WO2020088323A1

WO2020088323A1 - Capability exposure method and device

Info

Publication number: WO2020088323A1
Application number: PCT/CN2019/112731
Authority: WO
Inventors: 王思善; 赵晓娜; 常新苗
Original assignee: 华为技术有限公司
Priority date: 2018-11-01
Filing date: 2019-10-23
Publication date: 2020-05-07

Abstract

A capability exposure method and a device, able to solve the problem in the prior art that the security of a service executed by means of a TEE+SE security framework cannot be guaranteed. In the present application, an SE and a TEE establish a session used for communications. The SE, by means of said session, sends an acquisition instruction used to acquire a security certificate of the TEE to the TEE. The TEE receives the acquisition instruction from the SE by means of the session. After receiving the acquisition instruction, the TEE, on the basis of attribute information of the TEE, generates a security certificate, and by means of the session, sends the generated security certificate to the SE. The SE receives, by means of the session, the security certificate sent by the TEE, and then, on the basis of the security certificate and a preset security policy, determines that the TEE is in a secure state. After determining that the TEE is in a secure state, the SE exposes a first capability to a third party service in the SE, the first capability being implemented on the basis of a second capability of the TEE.

Description

Ability opening method and device

This application requires a Chinese patent application submitted to the State Intellectual Property Office of China on November 1, 2018, with the application number 201811297353.7, and the application name is "a method for SE to validate TEE and activate TUI capabilities" and filed on December 5, 2018 China Patent Office, the application number is 201811478516.1, the priority of the application name is "a capability opening method and device", the entire content of which is incorporated by reference in this application.

Technical field

This application relates to the technical field of terminal security verification, and in particular, to a capability opening method and device.

Background technique

In order to ensure the security of the terminal's execution of services, a trusted execution environment (TEE) + security unit (SE) security architecture is introduced into the terminal. The TEE + SE security architecture passes the SE with a higher security level Cooperate with the TEE whose security level is lower than the SE to perform the business with higher security requirements in the terminal.

In the prior art, when a business is executed through the TEE + SE security architecture, the SE and TEE cooperate to execute the business. Since the security level of the TEE is lower than the SE, in this way, in the case of a security vulnerability in the TEE, it may cause The security of business execution through the TEE + SE security architecture cannot be guaranteed.

Summary of the invention

The embodiments of the present application provide a capability opening method and device to solve the problem that the security of executing services through the TEE + SE security architecture in the prior art cannot be guaranteed.

In the first aspect, the embodiments of the present application provide a capability opening method, which can be executed by the SE or a device (such as a chip system) capable of supporting the SE to implement the method. In this application, the method executed by the SE is described as an example . The method includes: the SE and the TEE establish a session for communication, and the SE sends the TEE an acquisition instruction for acquiring the security certificate of the TEE through the session. After that, a security certificate is generated based on the TEE attribute information, and the generated security certificate is sent to the SE through the session. After the SE receives the security certificate sent by the TEE through the session, the SE determines that the TEE is in accordance with the security certificate and the preset security policy. In the safe state, after the SE determines that the TEE is in a safe state, the SE opens the first capability to the third-party service in the SE, where the first capability is implemented based on the second capability of the TEE.

Through the above method, when the business is executed through the TEE + SE security architecture, the SE can establish a communication session with the TEE before executing the business, and can obtain the TEE security certificate through the session request, and then the TEE security certificate and the The security policy established determines that TEE is in a safe state, and after determining that TEE is in a safe state, the first capability is opened to third-party services in the SE. In this way, the ability to open is only allowed when the TEE itself is in a safe state. The third-party business within the SE can ensure the security of the business executed under the TEE + SE security architecture.

In a possible design, TEE can use the key to perform digital signature or message authentication code (MAC) operation on the TEE attribute information to generate a security certificate. The generated security certificate may include TEE attribute information. The key may include a private key of TEE, a pre-configured key, or a key negotiated by TