证应用。
如前文所述，可信安全平台可以是TEE或SE。因此，如果CA确定终端设备上提供TEE或SE，则CA认为终端设备本地提供可信安全平台。进一步地，CA判断可信安全平台中是否存在电子身份证应用。
如果可信安全平台为TEE，则客户端应用需要判断TEE中是否存在其对应的可信应用(trusted application,TA)，换句话说，当可信安全平台具体为TEE时，电子身份证应用具体为TA。而在可信安全平台为SE时，客户端应用需要判断SE中是否存在其对应的小应用程序applet。也可以说，当可信安全平台为SE时，电子身份证应用具体为applet。
本领域技术人员应当理解，TEE中运行有多个TA，而这里所说的TA是指该多个TA中的电子身份证应用TA。同样地，SE中也有多个applet，而这里所说的applet是指该多个applet中的电子身份证应用applet。以下，将TEE中的电子身份证应用TA或SE中的电子身份证应用applet统称为电子身份证应用。相对于CA，电子身份证应用是一种可信应用。
具体地，CA判断终端设备本地是否提供可信安全平台，以及可信安全平台中是否存在电子身份证应用有多种方式。
以可信安全平台是TEE为例，例如，通过初始化TEE环境(TEE context)操作，判断本地是否存在TEE或TEE是否可用。在初始化TEE context之后，通过创建会话(open session)操作判断TEE中是否存在电子身份证应用TA。或者，CA通过TA查询操作(get list of TA)从审计(audit)安全域(secure domain,SD)中获取到TA列表后判断是否存在电子身份证应用TA。上述初始化TEE环境操作和创建会话操作的具体内容可参考全球平台组织(global platform,GP)发布的TEE客户端接口标准(TEE Client API Specification)。前者用于在客户端应用CA和终端上的一个TEE之间建立连接，连接成功可认为存在TEE。后者用于在客户端应用CA和TEE内的一个特定TA 之间建立会话，建立会话成功可认为存在该TA。上述TA查询操作的具体内容可参考GP发布的TEE管理框架标准(TEE Management Framework Specification)，是用于获取TEE内某个安全域，例如audit SD，直接或间接关联的所有TA的列表(通过TA的通用唯一标识(uniform unique identity,UUID)表示)，以便于CA根据所获取的UUID判断是否存在电子身份证应用的UUID，存在时认为存在该TA。
再以安全平台是SE为例，如果终端设备通过开放移动接口(open mobile API,OMAPI)访问SE，则可利用该接口标准提供的功能进行判断。其中，OMAPI由SIM联盟(SIMalliance)发布，目前已转给GP。例如，通过获取读卡器函数getReaders()获取终端设备上的所有读卡器Readers(SIM/SD/eSE slot)，然后通过SE状态查询函数isSecureElementPresent()查询每个Reader上是否已插入SE。或者，更进一步地，可通过创建会话函数openSession()与每个SE之间创建session以查询是否有SE存储电子身份证应用applet，具体过程可参考OMAPI标准。
可选地，如果CA判断可信安全平台中不存在电子身份证应用，则下载并安装电子身份证应用到该可信安全平台中，例如，可通过可信安全平台向身份认证服务器请求，并经过可信安全平台下载电子身份证应用，或者，也可以直接从获得授权的身份认证服务器下载电子身份证应用。接下来，执行步骤203。
CA在确定可信安全平台中存在电子身份证应用的情况下，直接执行步骤203。
203、终端设备查询可信安全平台是否保存有身份认证服务器的证明信息。
具体地，客户端应用CA可以通过如下步骤2031-2033查询可信安全平台是否保存有身份认证服务器的证明信息。
2031、CA向电子身份证应用发送查询命令，查询命令用于请求查询电子身份证应用是否保存有身份认证服务器的证明信息。
其中，查询命令中携带能够表明身份认证服务器的身份的信息。例如，身份认证服务器的标识或名称。
身份认证服务器的证明信息可以是能够表征身份认证服务器的证书的信息。例如，可以是身份认证服务器的证书(例如，公钥证书)。
2032、电子身份证应用查询自己是否保存有身份认证服务器的证明信息(例如，身份认证服务器的证书)。
2033、电子身份证应用向CA返回查询响应。
其中，查询响应中携带查询结果，查询结果用于指示电子身份证应用是否保存有身份认证服务器的证明信息。
可选地，如果电子身份证应用保存有身份认证服务器的证明信息，电子身份证应用可以向CA返回查询成功响应。进一步地，查询成功响应中携带用于指示电子身份证应用保存有身份认证服务器的证明信息的信息，例如，查询结果信息(成功)和/或能够表征身份认证服务器的证书的信息(例如，身份认证服务器的公钥证书，或关联该公钥证书的证书序号、可信安全平台标识、终端设备标识等信息)。
应理解，如果电子身份证应用没有查询到身份认证服务器的证明信息，则查询响应中的查询结果用于指示电子身份证应用没有保存身份认证服务器的证明信息。
此外，步骤2031-2033具体还可以有其它实现方式，分别参见图6中的方式1、方 式2和方式3。
参见图6，图6是终端设备查询可信安全平台是否保存有身份认证服务器的证明信息的示意图。
方式1
2031、CA向电子身份证应用发送的查询命令，查询命令中除了携带能够表明身份认证服务器的身份的信息之外，还携带有一个随机数(以下记作R1)。
其中，R1可以由CA生成或在REE侧生成。
2032、电子身份证应用除了查询是否保存有身份认证服务器的证明信息，并对R1进行签名运算，得到R1的签名。
在步骤2032中，上述签名运算可以是对该随机数计算哈希值，然后用密钥(例如，可信安全平台的私钥，或电子身份证应用的私钥)对该哈希值做加密。当然也可以采用其它现有技术手段进行签名运算。
2033、电子身份证应用向CA返回查询响应。
如果电子身份证应用保存有身份认证服务器的证明信息，则向CA返回查询成功响应，查询成功响应中除了携带能够表征身份认证服务器的证书的信息，还携带有R1的签名。
可选地，在步骤2031中，查询命令中也可以不携带随机数。也就是说，CA不向电子身份证应用发送随机数。
在步骤2032中，电子身份证应用在接收到查询命令之后，如果确定保存有身份认证服务器的证明信息，电子身份证应用可以自己生成一个随机数(以下记作R2)，并对R2进行签名运算，得到R2的签名。
在步骤2033中，电子身份证应用向CA返回的查询响应中除了携带能够表征身份认证服务器的证书的信息，还携带R2和R2的签名。
应理解，由于R2是由电子身份证应用生成的，因此电子身份证应用向CA返回R2的签名的同时，也需要将R2发送给CA。而在前面所述的R1的示例中，由于R1是在CA侧生成的，因此电子身份证应用只需要返回R1的签名即可。
具体地，电子身份证应用对R1或R2进行签名运算时，可以使用可信安全平台的密钥对R进行签名运算，得到R1的签名或R2的签名。
进一步地，在上述各实施例的步骤2033中，查询响应中还可以携带能够指示可信安全平台的证书的信息(以下称作可信安全平台信息)，从而使身份认证服务器根据该信息确定可信安全平台的证书，以对上述R的签名进行验证。其中，可信安全平台信息可以是可信安全平台的证书序号、可信安全平台的标识和终端设备的标识信息等。例如，当可信安全平台是TEE时，这里所说的可信安全平台信息可以是TEE证书序号、TEE标识和终端设备的标识等。
方式2
2031、CA向电子身份证应用发送查询命令。
对于方式2中的步骤2031可以参考方式1中的步骤2031，这里不再赘述。
2032、电子身份证应用确定保存有身份认证服务器的证明信息。
2033、电子身份证应用在从身份认证服务器获取基于终端设备提供的可信安全平 台对电子身份证的业务适用范围进行升级的授权后，向CA返回查询成功响应。
关于电子身份证应用从身份认证服务器获取基于终端设备提供的可信安全平台对电子身份证的业务适用范围进行升级的授权，具体参见下文图7所示的步骤204所述的方法。
关于查询成功响应，其中可以携带能够表征身份认证服务器的证书的信息、本地升级授权结果(成功)中的至少一个。
方式3
2031、CA向电子身份证应用发送查询请求，查询请求用于请求查询电子身份证应用是否有身份认证服务器的证明信息。
如果步骤2031中的查询命令中携带随机数R1，在步骤2302中，电子身份证应用使用可信安全平台的密钥对R1进行签名运算，得到R1的签名。或者，如果查询命令中不携带随机数R1，在步骤2032中，电子身份证应用在查询到身份认证服务器的证明信息之后，生成随机数R2，并使用可信安全平台的密钥对R2进行签名运算，得到R2的签名。
2032、电子身份证应用查询到保存有身份认证服务器的证明信息之后，使用证件包应用服务器的密钥对可信安全平台信息、随机数的签名中的至少一项进行加密运算，得到加密数据。
2033、电子身份证应用向CA发送查询成功响应，查询成功响应中携带该加密数据。
CA从电子身份证应用接收到查询成功响应，表明电子身份证应用保存有身份认证服务器的证明信息。
需要说明的是，上述查询成功响应中携带的加密数据被CA收到后，可由CA经过证件包应用发送给证件包应用服务器，以使证件包应用服务器对该加密数据进行解密并对解密出的数据(上述步骤2032中加密前的数据)进行验证(如对上述随机数的签名进行验签)。
在步骤203中，CA通过向可信安全平台进行查询，可以获知可信安全平台中是否保存有身份认证服务器的证明信息。在可信安全平台保存有身份认证服务器的证明信息的情况下，终端设备执行步骤204及其后续步骤。
需要说明的是，在本次查询过程中涉及的可信安全平台信息以及可能的随机数信息是为了便于在后面的步骤204中让身份认证服务器对终端设备是否存在合法的可信安全平台进行确认，进而决定是否允许基于终端设备本地提供的可信安全对电子身份证的业务适用范围进行授权。
204、终端设备向身份认证服务器发送本地升级授权请求，并从身份认证服务器接收本地升级授权应答消息。
步骤204中，终端设备向身份认证服务器申请基于可信安全平台对用户的电子身份证的适用范围进行升级的权限，可以参见图7中所示的多种方式实现。图7是终端设备向身份认证服务器申请基于可信安全平台对电子身份证的业务适用范围进行升级的权限的示意图。
方式1
终端设备通过CA向身份认证服务器发送本地升级授权请求。
2041、CA向身份认证服务器发送本地升级授权请求，身份认证服务器接收本地升级授权请求。
CA获知电子身份证应用是否保存有身份认证服务器的证明信息，例如上述步骤203的方式1中根据收到的查询响应后即可确定。如果电子身份证应用保存有身份认证服务器的证明信息，CA向身份认证服务器发送本地升级授权请求。
其中，本地升级授权请求用于请求身份认证服务器许可基于终端设备本地的可信安全平台对电子身份证的业务适用范围进行升级。本地升级授权请求中携带有可信安全平台信息。
可选地，本地升级授权请求中还携带随机数R和随机数R的签名。这里的随机数R和随机数R的签名可以是步骤203中的R1和R1的签名，也可以是R2和R2的签名。
可选地，本地升级授权请求中还可以携带终端设备的标识信息。
上述可信安全平台信息、随机数和随机数的签名(例如，R1和R1的签名，或者R2和R2的签名)、终端设备的标识信息中的至少一项可以是使用身份认证服务器的密钥(例如，公钥或对称密钥)经过加密处理后的数据。
2042、身份认证服务器对本地升级授权请求中携带的信息进行验证，以确定是否许可本地升级授权请求。
是否许可本地升级授权也即是否同意基于终端设备上的可信安全平台对用户的电子身份证的业务适用范围进行升级。
具体地，身份认证服务器接收本地升级授权请求，并对本地升级授权请求中携带的信息(例如，可信安全平台信息、随机数和随机数的签名)进行验证。首先，身份认证服务器根据可信安全平台信息，获取可信安全平台的证书，并使用预置的认证中心的根证书对可信安全平台的证书进行验证。例如，可信安全平台信息包含可信安全平台的公钥证书时，身份认证服务器可直接获得该公钥证书，或者，可信安全平台信息包含该公钥证书的序号、可信安全平台的标识、终端设备的标识等至少一项时，身份认证服务器可根据这些信息查找到对应的公钥证书(需要说明的是，身份认证服务器已预存这些信息与该公钥证书的关联关系)。然后，身份认证服务器采用现有技术手段即可验证该公钥证书的合法性(例如，利用根证书验证该公钥证书上的签名是否合法)。之后，身份认证服务器使用上述公钥证书对随机数R的签名进行验证，例如，采用现有技术手段验签，使用公钥证书对应的公钥对该R的签名解密得到其哈希值，同时对接收到的随机数R计算哈希值，并将解密出的哈希值和计算出的哈希值进行比较即可。如果验证通过，身份认证服务器同意基于终端设备提供的可信安全平台对电子身份证的业务适用范围进行升级。如果验证不通过，则不同意。
2043、身份认证服务器向CA返回本地升级授权响应。
本地升级授权响应用于指示身份认证服务器同意或不同意基于终端设备提供的可信安全平台对电子身份证的业务适用范围进行升级。
在身份认证服务器同意基于可信安全平台对电子身份证的业务适用范围进行升级的情况下，身份认证服务器向CA返回授权应答消息，授权应答消息用于指示身份认 证服务器允许基于可信安全平台对电子身份证的所述业务适用范围进行升级。或者，可以本地升级授权响应中携带指示信息，该指示信息用于指示身份认证服务器同意基于可信安全平台对电子身份证的所述业务适用范围进行升级。
在身份认证服务器不同意基于可信安全平台对电子身份证的业务适用范围进行升级的情况下，身份认证服务器向CA返回否定应答消息。或者，可以本地升级授权响应中携带指示信息，该指示信息用于指示身份认证服务器不同意基于可信安全平台对电子身份证的所述业务适用范围进行升级。
方式2
终端设备通过电子身份证应用向身份认证服务器发送本地升级授权请求。
在方式2中，CA请求电子身份证应用在查询到可信安全平台保存有身份认证服务器的证明信息后，直接向身份认证服务器发送本地升级授权请求。
参见图7中的方式2，为了便于理解，图7的方式2中用虚线画出了上述图6中方式2的步骤2032，表示图7中的方式2可以在终端设备执行上述图6中方式2的步骤2031和2032之后，转至步骤2041。
2031、CA向电子身份证应用发送查询命令，查询命令中携带能够表征身份认证服务器的身份的信息。
该查询命令中还可能携带随机数R。
2032、电子身份证应用响应于查询命令，查询可信安全平台是否保存有身份认证服务器的证明信息。
步骤2031-2032可以参考上文图6所示的方式1或方式2中的步骤2031-2032，具体携带信息类似，这里不再赘述。
2041、电子身份证应用在查询到可信安全平台保存有身份认证服务器的证明信息的情况下，向身份认证服务器发送本地升级授权请求。
本地升级授权请求中携带有可信安全平台信息。
可选地，如果查询命令中携带随机数R1，电子身份证应用对R1进行签名运算，得到R1的签名，并在发送给身份认证服务器的本地升级授权请求中携带R1和R1的签名。
如果查询命令中不携带随机数，电子身份证应用可以自己生成随机数R2，并对R2进行签名运算，得到R2的签名。本地升级授权请求中携带R2和R2的签名。
在方式2的步骤2041中，本地升级授权请求携带的信息与上述方式1的步骤2041中的本地升级授权请求携带的信息类似，不再赘述。
2042、电子身份证应用从身份认证服务器接收本地升级授权响应。
具体地，身份认证服务器对本地升级授权请求中携带的信息进行验证。如果验证通过，身份认证服务器向电子身份证应用返回本地升级授权应答。如果验证不通过，身份认证服务器向电子身份证应用返回本地升级否定应答。
可选的，电子身份证应用向CA发送查询响应，如图6所述的上述方式2中的步骤2033，或者，向CA转发接收到的该本地升级授权响应，以向CA通知授权结果。
本方式2的步骤2042中的本地升级授权响应携带的内容与上述方式1的步骤2042中的本地升级授权响应类似，不再赘述。
需要说明的是，在方式2中，电子身份认证应用直接向身份认证服务器发送消息或从身份认证服务器接收消息，还可以理解为所发送的消息是电子身份认证应用生成的，因此，在具体实现中，还可以是电子身份认证应用将生成的本地升级授权请求透传给客户端应用CA，然后经过客户端应用CA发送给身份认证服务器，然后经过客户端应用CA从身份认证服务器接收应答。
方式3
终端设备通过CA请求证件包应用服务器向身份认证服务器发送本地升级授权请求。
方式3的实现可能需要一个前提，即电子身份证应用预置有证件包应用服务器的证书、身份认证服务器的证书(可选的)，证件包应用服务器预置有可信安全平台的证书、认证中心CA的根证书和身份认证服务器的证书，身份认证服务器预置有证件包应用服务器的证书、可信安全平台的证书(可选的)。
本方式3可以基于步骤203中的方式3。也即，CA从电子身份证应用接收步骤2033中的查询响应之后开始执行下面的步骤2041。
如步骤203的方式3所述，查询成功响应中携带有加密数据。该加密数据可以是电子身份证应用使用证件包应用服务器的密钥(例如，公钥或对称密钥)对可信安全平台信息、随机数R和R的签名中的一项或多项经过加密得到的。
2041、CA向证件包应用服务器发送本地升级授权请求。
本地升级授权请求中携带该加密数据。
2042、证件包应用服务器获取本地升级授权请求中携带的加密数据，对加密数据解密后，核对可信安全平台信息。或者，证件包应用服务器对加密数据解密后，再使用身份认证服务器的密钥对解密后的数据进行二次加密。
步骤2042中的两种处理方式详见如下说明。
(1)证件包应用服务器使用自己的密钥(即，证件包应用服务器的密钥)对加密数据进行解密，得到可信安全平台信息和/或随机数的签名。然后，证件包应用服务器对可信安全平台信息进行验证，并使用可信安全平台信息对随机数的签名进行验签，得到验证结果。其中，验证结果用于表明可信安全平台是否可信。
如果证件包应用服务器得到的验证结果表明可信安全平台信息是可信的，则证件包应用服务器可以向身份认证服务器发送指示信息(记作指示信息#1)，指示信息#1用于表明可信安全平台是可信的。反之，证件包应用服务器可以向身份认证服务器发送指示信息#2，指示信息#2用于指示可信安全平台是不可信的。
应理解，身份认证服务器可以在后续步骤2043中接收到身份认证服务器发送的本地升级授权请求时，或者在后续步骤205中接收到本地升级请求时，根据该指示信息#1或指示信息#2确定是否同意终端设备基于可信安全平台对用户的电子身份证的业务适用范围进行升级。如果身份认证服务器从证件包应用服务器接收到指示信息#1，身份认证服务器将同意基于终端设备上的可信安全平台对电子身份证的业务适用范围进行升级。如果身份认证服务器从证件包应用服务器接收到指示信息#2，身份认证服务器则不同意基于终端设备上的可信安全平台对电子身份证的业务适用范围进行升级。
(2)证件包应用服务器对加密数据做解密后，再使用身份认证服务器的密钥(如 预先存储的身份认证服务器的公钥证书对应的公钥)对解密后的数据进行二次加密，并将二次加密数据发送给身份认证服务器，由身份认证服务器对二次加密数据进行解密，再对解密后得到的可信安全平台信息进行核对，并对随机数的签名进行验签，从而来判断可信安全平台是否可信，进而在接收到本地升级授权请求时，确定是否许可本地升级授权请求。
可选地，身份认证服务器也可以选择将本地升级请求中的携带的信息透传给身份认证服务器，由身份认证服务器对这些信息解密后进行核对。
2043、证件包应用服务器向身份认证服务器发送本地升级授权请求。
如果在步骤2042中证件包应用服务器采用上述处理方式(1)，步骤2043中的本地升级授权请求中携带上述指示信息1或指示信息2。
身份认证服务器直接根据指示信息1或指示信息2，可以确定是否同意基于终端设备提供的可信安全平台对电子身份证的业务适用范围进行升级。
如果在步骤2042中证件包应用服务器采用上述处理方式(2)，步骤2043中的本地升级授权请求中携带二次加密后的数据。
身份认证服务器使用自己的密钥对二次加密数据进行解密后，核对可信安全平台信息。核对通过的情况下，同意基于终端设备提供的可信安全平台对电子身份证的业务适用范围进行升级。核对不通过的情况下不同意。
2044、身份认证服务器在同意基于终端设备提供的可信安全平台对电子身份证的适用范围进行升级的情况下，向证件包应用服务器发送本地升级授权应答。
或者，身份认证服务器向终端设备(如客户端应用CA)返回本地升级授权应答，由终端设备将本地升级授权应答转发给证件包应用服务器。如图7中标记的步骤2045所示。
可选的，也可以不执行本步骤2043-2044，而是由证件包应用服务器对终端设备发送的加密数据做解密后直接对解密出的数据进行验证，如果验证通过，则直接向终端设备授予本地升级的权限，此时，证件包应用服务器需事先与身份认证服务器之间达成协商，即实现中证件包应用服务提供商与身份认证服务提供商之间先达成合作，赋予证件包应用服务提供商这样的权限，使其以类似委托代理的身份对终端设备上的可信安全平台进行验证与本地升级权限的授予。
需要说明的是，上述步骤203和204中涉及的随机数及其签名，是一种实现方式，起到一定的防重放攻击的作用，当然也可以使用其他信息替代随机数，例如使用CA与TA之间交互次数的计数值。
以上步骤201-204描述了终端设备从身份认证服务器申请基于本地提供的可信安全平台对电子身份证的适用范围进行升级的权限，并获得授权的过程。下面的步骤205-209是在获得基于可信安全平台对电子身份证的业务适用范围进行升级的权限的基础上，对电子身份证的业务适用范围进行升级的过程。
205、终端设备生成对电子身份证的业务适用范围进行升级所需的升级信息，并将升级信息发送给身份认证服务器。
步骤205通过图8中所示的多种方式实现。
参见图8，图8是终端设备生成升级信息并向身份认证服务器发送升级信息的示 意图。
方式1
2051、CA向电子身份证应用发送本地升级命令，本地升级命令用于请求电子身份证应用生成升级信息。
在本申请中，升级信息至少包括用户的人脸图像信息和实体身份证信息。
一种可选的实现方式是，本地升级命令中可以携带升级信息中的一部分信息，此时，CA可在REE侧生成升级信息的一部分信息，并从电子身份证应用获取升级信息的另外一部分信息。
例如，CA在REE侧获取人脸图像信息，并从电子身份证应用获取实体身份证信息。或者，CA在REE侧获取实体身份证信息，并从电子身份证应用获取人脸图像信息。具体地，CA可以在REE侧生成升级信息的一部分信息，并向电子身份证应用发送本地升级命令，本地升级命令用于请求电子身份证应用生成升级信息中的另外一部分信息(并对所有升级信息进行加密或签名处理)。电子身份证应用响应于本地升级命令，生成CA请求的升级信息中的另外一部分信息，并在生成该升级信息的另外一部分信息之后，向CA反馈本地升级命令响应，本地升级命令响应中携带该升级信息的另外一部分信息。
可选地，CA、电子身份证应用也可分别对各自获取的部分升级信息进行加密或签名处理。例如，CA使用身份认证服务器的公钥或对称密钥对其获取的部分升级信息进行加密，电子身份证应用使用可信安全平台的私钥对其获取的部分升级信息进行签名处理等等。此外，也可以由电子身份证应用对所有升级信息进行加密或签名处理。
另一种可选的实现方式是，本地升级命令中可以不携带任何升级信息，此时，需要电子身份证应用获取所有升级信息，然后通过本地升级响应返回给CA。例如，电子身份证应用可以通过近场通信(near filed communication,NFC)读取实体身份证信息，或通过用户界面(user interface,UI)接收用户输入的实体身份证信息，或通过用户上传的拍照来识别实体身份证信息；并通过终端设备上的摄像头实时采集人脸图像信息。
可选地，电子身份证应用对读取用户的实体身份证信息和/或采集用户的人脸图像信息进行加密处理或签名处理。例如，电子身份证应用可以使用可信安全平台的私钥或对称密钥对人脸图像信息和/或实体身份证信息进行签名处理。或者，电子身份证应用使用身份认证服务器的公钥或对称密钥对人脸图像信息和/或实体身份证信息进行加密处理。
2052、CA向身份认证服务器发送本地升级请求，本地升级请求中携带升级信息。
可选地，升级信息还包括电子身份证信息。或者，升级信息还包括电子身份证信息和电子身份证对应的当前的业务适用范围标识。
其中，该电子身份证信息(可以包括电子身份证及其对应的当前的业务适用范围的标识)可以是在终端设备本地获取的，或者是从证件包应用服务器获取的。例如，若电子身份证信息在终端设备(具体例如可信安全平台)上保存，则可以直接获取，若电子身份证信息在证件包应用服务器侧保存，则需要在步骤2052之前，通过如下步骤2053-2054获取。
2053、CA向证件包应用服务器发送电子身份证信息获取请求。
电子身份证信息获取请求用于请求从证件包应用服务器获取用户当前的电子身份证信息。
2054、CA从证件包应用服务器接收应答消息，并从应答消息中获取电子身份证信息。
可选地，升级信息还可以包括终端设备的标识信息。终端设备的标识信息可以方便身份认证服务器确定通过上述步骤201-204申请的本地升级授权结果，还可能用于确定终端设备上的可信安全平台的证书，或者用于对上述电子身份证信息进行关联性核对。
需要说明的是，以上获取的电子身份证信息(及其对应的当前的业务适用范围)是用于向身份认证服务器确认本次升级操作是针对该电子身份证进行的，以确保在某些情况下(如当用户在一个终端设备上开通多个电子身份证时，或者当多个用户在同一个终端设备上分别开通电子身份证时)能对指定的电子身份证的业务适用范围进行升级。
方式2
电子身份证应用生成升级信息(即，升级信息包括的全部信息)。电子身份证应用在生成升级信息之后，由电子身份证应用直接向身份认证服务器发送本地升级请求。
其中，本地升级请求中携带该升级信息。
2051、CA向电子身份证应用发送本地升级命令，本地升级命令用于请求电子身份证应用生成升级信息。
在方式2中，本地升级命令携带的内容与上述方式1中步骤2051所述的本地升级命令相同，这里不再赘述。
方式2与上述方式1的不同之处在于，电子身份证应用可不向CA返回本地升级响应，或者返回的本地升级响应中不包含方式1中所述的所有或部分升级信息。
2052、电子身份证应用向身份认证服务器发送本地升级请求，本地升级请求中携带该升级信息。
可选地，如果在步骤2052中，电子身份证应用对人脸图像信息和/或实体身份证信息进行了签名处理，则本地升级请求中还携带签名信息。或者，如果电子身份证应用人脸图像信息和/或实体身份证信息进行了加密处理，则本地升级请求中携带的升级信息是经过加密处理后的数据。
可选地，升级信息还包括电子身份证信息。或者，升级信息还包括电子身份证信息和电子身份证对应的当前的业务适用范围标识。具体可由客户端应用CA在本方式2的步骤2051之前从证件包应用服务器获取，与上述方式1中步骤2053-2054类似，不再赘述。
方式3
CA将升级信息发送给证件包应用服务器，由证件包应用服务器向身份认证服务器发送本地升级请求。
2051、CA将通过上述方式1获取到人脸图像信息和实体身份证信息发送给证件包应用服务器。或者，在上述方式2中，电子身份证应用将封装好的升级信息发送给CA，再由CA将升级信息发送给证件包应用服务器。
可选地，在方式2中，电子身份证应用在将人脸图像信息和实体身份证信息发送给CA之前，可以使用证件包应用服务器的公钥或对称密钥对人脸图像信息和/或实体身份证信息进行加密处理处理。
2052、证件包应用服务器向身份认证服务器发送本地升级请求，本地升级请求中携带升级信息。
其中，升级信息用于身份认证服务器对电子身份证的业务适用范围进行升级。
可选地，在步骤2052中，可以由证件包应用服务器直接将升级信息透传给身份认证服务器。或者也可以由证件包应用服务器对人脸图像信息和实体身份证信息进行验证，再将验证结果发送给身份认证服务器。
需要说明的是，在以上各方式中，人脸图像信息和实体身份证信息不能全部由CA从REE侧获取。人脸图像信息和实体身份证信息后续会发送给身份认证服务器进行核对。如果人脸图像信息指示的用户与实体身份证信息指示的用户是同一个用户，核对通过，身份服务器就会对电子身份证的业务适用范围进行升级。否则，核对不通过，不作升级。上文已经介绍过，REE相对于TEE而言，安全性较低，因此，运行在REE中的普通应用(即，客户端应用CA)的安全性是无法保障的。因此，升级信息中至少有一项不是从REE侧获取，才能提高核对的可靠性。
需要说明的是，如果是证件包应用服务器向身份认证服务器发送本地升级请求，则上述方式1中的步骤2053-2054可以略去。也即，CA将获取到的人脸图像信息和实体身份证信息发送给证件包应用服务器。证件包应用服务器将人脸图像信息和实体身份证信息与电子身份证信息一并封装到本地升级请求中发送给身份认证服务器。CA不需要从证件包应用服务器获取电子身份证信息。
206、身份认证服务器对升级信息进行核对，并在核对通过的情况下，对电子身份证的业务适用范围进行升级。
具体地，身份认证服务器核对人脸图像信息指示的用户与实体身份证信息指示的用户是否为同一个用户。如果是同一个用户，身份认证服务器对该用户的电子身份证的当前的业务适用范围进行升级。
身份认证服务器对用户的电子身份证的业务适用范围完成升级之后，可以向终端设备发送本地升级成功应答。
可选地，如果步骤205中采用方式1或2，且人脸图像信息和/或实体身份证信息这些升级信息是使用可信安全平台的密钥(例如私钥或对称密钥)签名后的签名信息，则身份认证服务器需要先使用可信安全平台的密钥(如公钥或对称密钥)对签名信息验签，以核对人脸图像信息和/或实体身份证信息。或者，如果步骤205中采用方式3，则证件包应用服务器将使用身份认证服务器的密钥(例如，公钥)经过加密处理的加密数据传给身份认证服务器，身份认证服务器需要对加密数据进行解密(例如使用自身私钥进行解密)，再核对人脸图像信息和实体身份证信息进行核对。或者，如果步骤205中采用方式3，则证件包应用服务器已经对人脸图像信息和/或实体身份证信息进行了核对，直接向身份认证服务器发送了核对结果，则身份认证服务器可以根据证件包应用服务器的核对结果确定是否对电子身份证的业务适用范围进行升级。如果核对结果指示核对通过，则对用户的电子身份证的业务适用范围进行升级，如果核对结 果指示核对未通过，则不对该用户的电子身份证的业务适用范围进行升级。进一步地，在核对不通过的情况下，身份认证服务器可以向终端设备返回升级失败信息。
207、身份认证服务器向证件包应用服务器或终端设备发送升级通知。
例如，在终端设备的CA或TA向身份认证服务器发送本地升级请求(也即，升级信息)的情况下，身份认证服务器向终端设备返回升级通知。可选地，终端设备再将升级通知转发给证件包应用服务器，以由证件包应用服务器更新并保存升级后的业务适用范围标识。或者，在终端设备通过证件包应用服务器向身份认证服务器发送本地升级请求或在终端设备的CA或TA向身份认证服务器发送的本地升级请求中携带证件包应用服务器的标识信息(例如，证件包应用服务器的名称或统一资源定位符(uniform resource locator,URL))的情况下，身份认证服务器在对电子身份证的业务适用范围完成升级之后，直接向证件包应用服务器发送升级通知，升级通知用于通知证件包应用服务器更新该用户的电子身份证的业务适用范围。
其中，升级通知中携带升级后的业务适用范围的标识。
可选地，在本地升级请求中携带用户的电子身份证信息和/或终端设备标识的情况下，身份认证服务器将升级后的业务适用范围的标识与该电子身份证信息和/或终端设备标识进行关联。
208、证件包应用服务器将该用户的电子身份证的业务适用范围从第一业务适用范围更新为第二业务适用范围。
其中，第一业务适用范围是升级之前的业务适用范围，第二业务适用范围是指完成升级后的业务适用范围。第二业务适用范围大于第一业务适用范围。
步骤207-208，身份认证服务器可直接向证件包应用服务器发送升级通知，以通知证件包应用服务器更新电子身份证的业务适用范围。
另外，终端设备从身份认证服务器接收到升级通知之后，可同步更新该用户的电子身份证的业务适用范围，例如，CA或电子身份证应用以UI形式对电子身份证的业务适用范围进行更新，参见图2中的步骤209。
参见图9，图9是对电子身份证进行管理操作的又一用户界面UI示意图。如图9所示，CA在从身份认证服务器接收到升级通知后，向用户显示提示信息，提示完成升级之后的电子身份证的业务适用范围。例如，CA在管理界面上提示“您的电子身份证当前的业务适用范围为：业务适用范围B”，并在管理界面上提供“确定”按钮和“修改”按钮。CA通过检测用户点击“确定”按钮，将业务适用范围B记录为该用户的电子身份证当前的业务适用范围。或者，CA通过检测用户点击“修改”按钮，返回向用户呈现图3中所示的管理界面，提示用户重新选择用户需要的业务适用范围等。当然，也可以在升级成功后不向用户呈现再次确认的入口，而是直接在UI上提醒用户电子身份证的业务适用范围升级已成功，以及升级后的业务使用范围的等级或适用的具体业务是什么。
可选地，以上步骤208以及文中涉及的管理界面也可以由电子身份证应用提供，相应地，更新升级后的业务适用范围的记录也可以由电子身份证应用执行。
以上是本申请提出的终端设备基于本地提供的可信安全平台对用户的电子身份证的业务适用范围进行升级的流程。
根据上文所述，电子身份证的业务适用范围有大有小。如果一个用户想要使自己的电子身份证所能适用的业务适用范围扩大，以使用电子身份证办理更多的业务，则可以通过场景一中描述的方法对自己的电子身份证的业务适用范围进行升级。例如，在升级之前，这个用户的电子身份证只能办理酒店入住和车票购买业务。升级之后，除了可以办理酒店入住和车票购买，这个用户的电子身份证还能用于办理工商注册登记、证券开户等业务。
而在另一种场景中，如果一个用户还没有电子身份证，那么他可以在申请电子身份证的时候，就申请一个具有目标业务适用范围的电子身份证。例如，如果这个用户希望申请的电子身份证可以用于工商注册登记和证券开户等业务，那么该用户可以在直接申请具有该业务适用范围的电子身份证。这种场景即使下面所说的场景二。
场景二
参见图10，图10是本申请提出的申请电子身份证的方法流程图。
510、终端设备接收触发指令。
触发指令用于请求为用户申请具有目标业务适用范围的电子身份证。其中，目标业务适用范围是指用户为自己申请的电子身份证选择的业务适用范围。
电子身份证应用可以将电子身份证能够适用的业务范围划分为多个等级，每个等级对应一个业务适用范围。其中，较大的业务适用范围可以涵盖较小的业务适用范围。一个用户在申请电子身份证的时候，可以根据业务需求，为即将申请的电子身份证选择一个合适的业务适用范围。当然，上述目标业务适用范围也可以是默认的，或终端设备根据本地是否提供可信安全平台后确定的，如在后面的流程中若终端确定本地不存在可信安全平台，则目标业务适用范围为最低等级的，否则高于最低等级。
步骤510中，终端设备接收触发指令的过程可以参考场景一中的步骤201。以图3为例，用户通过在电子身份证应用提供的管理界面上选择“申请电子身份证”，选择办理“申请电子身份证”业务。终端设备通过检测用户的点击操作，接收到该触发指令，从而触发为用户申请电子身份证的业务流程。进一步地，终端设备在检测到用户的触发指令之后，可以为用户呈现提示界面，供用户选择电子身份证的业务适用范围。终端设备通过检测用户操作，确定用户选择的目标业务适用范围，从而基于可信安全平台为用户直接申请得到该具有目标业务适用范围的电子身份证。
这里，获取用户的点击操作仅是作为终端设备接收触发指令的示例，本领域技术人员也可以采用现有技术手段来接收(或者说，检测)用户的触发指令。
需要说明的是，在场景一中，触发指令用于触发对电子身份证的业务适用范围的升级。而在场景二中，触发指令用于触发申请具有目标业务适用范围的电子身份证。
520、终端设备基于触发指令，确定终端设备提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息。
步骤520可以参考场景一中的步骤220，这里不再赘述。
530、终端设备从身份认证服务器获得基于该可信安全平台为用户申请具有目标业务适用范围的电子身份证的权限。
终端设备在确定可信安全平台保存有身份认证服务器的证明信息的情况下，向身份认证服务器申请基于可信安全平台为用户申请具有目标业务适用范围的电子身份证 的权限。在得到身份认证服务器的许可之后，终端设备就获得了该权限。
例如，终端设备上运行在REE中的CA通过步骤520，请求电子身份证应用查询是否保存有身份认证服务器的证明信息。在接收到电子身份证应用返回的查询成功响应之后，CA向身份认证服务器发送本地申请授权请求。本地申请授权请求用于请求身份认证服务器许可基于可信安全平台为用户申请具有目标业务适用范围的电子身份证。
其中，本地申请授权请求中携带有可信安全平台信息。可选地，本地申请授权请求中还携带随机数R和R的签名。进一步地，还可以携带有终端设备的标识信息等信息。
这里，可信安全平台信息、R和R的签名中的一项或多项可以是使用身份认证服务器的密钥(例如，公钥或对称密钥)经过加密处理后的数据。
身份认证服务器对本地申请授权请求中携带的信息进行验证，以确定是否许可本地申请授权。如果验证通过，身份认证服务器同意基于终端设备提供的可信安全平台为用户申请电子身份证。如果验证不通过，身份认证服务器不同意基于可信安全平台为用户申请电子身份证。验证的过程可以参考场景一中的说明。
在验证通过的情况下，身份认证服务器会向终端设备返回本地申请授权应答，终端设备获得了基于可信安全平台为用户申请电子身份证的权限。
540、终端设备向身份认证服务器发送申请电子身份证所需的申请信息，以使身份认证服务器根据申请信息，为用户生成具有目标业务适用范围的电子身份证。
其中，申请信息用于身份认证服务器验证用户并为用户生成具有目标业务适用范围的电子身份证。
在场景二中，申请信息至少包括用户的人脸图像信息和实体身份证信息。进一步地，申请信息中的部分或全部信息还可以是使用可信安全平台的密钥经过签名处理后的数据，和/或，使用身份认证服务器的密钥经过加密处理后的数据。可选地，申请信息还可以包括终端设备的标识信息、本地申请授权结果信息等。与场景一中不同的是，申请信息中不包括电子身份证信息。
终端设备向身份认证服务器发送申请信息的过程，可以参考场景一中终端设备向身份认证服务器发送升级信息的过程。
身份认证服务器对申请信息进行核对。如果核对通过，身份认证服务器为用户生成具有目标业务适用范围的电子身份证。进一步地，身份认证服务器将生成的电子身份证下发到终端设备的可信安全平台上进行保存。
根据场景二中描述的方法，终端设备通过从身份认证服务器申请得到基于终端设备提供的可信安全平台为用户申请具有目标业务适用范围的电子身份证的权限，进而可以基于该可信安全平台为用户申请具有目标业务适用范围的电子身份证。这样，用户可以直接申请得到一个具有较大的业务适用范围的电子身份证，也不再需要借助于部署在固定网点的可信受理终端，降低部署成本，同时可以为用户带来方便。
下面结合图11给出终端设备基于可信安全平台为用户申请电子身份证的一个示例。
参见图11，图11是本申请提出的终端设备基于可信安全平台申请电子身份证的示意图。
601、终端设备通过富执行环境REE中的客户端应用CA接收触发指令，触发指令用于请求为用户申请具有目标业务适用范围的电子身份证。
具体地，终端设备上运行在REE中的CA可以为用户提供一个管理自己电子身份证的相关信息的入口。用户在没有开通电子身份证的情况下，通过打开CA，进入电子身份证的管理界面。其中，电子身份证的管理包括申请电子身份证，以及申请到电子身份证的后续管理，例如，根据需要对申请到的电子身份证的业务适用范围进行升级等。
其中，CA提供的管理界面可以参考场景一中的步骤201。
602、CA基于触发指令，确定终端设备本地提供可信安全平台，并确定可信安全平台中是否存在电子身份证应用。
步骤602可以参考场景一中的步骤202，这里不再详述。
603、终端设备查询可信安全平台是否保存有身份认证服务器的证明信息。
在场景二中，终端设备查询可信安全平台是否保存有身份认证服务器的证明信息，可以参考上述场景一中的说明，这里不再赘述。
604、终端设备向身份认证服务器发送本地申请授权请求，并从身份认证服务器接收本地申请授权应答响应。
场景二中，终端设备向身份认证服务器发送本地申请授权请求，与场景一中描述的终端设备向身份认证服务器发送本地升级授权请求类似。场景二中，终端设备从身份认证服务器接收本地申请授权响应，与场景一中终端设备从身份认证服务器接收本地升级授权响应类似，可以参见场景一中的各实现方式。
例如，终端设备上的CA向身份认证服务器发送本地申请授权请求，本地申请授权请求中携带可信安全平台信息。可选地，可信安全平台信息可以是电子身份证应用使用身份认证服务器的密钥进行加密运算后的加密数据。
可选地，本地申请授权信息中还携带随机数R和R的签名。其中，R和R的签名也可以是使用身份认证服务器的密钥进行加密运算后的加密数据。
相对应地，身份认证服务器接收到本地申请授权请求，对本地申请授权请求中携带的可信安全平台信息进行核对。如果该可信安全平台信息是使用身份认证服务器的密钥进行加密处理后的加密数据，身份认证服务器首先使用自身的私钥对加密数据进行解密，再使用本地预置的认证中心CA的根证书对解密后得到的可信安全平台信息进行核对。
类似地，如果本地申请授权请求中还携带R和R的签名，身份认证服务器使用可信安全平台信息对R的签名进行验证，验证的过程参见场景一，这里不再详述。
605、终端设备生成申请具有目标业务适用范围的电子身份证所需的申请信息，并将申请信息发送给身份认证服务器。
与场景一中描述的终端设备生成升级信息的过程类似，本场景二中，申请信息可以由CA和电子身份证应用共同生成，或由电子身份证应用独自生成。如果是前者，生成的申请信息中至少有一项是从电子身份证应用获取的，也就是说申请信息不能全部由CA在REE侧生成，人脸图像信息或实体身份证信息中至少有一项来自电子身份证应用。
如步骤540所述，申请信息至少包括用户的人脸图像信息和实体身份证信息。
具体地，终端设备可以通过多种方式将申请信息发送给身份认证服务器。例如，CA生成申请信息之后，向身份认证服务器发送本地申请请求，本地申请请求中携带申请信息。或者，CA向电子身份证应用发送本地申请命令，由电子身份证应用生成申请信息(包括人脸图像信息和实体身份证信息)，并向身份认证服务器发送本地申请请求，本地申请请求中携带该申请信息。可选地，申请信息中还可以包括签名信息，签名信息是电子身份证应用使用可信安全平台的密钥对人脸图像信息和实体身份证信息中的一项或多项进行签名处理得到的。可选地，申请信息还可以包括目标业务适用范围的标识信息。或者，CA生成申请信息之后，向证件包应用服务器发送本地申请请求，本地申请请求中携带申请信息。可选地，证件包应用服务器可以对申请信息进行核对，再将核对结果发送给身份认证服务器。或者，证件包应用服务器也可以将本地申请请求透传给身份认证服务器。证件包应用服务器对申请信息的处理方式可以参考场景一中证件包应用服务器对升级信息的处理方式。
606、身份认证服务器对申请信息进行核对，并在核对通过的情况下，为用户生成具有目标业务适用范围的电子身份证。
具体地，身份认证服务器核对人脸图像信息指示的用户与实体身份证信息指示的用户是否为同一个用户。如果是同一个用户，身份认证服务器为用户生成具有目标业务适用范围的电子身份证。如果不是同一个用户，身份认证服务器向终端设备返回拒绝消息，拒绝消息用于指示身份认证服务器拒绝为该用户开通和下发电子身份证。
可选地，如上述步骤605，如果申请信息包括电子身份证应用使用可信安全平台的密钥(例如私钥或对称密钥)对对人脸图像信息和/或实体身份证信息进行签名处理后的签名信息，身份认证服务器使用预置的可信安全平台的密钥(例如，公钥或对称密钥)对该签名信息进行验签。
607、身份认证服务器向终端设备或证件包应用服务器发送申请成功通知。
例如，在终端设备的CA或TA向身份认证服务器发送本地申请请求的情况下，身份认证服务器向终端设备返回申请成功通知。申请成功通知用于指示用户的电子身份证申请成功，其中，申请成功通知中携带身份认证服务器为用户生成的电子身份证以及电子身份证的业务适用范围的标识信息。
可选地，在终端设备发送给身份认证服务器的本地申请请求中携带终端设备标识的情况下，身份认证服务器将该用户的电子身份证、电子身份证的业务适用范围的标识信息与该终端设备标识关联起来。
CA接收到申请成功通知，保存该电子身份证信息，并记录该电子身份证的业务适用范围。CA还可以通过管理界面提示用户电子身份证申请成功，并向用户提供查看申请到的电子身份证的业务适用范围的功能。
或者，终端设备的CA或TA向身份认证服务器发送的本地申请请求中还可以携带证件包应用服务器的标识信息(例如，证件包应用的名称或URL)，便于身份认证服务器直接将申请成功通知发送给证件包应用服务器。其中，申请成功通知中携带电子身份证及其业务适用范围的标识信息。
608、证件包应用服务器记录该用户的电子身份证的业务适用范围。
证件包应用服务器接收到申请成功通知后，记录该用户的电子身份证信息以及该电子身份证的业务适用范围。
与场景一类似，CA或电子身份证应用也可以以UI形式记录为用户申请到的电子身份证的业务适用范围，参见图11中的步骤609，这里不再赘述。
本步骤608是可选的，即场景二中可以只在终端设备侧对电子身份证及其业务适用范围进行记录，而不需要在证件包服务器侧进行记录。
根据场景二中介绍的方法，终端设备可以基于终端设备上提供的可信安全平台为用户申请具有目标业务适用范围的电子身份证。
以上场景一和场景二，分别可以在不同的阶段为用户申请到具有较大业务适用范围的电子身份证。场景一是在用户已经拥有电子身份证的阶段，对电子身份证的较小的业务适用范围进行升级，从而使电子身份证的业务适用范围扩大。场景二是在用户不具有电子身份证的阶段，直接为用户申请一个具有较大的目标业务适用范围的电子身份证。
下面对本申请提供的对电子身份证的业务适用范围进行升级的装置和申请电子身份证的装置进行说明。
参见图12，图12是本申请提出的对电子身份证的业务适用范围进行升级的装置700的框图。
输入输出单元701，用于接收触发指令，触发指令用于请求对用户的电子身份证的业务适用范围进行升级；
处理单元702，用于根据输入输出单元701接收到的触发指令，确定装置700提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息；
处理单元702，还用于从身份认证服务器获得基于可信安全平台对电子身份证的业务适用范围进行升级的权限；
处理单元702，还用于生成对电子身份证的业务适用范围进行升级所需的升级信息；
收发单元703，用于将处理单元702生成的升级信息发送给身份认证服务器，以使身份认证服务器根据该升级信息对该电子身份证的业务适用范围进行升级。
可选地，处理单元702在确定可信安全平台保存有身份认证服务器的证明信息之前，还用于确定该可信安全平台中存在电子身份证应用；或者，
确定单元702在确定该可信安全平台中不存在电子身份证应用的情况下，还用于下载并安装电子身份证应用到该可信安全平台中。
可选地，该可信安全平台为可信执行环境TEE，该电子身份证应用为TEE中的可信应用TA，或者，该可信安全平台为安全单元SE，该电子身份证应用为SE中的安全应用。
可选地，该升级信息包括用户的人脸图像信息和实体身份证信息，处理单元702用于通过REE中的客户端应用CA生成所述升级信息；收发单元703用于将所述CA生成的升级信息发送给身份认证服务器，其中，升级信息中的至少一项信息是所述CA从电子身份证应用获取的；或者
处理单元702用于通过所述CA请求所述电子身份证应用生成所述升级信息；收 发单元703用于将电子身份证应用生成的升级信息发送给身份认证服务器。
可选地，该升级信息还包括签名信息，签名信息是电子身份证应用使用可信安全平台的密钥对人脸图像信息和实体身份证信息中的至少一项进行签名处理得到的信息。
可选地，该升级信息还包括电子身份证信息，或者，该升级信息还包括电子身份证信息和电子身份证信息对应的业务适用范围的标识信息。
可选地，该升级信息是使用身份认证服务器的密钥进行加密处理后的信息。
可选地，处理单元702用于通过REE中的CA向所述可信安全平台发送查询命令，查询命令用于请求查询可信安全平台是否保存有身份认证服务器的证明信息，查询命令中携带能够表征身份认证服务器的身份的信息；
以及，处理单元702用于通过CA从可信安全平台接收查询成功响应，查询成功响应用于指示可信安全平台保存有身份认证服务器的证明信息。
可选地，查询成功响应中携带能够指示可信安全平台的证书的信息，以及，收发单元703用于向身份认证服务器发送本地升级授权请求，本地升级授权请求中携带该能够指示可信安全平台的证书的信息；
以及，收发单元703还用于接收所述身份认证服务器返回的授权应答消息，授权应答消息用于指示身份认证服务器允许基于可信安全平台对电子身份证的所述业务适用范围进行升级。
可选地，收发单元703还用于通过CA向身份认证服务器发送本地升级授权请求；以及，收发单元703还用于通过CA接收身份认证服务器返回的授权应答消息；或者，
收发单元703还用于通过电子身份证应用向身份认证服务器发送本地升级授权请求；以及，收发单元703通过电子身份证应用从身份认证服务器接收授权应答消息。
可选地，本地升级授权请求中还携带随机数和随机数的签名，该随机数的签名是可信安全平台使用可信安全平台的密钥对随机数进行签名运算得到的，其中，该随机数是可信安全平台生成的，或者是CA通过查询命令发送给可信安全平台的。
可选地，该能够指示可信安全平台的证书的信息、随机数和随机数的签名中的至少一项是使用身份认证服务器的密钥进行加密处理后的信息。
应理解，装置700可以对应上述对电子身份证的业务适用范围进行升级的方法100及其各实施例中描述的终端设备。例如，装置700可以为上述方法100及其各实施例中的终端设备，或者也可以为配置在该终端设备中的芯片。装置700中各个单元分别用于执行上述方法100及其各实施例中由终端设备执行的各操作和/或处理流程。为了避免赘述，省略其详细说明。
参见图13，图13是本申请提出的申请电子身份证的装置800的框图。
输入输出单元801，用于接收触发指令，触发指令用于请求为用户申请具有目标业务适用范围的电子身份证；
处理单元802，用于根据输入输出单元801接收到的所述触发指令，确定装置800提供可信安全平台，并确定可信安全平台保存有身份认证服务器的证明信息；
处理单元802，还用于从身份认证服务器获得基于可信安全平台申请电子身份证的权限；
处理单元802，还用于生成申请具有目标业务适用范围的电子身份证所需的申请 信息；
收发单元803，用于将处理单元802生成的申请信息发送给身份认证服务器，以使身份认证服务器根据该申请信息为该用户生成具有目标业务适用范围的电子身份证。
可选地，在确定可信安全平台保存有身份认证服务器的证明信息之前，处理单元802还用于确定所述可信安全平台中存在电子身份证应用；或者
处理单元802还用于在确定所述可信安全平台中不存在所述电子身份证应用的情况下，下载并安装所述电子身份证应用到所述可信安全平台中。
可选地，可信安全平台为可信执行环境TEE，电子身份证应用为TEE中的可信应用TA，或者，可信安全平台为安全单元SE，电子身份证应用为所述SE中的安全应用。
可选地，该申请信息包括用户的人脸图像信息和实体身份证信息，处理单元802用于通过REE中的客户端应用CA生成所述申请信息；收发单元803用于将CA生成的申请信息发送给身份认证服务器，其中，申请信息中的至少一项信息是CA从电子身份证应用获取的；或者，
处理单元802用于通过CA请求电子身份证应用生成申请信息；收发单元803用于将电子身份证应用生成的申请信息发送给身份认证服务器。
可选地，该申请信息还包括签名信息，签名信息是电子身份证应用使用可信安全平台的密钥对人脸图像信息和实体身份证信息中的至少一项进行签名处理得到的信息。
可选地，该申请信息还包括目标业务适用范围的标识信息。
可选地，该申请信息是使用身份认证服务器的密钥进行加密处理后的信息。
可选地，处理单元802用于通过REE中的CA向可信安全平台发送查询命令，查询命令用于请求查询可信安全平台是否保存有身份认证服务器的证明信息，查询命令中携带能够表征身份认证服务器的身份的信息；
以及，处理单元802还用于通过CA从可信安全平台接收查询成功响应，查询成功响应用于指示可信安全平台保存有身份认证服务器的证明信息。
可选地，查询成功响应中携带能够指示可信安全平台的证书的信息，
以及，收发单元803用于向身份认证服务器发送本地申请授权请求，本地申请授权请求中携带该能够指示所述可信安全平台的证书的信息；
以及，收发单元803还用于接收身份认证服务器返回的授权应答消息，授权应答消息用于指示身份认证服务器允许基于可信安全平台为用户申请具有目标业务适用范围的电子身份证。
可选地，收发单元803通过CA向身份认证服务器发送本地申请授权请求；以及，收发单元803还用于通过CA接收身份认证服务器返回的授权应答消息；或者，
收发单元803用于通过电子身份证应用向身份认证服务器发送本地申请授权请求；以及，收发单元803还用于通过电子身份证应用从身份认证服务器接收授权应答消息。
可选地，本地申请授权请求中还携带随机数和随机数的签名，该随机数的签名是可信安全平台使用可信安全平台的密钥对随机数进行签名运算得到的，其中，随机数是可信安全平台生成的，或者是CA通过查询命令发送给可信安全平台的。
可选地，所述能够指示可信安全平台的证书的信息、随机数和随机数的签名中的 至少一项是使用身份认证服务器的密钥进行加密处理后的信息。
应理解，装置800可以对应上述申请电子身份证的方法500及其各实施例中描述的终端设备。例如，装置800可以为上述方法500及其各实施例中的终端设备，或者也可以为配置在该终端设备中的芯片。并且，装置800中各个单元分别用于执行上述方法500及其各实施例中由终端设备执行的各操作和/或处理流程。为了避免赘述，省略其详细说明。
参见图14，图14是适用于本申请实施例的终端设备900的结构示意图。本领域技术人员应理解，图14中示出的结构不应对本申请中的终端设备构成限定，终端设备900可以包括比图14示出的更多或更少的部件，或者组合某些部件等。
收发器910用于建立通信信道，使终端设备通过所述通信信道以连接至远程服务器，并从所述远程服务器下媒体数据。所述收发器910可以包括无线局域网(wireless local area network,wireless LAN)模块、蓝牙模块、近场通信(near field communication,NFC)模块、基带(base band)模块等通信模块以及所述通信模块对应的射频(radio frequency,RF)电路，用于进行无线局域网络通信、蓝牙通信、NFC通信、红外线通信和/或蜂窝式通信系统通信。RF电路用于信息收发或通话过程中信号的接收和发送。例如，将基站的下行信息接收后，给处理器920处理，或者，将上行数据发送给基站。又例如，从外部NFC设备接收信息后，给处理器920处理，再将处理结果发送给外部NFC设备。通常，所述射频电路包括用于执行这些功能的公知电路，包括但不限于天线系统、射频收发机、一个或多个放大器、调谐器、一个或多个振荡器、数字信号处理器、编解码(Codec)芯片组、用户身份模块(subscriber identification module,SIM)卡、存储器等等。此外，射频电路还可以通过无线通信与网络和其它设备通信。所述无线通信可以采用任意一种通信标准或协议，包括但不限于无线局域网(wireless local area networks，WLAN)全球移动通讯(global system of mobile communication，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)系统、未来的第五代(5th generation，5G)系统或新无线(new radio，NR)等。
在本申请实施例中，终端设备与身份认证服务器、证件包应用服务器之间信息、数据和/或信令的交互可以通过收发器910实现。例如，终端设备可以通过收发器910向身份认证服务器发送本地升级授权请求、本地申请授权请求等，还可以通过收发器910将处理器920生成的升级信息或申请信息发送给身份认证服务器。终端设备还可以从身份认证服务器接收本地授权应答、查询成功响应等消息。此外，终端设备通过NFC通道读取用户的实体身份证信息，也可以通过收发器910实现。这里不再一一列举。
处理器920是终端设备的控制中心，利用各种接口和线路连接整个终端设备的各个部分，通过运行或执行存储在存储器内的软件程序和/或模块，以及调用存储在存储 器内的数据，以执行终端设备的各种功能和/或处理数据。例如，在本申请实施例中，升级信息、申请信息的生成、确定终端设备是否提供可信安全平台、判断可信安全平台上是否保存有身份认证服务器的证明信息、对可信安全平台信息进行加密和/或签名操作等都可以由处理器执行。处理器可以由集成电路(integrated circuit,IC)组成。例如，可以由单颗封装的IC所组成，也可以由连接多颗相同功能或不同功能的封装IC而组成。处理器920可以仅包括中央处理器(central processing unit,CPU)，也可以是GPU、数字信号处理器(digital signal processor,DSP)以及终端设备900中的控制芯片(例如，基带芯片)的组合。在本申请实施方式中，CPU可以是单运算核心，也可以包括多运算核心。
存储器930可用于存储软件程序和模块，处理器920通过运行存储在存储器930的软件程序和模块，从而执行终端设备900的各种功能应用以及数据处理。存储器930可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(例如，声音播放功能、图像播放功能等)等。存储数据区可存储根据终端设备900的使用所创建的数据(例如，音频数据、图像数据、电话本等)。在本申请实施方式中，存储器930可以包括易失性存储器，例如非挥发性动态随机存取内存(nonvolatile random access memory，NVRAM)、相变化随机存取内存(phase change RAM,PRAM)、磁阻式随机存取内存(magetoresistive RAM,MRAM)等，还可以包括非易失性存储器，例如,一个或多个磁盘存储器件、电子可擦除可编程只读存储器(electrically erasable programmable read-only memory,EEPROM)，闪存器件，例如，反或闪存(NOR flash memory)或是反及闪存(NAND flash memory)。非易失存储器储存处理器元所执行的操作系统及应用程序。处理器从非易失存储器加载运行程序与数据到内存并将数字内容储存于大量储存装置中。上述操作系统包括用于控制和管理常规系统任务，例如，内存管理、存储设备控制、电源管理等，以及有助于各种软硬件之间通信的各种组件和/或驱动器。在本申请实施方式中，操作系统可以是Google公司的安卓(Android)系统、苹果公司开发的iOS系统、Microsoft公司开发的Windows操作系统等，或者还可以是Vxworks这种嵌入式操作系统。上述应用程序包括安装在终端设备上的任何应用，包括但不限于浏览器、电子邮件、即时消息服务、文字处理、键盘虚拟、窗口小部件(Widget)、加密、数字版权管理、语音识别、语音复制、定位(例如，由全球定位系统提供的功能)、音乐播放等。在本申请实施例中，终端设备涉及到数据的存储，例如，应用程序及用户数据的存储、各类服务器(例如，证件包应用服务器、身份认证服务器)的证书的预置、CTID的安全存储等。
输入设备940可用于实现用户与终端设备的交互，和/或将信息输入到终端设备中。例如，输入设备940可以接收用户输入的数字或字符信息，以产生与用户设置或功能控制有关的信号输入。在本申请实施例中，输入设备940可以是触控面板941，或者还可以是其它人机交互界面，例如，实体输入键、麦克风，还可以是其它外部信息撷取设备，例如摄像头(图14中未示出)等。触控面板也称为触摸屏或触控屏，可收集用户在其上触摸或接近的操作动作。例如，用户使用手指、触笔等任何适合的物体或附件在触控面板上或接近触控面板的位置的操作动作，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板可包括触摸检测装置和触摸控制器两个部分。其中， 触摸检测装置检测用户的触摸操作，并将检测到的触摸操作转换为电信号，以及将所述电信号传送给触摸控制器；触摸控制器从触摸检测装置上接收所述电信号，并将它转换成触点坐标，再送给处理器920。所述触摸控制器还可以接收处理器920发来的命令并执行。此外，可以采用电阻式、电容式、红外线(Infrared)以及表面声波等多种类型实现触控面板。在本申请的其它实施方式中，输入设备940所采用的实体输入键可以包括但不限于物理键盘、功能键(例如，音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。麦克风形式的输入设备可以收集用户或环境输入的语音并将其转换成电信号形式的、处理器920可执行的命令。
在本申请实施例中，终端设备900可以通过输入设备940实现与用户的交互。例如，终端设备可以通过触控面板951接收触发指令，或者通过触控面板951接收用户手动输入的实体身份证信息。又例如，运行在REE中的客户端应用CA、运行在TEE或SE中的电子身份证应用通过摄像头采集用户的人脸图像信息等。
输出设备950可用于显示由用户输入的信息或提供给用户的信息以及终端设备900的各种菜单，还可以接受用户输入。输出设备950包括但不限于影像输出单元和声音输出单元。影像输出单元用于输出文字、图片和/或视频。所述影像输出单元可包括显示面板，显示面板951可以采用液晶显示器(liquid crystal display，LCD)、有机发光二极管(organic light-emitting diode，OLED)、场发射显示器(field emission display，FED)等形式来配置。或者，所述影像输出单元可以包括反射式显示器，例如，电泳式(electrophoretic)显示器，或利用光干涉调变技术(interferometric modulation of light)的显示器。所述影像输出单元可以包括单个显示器或不同尺寸的多个显示器。在本申请的具体实施方式中，上述输入设备940所采用的触控面板941亦可同时作为输出设备950的显示面板951。例如，当触控面板检测到在其上的触摸或接近的手势操作后，传送给处理器920以确定触摸事件的类型，随后处理器920根据触摸事件的类型在显示面板951上提供相应的视觉输出。虽然在图14中，输入设备940与输出设备950是作为两个独立的部件来实现电子设备的输入和输出功能，但是在某些实施例中，可以将触控面板941与显示面板951集成一体而实现终端设备的输入和输出功能。例如，所述影像输出单元可以显示各种图形化用户接口(graphical user interface,GUI)以作为虚拟控制组件，包括但不限于窗口、卷动轴、图标及剪贴簿，以供用户通过触控方式进行操作。
例如，本申请实施例中图3、图4、图5和/或图9中所示的管理界面、提示框可以由输出设备950中的显示面板951显示。
传感器960可以为一种或多种。例如，传感器960可以包括光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板951的亮度，接近传感器可在终端设备900移动到耳边时，关闭显示面板951和/或背光。作为运动传感器的一种，加速度传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别终端设备姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等。此外，终端设备900还可配置的重力感应器(也可以称为重力传感器)、陀螺仪、气压计、湿度计、温度计、红 外线传感器等其他传感器，在此不再赘述。例如，在本申请实施例中，输入设备、输出设备也可以通过传感器实现，终端设备可以通过传感器检测用户在触控面板941上的操作，以接收触发指令。
终端设备900还可以包括音频电路970，音频电路970可提供用户与终端设备900之间的音频接口。音频电路970可将接收到的音频数据转换后的信号，传输到扬声器971，由扬声器971转换为声音信号输出。另一方面，麦克风972将收集的声音信号转换为信号，由音频电路970接收后转换为音频数据，再将音频数据输出至收发器910以发送给另一终端设备，或者将音频数据输出至处理器920以作进一步处理。
此外，终端设备900还包括给各个部件供电的电源980(例如，电池)。优选的，电源980可以通过电源管理系统与处理器920逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗等功能。
图14中所示的终端设备900可用于实现本申请提供的对电子身份证的业务适用范围进行升级的方法，也可以用于实现本申请提供的申请电子身份证的方法。
例如，在场景一中，终端设备900通过输入设备940(例如，可以是触控面板941)检测用户操作，以接收用于请求对用户的电子身份证的业务适用范围进行升级的触发指令。输入设备940将接收到的触发指令发送至处理器920。处理器920通过调用并运行存储在存储器930中的软件程序和/或模块，确定终端设备900是否提供可信安全平台，并在确定终端设备900提供可信安全平台的情况下，判断可信安全平台是否保存有身份认证服务器的证明信息。在可信安全平台保存有身份认证服务器的证明信息的情况下，终端设备通过处理器920生成对电子身份证的业务适用范围进行升级所需的升级信息，并通过收发器910将该升级信息发送给身份认证服务器，以使身份认证服务器根据该升级信息，对该用户的电子身份证的业务适用范围进行升级。
又例如，在场景二中，终端设备900通过输入设备940(例如，可以是触控面板941)接收用户输入的用于请求为用户申请具有目标业务适用范围的电子身份证的触发指令。输入设备940将接收到的触发指令发送至处理器920。处理器920通过调用并运行存储在存储器930中的软件程序和/或模块，确定终端设备900是否提供可信安全平台，并在确定终端设备900提供可信安全平台的情况下，判断可信安全平台是否保存有身份认证服务器的证明信息。在可信安全平台保存有身份认证服务器的证明信息的情况下，终端设备通过处理器920生成为用户申请具有目标业务适用范围的电子身份证所需的申请信息，并通过收发器910将该申请信息发送给身份认证服务器，以使身份认证服务器根据该申请信息，为用户生成具有目标业务适用范围的电子身份证。
终端设备900可以对应上述方法实施例中描述的终端设备，并且，终端设备900的各器件和/或设备分别用于执行上述方法实施例中由终端设备所执行的操作和/或处理过程，这里，为了避免赘述，省略其详细说明。
应理解，图12中所示的装置700可以为图14中所示的终端设备900。例如。输入输出单元701的输入功能可以通过图14中的输入设备940实现，输入输出单元701的输出功能可以通过图14中的输出设备950实现。处理单元702可以通过图14中的处理器920实现。收发单元703可以通过图14中的收发器910实现。
同样地，图13中所示的装置800也可以为图14中所示的终端设备900。例如。 输入输出单元801的输入功能可以通过图14中的输入设备940实现，输入输出单元801的输出功能可以通过图14中的输出设备950实现。处理单元802可以通过图14中的处理器920实现。收发单元803可以通过图14中的收发器910实现。
此外，装置700也可以是配置在终端设备900中的芯片。此种情况下，输入输出单元701和收发单元703可以是芯片上的输入输出接口/输入输出电路。处理单元701可以为芯片的处理器。终端设备900通过该芯片、输入设备940、输出设备950和收发器910可以实现场景一中的终端设备所具备的功能。例如，输入设备940接收用于请求对用户的电子身份证的业务适用范围进行升级的触发指令，并将该触发指令通过芯片的输入接口/输入电路输入给芯片的处理器。芯片的处理器在接收到触发指令之后，生成升级信息，再将该升级信息通过输出接口/输出电路输出给收发器910，由收发器910将该升级信息发送给身份认证服务器。
可选地，芯片的处理器可以独立于终端设备中的处理器920，或者也可以通过终端设备中的处理器920来实现。
同样地，装置800也可以是配置在终端设备900中的芯片。此种情况下，输入输出单元801和收发单元803可以是芯片上的输入输出接口/输入输出电路。处理单元801可以为芯片的处理器。终端设备900通过该芯片、输入设备940、输出设备950和收发器910可以实现场景二中的终端设备所具备的功能。例如，输入设备940接收用于请求申请具有目标业务适用范围的电子身份证的触发指令，并将该触发指令通过芯片的输入接口/输入电路输入给芯片的处理器。芯片的处理器在接收到触发指令之后，生成申请信息，再将该申请信息通过芯片的输出接口/输出电路输出给收发器910，由收发器910将该申请信息发送给终身份认证服务器。
可选地，芯片的处理器可以独立于终端设备中的处理器920，或者也可以通过终端设备中的处理器920来实现。
此外，本申请提供一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，当该计算机程序在计算机上运行时，使得计算机执行方法100及其任意可能的实现方式的方法中由终端设备执行的相应操作和/或处理过程。
本申请提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当该计算机程序在计算机上运行时，使得计算机执行方法500及其任意可能的实现方式的方法中由终端设备执行的相应操作和/或处理过程。
本申请提供一种芯片，包括存储器和处理器，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片的终端设备执行方法100及其任意可能的实现方式的方法中由终端设备执行的相应操作和/或处理过程。
本申请提供一种芯片，包括存储器和处理器，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片的终端设备执行方法500及其任意可能的实现方式的方法中由终端设备执行的相应操作和/或处理过程。
本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序，当该计算机程序在计算机上运行时，使得计算机执行方法100及其任意可能的实现方式的方法中由终端设备执行的相应操作和/或处理过程。
本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序，当该计算 机程序在计算机上运行时，使得计算机执行方法500及其任意可能的实现方式的方法中由终端设备执行的相应操作和/或处理过程。
可选地，上述计算机程序可以全部或部分存储在与处理器封装在一起的存储介质上，也可以部分或全部存储在不与处理器封装在一起的存储器上。
上述实施例中，“和/或”描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况。其中A，B可以是单数或者复数。
另外，在上述实施例中，“至少一个”表示一个或多个。多个可以是两个或两个以上。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
应理解，本申请所提供的实施例中所揭露的装置和方法，也可以通过其它的方式实现。另外，以上所描述的装置实施例仅仅是示意性的。例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。例如，多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的。作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要，选择其中的部分或者全部单元来实现本实施例的技术方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory,ROM)、随机存取存储器(random access memory,RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的范围之内。本申请的保护范围应以所述权利要求的保护范围为准。

Claims (26)

  1. 一种对电子身份证的业务适用范围进行升级的方法，其特征在于，包括：
    终端设备接收触发指令，所述触发指令用于请求对用户的电子身份证的业务适用范围进行升级；
    所述终端设备确定所述终端设备提供可信安全平台，并确定所述可信安全平台保存有身份认证服务器的证明信息；
    所述终端设备从所述身份认证服务器获得基于所述可信安全平台对所述电子身份证的业务适用范围进行升级的权限；
    所述终端设备生成对所述电子身份证的业务适用范围进行升级所需的升级信息，并向所述身份认证服务器发送所述升级信息，以使所述身份认证服务器根据所述升级信息对所述电子身份证的所述业务适用范围进行升级。
  2. 根据权利要求1所述的方法，其特征在于，所述终端设备确定所述可信安全平台保存有身份认证服务器的证明信息之前，所述方法还包括：
    所述终端设备确定所述可信安全平台中存在电子身份证应用；或者
    所述终端设备在确定所述可信安全平台中不存在所述电子身份证应用的情况下，下载并安装所述电子身份证应用到所述可信安全平台中。
  3. 根据权利要求2所述的方法，其特征在于，所述可信安全平台为可信执行环境TEE，所述电子身份证应用为所述TEE中的可信应用TA，或者，
    所述可信安全平台为安全单元SE，所述电子身份证应用为所述SE中的安全应用。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，所述升级信息包括用户的人脸图像信息和实体身份证信息，
    所述终端设备生成对所述电子身份证的业务适用范围进行升级所需的升级信息，并向所述身份认证服务器发送所述升级信息，包括：
    所述终端设备通过富执行环境REE中的客户端应用CA生成所述升级信息，并通过所述CA向所述身份认证服务器发送所述升级信息，其中，所述升级信息中的至少一项信息是所述CA从所述电子身份证应用获取的；或者
    所述终端设备通过所述CA请求所述电子身份证应用生成所述升级信息，并由所述电子身份证应用向所述身份认证服务器发送所述升级信息。
  5. 根据权利要求4所述的方法，其特征在于，所述升级信息还包括签名信息，所述签名信息是所述电子身份证应用使用所述可信安全平台的密钥对所述人脸图像信息和所述实体身份证信息中的至少一项进行签名处理得到的信息。
  6. 根据权利要求4或5所述的方法，其特征在于，所述升级信息还包括电子身份证信息，或者
    所述升级信息还包括所述电子身份证信息和所述电子身份证信息对应的所述业务适用范围的标识信息。
  7. 根据权利要求4-6中任一项所述的方法，所述升级信息是使用所述身份认证服务器的密钥进行加密处理后的信息。
  8. 根据权利要求1-7中任一项所述的方法，其特征在于，所述终端设备确定所述可信安全平台保存有身份认证服务器的证明信息，包括：
    所述终端设备通过REE中的CA向所述可信安全平台发送查询命令，所述查询命令用于请求查询所述可信安全平台是否保存有所述身份认证服务器的证明信息，所述查询命令中携带能够表征所述身份认证服务器的身份的信息；
    所述终端设备通过所述CA从所述可信安全平台接收查询成功响应，所述查询成功响应用于指示所述可信安全平台保存有所述身份认证服务器的证明信息。
  9. 根据权利要求8所述的方法，其特征在于，所述查询成功响应中携带能够指示所述可信安全平台的证书的信息，
    以及，所述终端设备从所述身份认证服务器获得基于所述可信安全平台对所述电子身份证的所述业务适用范围进行升级的权限，包括：
    所述终端设备向所述身份认证服务器发送本地升级授权请求，所述本地升级授权请求中携带所述能够指示所述可信安全平台的证书的信息；
    所述终端设备接收所述身份认证服务器返回的授权应答消息，所述授权应答消息用于指示所述身份认证服务器允许基于所述可信安全平台对所述电子身份证的所述业务适用范围进行升级。
  10. 根据权利要求9所述的方法，其特征在于，所述终端设备向所述身份认证服务器发送本地升级授权请求，包括：
    所述终端设备通过所述CA向所述身份认证服务器发送所述本地升级授权请求；
    以及，所述终端设备接收所述身份认证服务器返回的授权应答消息，包括：
    所述终端设备通过所述CA接收所述身份认证服务器返回的所述授权应答消息；或者，
    所述终端设备向所述身份认证服务器发送本地升级授权请求，包括：
    所述终端设备通过所述电子身份证应用向所述身份认证服务器发送所述本地升级授权请求；
    以及，所述终端设备接收所述身份认证服务器返回的授权应答消息，包括：
    所述终端设备通过所述电子身份证应用从所述身份认证服务器接收所述授权应答消息。
  11. 根据权利要求9或10所述的方法，其特征在于，所述本地升级授权请求中还携带随机数和随机数的签名，所述随机数的签名是所述可信安全平台使用所述可信安全平台的密钥对所述随机数进行签名运算得到的，其中，所述随机数是所述可信安全平台生成的，或者是所述CA通过查询命令发送给所述可信安全平台的。
  12. 根据权利要求9-11中任一项所述的方法，其特征在于，所述能够指示所述可信安全平台的证书的信息、所述随机数和所述随机数的签名中的至少一项是使用所述身份认证服务器的密钥进行加密处理后的信息。
  13. 一种申请电子身份证的方法，其特征在于，包括：
    终端设备接收触发指令，所述触发指令用于请求为用户申请具有目标业务适用范围的电子身份证，其中，业务适用范围用于指定所述电子身份证能够适用的业务；
    所述终端设备确定所述终端设备提供可信安全平台，并确定所述可信安全平台保存有身份认证服务器的证明信息；
    所述终端设备从所述身份认证服务器获得基于所述可信安全平台为所述用户申请 具有所述目标业务适用范围的电子身份证的权限；
    所述终端设备生成申请具有所述目标业务适用范围的电子身份证所需的申请信息，并向所述身份认证服务器发送所述申请信息，以使所述身份认证服务器根据所述申请信息为所述用户生成具有所述目标业务适用范围的电子身份证。
  14. 根据权利要求13所述的方法，其特征在于，所述终端设备确定所述可信安全平台保存有身份认证服务器的证明信息之前，所述方法还包括：
    所述终端设备确定所述可信安全平台中存在电子身份证应用；或者
    所述终端设备在确定所述可信安全平台中不存在所述电子身份证应用的情况下，下载并安装所述电子身份证应用到所述可信安全平台中。
  15. 根据权利要求14所述的方法，其特征在于，所述可信安全平台为可信执行环境TEE，所述电子身份证应用为所述TEE中的可信应用TA，或者，
    所述可信安全平台为安全单元SE，所述电子身份证应用为所述SE中的安全应用。
  16. 根据权利要求13-15中任一项所述的方法，其特征在于，所述申请信息包括用户的人脸图像信息和实体身份证信息，
    所述终端设备生成申请具有所述目标业务适用范围的电子身份证所需的申请信息，并向所述身份认证服务器发送所述申请信息，包括：
    所述终端设备通过富执行环境REE中的客户端应用CA生成所述申请信息，并通过所述CA向所述身份认证服务器发送所述申请信息，其中，所述申请信息中的至少一项信息是所述CA从所述电子身份证应用获取的；或者
    所述终端设备通过所述CA请求所述电子身份证应用生成所述申请信息，并由所述电子身份证应用向所述身份认证服务器发送所述申请信息。
  17. 根据权利要求16所述的方法，其特征在于，所述申请信息还包括签名信息，所述签名信息是所述电子身份证应用使用所述可信安全平台的密钥对所述人脸图像信息和所述实体身份证信息中的至少一项进行签名处理得到的信息。
  18. 根据权利要求16或17所述的方法，其特征在于，所述申请信息还包括所述目标业务适用范围的标识信息。
  19. 根据权利要求16-18中任一项所述的方法，所述申请信息是使用所述身份认证服务器的密钥进行加密处理后的信息。
  20. 根据权利要求13-19中任一项所述的方法，其特征在于，所述终端设备确定所述可信安全平台保存有身份认证服务器的证明信息，包括：
    所述终端设备通过REE中的CA向所述可信安全平台发送查询命令，所述查询命令用于请求查询所述可信安全平台是否保存有所述身份认证服务器的证明信息，所述查询命令中携带能够表征所述身份认证服务器的身份的信息；
    所述终端设备通过所述CA从所述可信安全平台接收查询成功响应，所述查询成功响应用于指示所述可信安全平台保存有所述身份认证服务器的证明信息。
  21. 根据权利要求20所述的方法，其特征在于，所述查询成功响应中携带能够指示所述可信安全平台的证书的信息，
    以及，所述终端设备从所述身份认证服务器获得基于所述可信安全平台为所述用户申请具有所述目标业务的电子身份证的权限，包括：
    所述终端设备向所述身份认证服务器发送本地申请授权请求，所述本地申请授权请求中携带所述能够指示所述可信安全平台的证书的信息；
    所述终端设备接收所述身份认证服务器返回的授权应答消息，所述授权应答消息用于指示所述身份认证服务器允许基于所述可信安全平台为所述用户申请具有所述目标业务适用范围的电子身份证。
  22. 根据权利要求21所述的方法，其特征在于，所述终端设备向所述身份认证服务器发送本地申请授权请求，包括：
    所述终端设备通过所述CA向所述身份认证服务器发送所述本地申请授权请求；
    以及，所述终端设备接收所述身份认证服务器返回的授权应答消息，包括：
    所述终端设备通过所述CA接收所述身份认证服务器返回的所述授权应答消息；或者，
    所述终端设备向所述身份认证服务器发送本地申请授权请求，包括：
    所述终端设备通过所述电子身份证应用向所述身份认证服务器发送所述本地申请授权请求；
    以及，所述终端设备接收所述身份认证服务器返回的授权应答消息，包括：
    所述终端设备通过所述电子身份证应用从所述身份认证服务器接收所述授权应答消息。
  23. 根据权利要求21或22所述的方法，其特征在于，所述本地申请授权请求中还携带随机数和随机数的签名，所述随机数的签名是所述可信安全平台使用所述可信安全平台的密钥对所述随机数进行签名运算得到的，其中，所述随机数是所述可信安全平台生成的，或者是所述CA通过查询命令发送给所述可信安全平台的。
  24. 根据权利要求21-23中任一项所述的方法，其特征在于，所述能够指示所述可信安全平台的证书的信息、所述随机数和所述随机数的签名中的至少一项是使用所述身份认证服务器的密钥进行加密处理后的信息。
  25. 一种终端设备，其特征在于，包括：
    输入输出设备，用于接收触发指令，所述触发指令用于请求对用户的电子身份证的业务适用范围进行升级；
    处理器，用于在所述输入输出设备接收到所述触发指令的情况下确定所述终端设备提供可信安全平台，并确定所述可信安全平台保存有身份认证服务器的证明信息；
    所述处理器，还用于在确定所述可信安全平台保存有所述身份认证服务器的证明信息的情况下，从所述身份认证服务器获得基于所述可信安全平台对所述电子身份证的业务适用范围进行升级的权限；
    所述处理器，还用于生成对所述电子身份证的业务适用范围进行升级所需的升级信息；
    收发器，用于将所述处理器生成的所述升级信息发送给所述身份认证服务器，以使所述身份认证服务器根据所述升级信息对所述电子身份证的业务适用范围进行升级。
  26. 一种终端设备，其特征在于，包括：
    输入输出设备，用于接收触发指令，所述触发指令用于请求为用户申请具有目标业务适用范围的电子身份证，其中，业务适用范围用于指定所述电子身份证能够适用 的业务；
    处理器，用于在所述输入输出设备接收到所述触发指令的情况下确定所述终端设备提供可信安全平台，并确定所述可信安全平台保存有身份认证服务器的证明信息；
    所述处理器，还用于从所述身份认证服务器获得基于所述可信安全平台为所述用户申请具有所述目标业务适用范围的电子身份证的权限；
    所述处理器，还用于生成申请具有所述目标业务适用范围的电子身份证所需的申请信息；
    所述收发器，还用于向所述身份认证服务器发送所述申请信息，以使所述身份认证服务器根据所述申请信息为所述用户生成具有所述目标业务适用范围的电子身份证。
PCT/CN2019/098318 2018-08-03 2019-07-30 对电子身份证的业务适用范围进行升级的方法和终端设备 WO2020024929A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP19844644.5A EP3817322A4 (en) 2018-08-03 2019-07-30 PROCESS FOR UPGRADING A SERVICE APPLICATION RANGE OF AN ELECTRONIC IDENTITY CARD, AND TERMINAL DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810876556.5 2018-08-03
CN201810876556.5A CN110795737A (zh) 2018-08-03 2018-08-03 对电子身份证的业务适用范围进行升级的方法和终端设备

Publications (1)

Publication Number Publication Date
WO2020024929A1 true WO2020024929A1 (zh) 2020-02-06

Family

ID=69231404

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/098318 WO2020024929A1 (zh) 2018-08-03 2019-07-30 对电子身份证的业务适用范围进行升级的方法和终端设备

Country Status (3)

Country Link
EP (1) EP3817322A4 (zh)
CN (1) CN110795737A (zh)
WO (1) WO2020024929A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111539752A (zh) * 2020-04-29 2020-08-14 中国银行股份有限公司 一种身份认证的方法、装置、存储介质及电子设备
CN111582949A (zh) * 2020-05-26 2020-08-25 深圳市元征科技股份有限公司 一种业务功能实现的方法及服务器
CN111756733A (zh) * 2020-06-23 2020-10-09 恒生电子股份有限公司 一种身份认证方法和相关装置
CN112861107A (zh) * 2021-02-07 2021-05-28 新大陆（福建）公共服务有限公司 一种可信数字身份文件存储于ic卡介质的应用方法
CN113434849A (zh) * 2020-09-04 2021-09-24 支付宝(杭州)信息技术有限公司 一种基于可信硬件的数据管理方法、装置及设备
CN113993131A (zh) * 2021-10-28 2022-01-28 中国联合网络通信集团有限公司 访问控制方法及装置
CN114650140A (zh) * 2020-12-21 2022-06-21 国民科技(深圳)有限公司 执行电子签名的移动终端、服务器和执行电子签名的方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101557308A (zh) * 2009-05-06 2009-10-14 成都市华为赛门铁克科技有限公司 一种文件的升级方法及终端设备
CN102609277A (zh) * 2011-08-26 2012-07-25 威海捷讯通信技术有限公司 一种移动终端应用软件升级方法
CN102799631A (zh) * 2012-06-26 2012-11-28 公安部第三研究所 基于rest实现网络电子身份标识业务过程管理控制的方法
CN104270386A (zh) * 2014-10-22 2015-01-07 中国建设银行股份有限公司 跨应用系统用户信息整合方法及身份信息管理服务器
CN108122112A (zh) * 2017-12-14 2018-06-05 杨宪国 基于鉴权装置的电子身份证签发认证和安全支付系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009100230A1 (en) * 2008-02-07 2009-08-13 Inflexis Corporation Mobile electronic security apparatus and method
US9721086B2 (en) * 2013-03-15 2017-08-01 Advanced Elemental Technologies, Inc. Methods and systems for secure and reliable identity-based computing
US10158491B2 (en) * 2013-04-08 2018-12-18 Antonio Salvatore Piero Vittorio Bonsignore Qualified electronic signature system, method and mobile processing terminal for qualified electronic signature
CN108173870B (zh) * 2018-01-15 2021-02-19 广州大白互联网科技有限公司 一种用于身份认证的网证生成方法和系统
CN108229179A (zh) * 2018-01-31 2018-06-29 郑州云海信息技术有限公司 一种提高系统安全性的方法、装置、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101557308A (zh) * 2009-05-06 2009-10-14 成都市华为赛门铁克科技有限公司 一种文件的升级方法及终端设备
CN102609277A (zh) * 2011-08-26 2012-07-25 威海捷讯通信技术有限公司 一种移动终端应用软件升级方法
CN102799631A (zh) * 2012-06-26 2012-11-28 公安部第三研究所 基于rest实现网络电子身份标识业务过程管理控制的方法
CN104270386A (zh) * 2014-10-22 2015-01-07 中国建设银行股份有限公司 跨应用系统用户信息整合方法及身份信息管理服务器
CN108122112A (zh) * 2017-12-14 2018-06-05 杨宪国 基于鉴权装置的电子身份证签发认证和安全支付系统

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
See also references of EP3817322A4
YANG MING-HUI; LIU MENG-ZHAN; ZOU XIANG; WANG ZHI-PENG; RAO JIE: "Reference of Germany elD Mechanism for China Network Identity Management", COMPUTER TECHNOLOGY AND DEVELOPMENT, vol. 24, no. 7, 31 July 2014 (2014-07-31), pages 157 - 161, XP009525346, DOI: 10.3969/j.issn.1673-629X.2014.07.039 *

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111539752A (zh) * 2020-04-29 2020-08-14 中国银行股份有限公司 一种身份认证的方法、装置、存储介质及电子设备
CN111582949A (zh) * 2020-05-26 2020-08-25 深圳市元征科技股份有限公司 一种业务功能实现的方法及服务器
CN111756733A (zh) * 2020-06-23 2020-10-09 恒生电子股份有限公司 一种身份认证方法和相关装置
CN113434849A (zh) * 2020-09-04 2021-09-24 支付宝(杭州)信息技术有限公司 一种基于可信硬件的数据管理方法、装置及设备
CN114650140A (zh) * 2020-12-21 2022-06-21 国民科技(深圳)有限公司 执行电子签名的移动终端、服务器和执行电子签名的方法
CN112861107A (zh) * 2021-02-07 2021-05-28 新大陆（福建）公共服务有限公司 一种可信数字身份文件存储于ic卡介质的应用方法
CN112861107B (zh) * 2021-02-07 2022-06-21 新大陆（福建）公共服务有限公司 一种可信数字身份文件存储于ic卡介质的应用方法
CN113993131A (zh) * 2021-10-28 2022-01-28 中国联合网络通信集团有限公司 访问控制方法及装置
CN113993131B (zh) * 2021-10-28 2023-06-30 中国联合网络通信集团有限公司 访问控制方法及装置

Also Published As

Publication number Publication date
EP3817322A4 (en) 2021-05-19
EP3817322A1 (en) 2021-05-05
CN110795737A (zh) 2020-02-14

Similar Documents

Publication Publication Date Title
WO2020024929A1 (zh) 对电子身份证的业务适用范围进行升级的方法和终端设备
US10091197B2 (en) Configuring, controlling and monitoring computers using mobile devices
US10754941B2 (en) User device security manager
WO2018228199A1 (zh) 一种授权方法以及相关设备
EP2997466B1 (en) Context aware virtual desktop
KR102223609B1 (ko) 전자 기기간 콘텐트 공유 방법 및 장치
CN109472166A (zh) 一种电子签章方法、装置、设备及介质
US9407642B2 (en) Application access control method and electronic apparatus implementing the same
WO2018000370A1 (zh) 一种移动终端的认证方法及移动终端
WO2017211205A1 (zh) 一种白名单更新方法和装置
WO2019206201A1 (zh) 一种配置文件传输方法及相关设备和存储介质
WO2019179394A1 (zh) 一种获取身份信息的方法、终端及验证服务器
WO2021115113A1 (zh) 数据处理方法、装置及存储介质
US11017066B2 (en) Method for associating application program with biometric feature, apparatus, and mobile terminal
JP2010049420A (ja) 情報処理装置、情報処理方法、情報処理プログラムおよび情報処理システム
WO2017206833A1 (zh) 支付方法、支付设备和支付服务器
EP3764258B1 (en) Constructing common trusted application for a plurality of applications
WO2015144066A1 (en) Sensitive operation verification method, apparatus, and system
JP2014519674A (ja) トラステッドプラットフォーム基盤の開放型ｉｄ認証方法、このための装置及びシステム
US10211991B1 (en) Method for downloading preauthorized applications to desktop computer using secure connection
US11233661B2 (en) Device and method for authenticating application in execution environment in trust zone
US9872176B2 (en) Method for processing authentication, electronic device and server for supporting the same
EP2533150B1 (en) Methods and devices for controlling access to computing resources
CN111489172A (zh) 一种资质信息的认证方法和终端以及服务器
CN116886367A (zh) 安全认证的方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19844644

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019844644

Country of ref document: EP

Effective date: 20210128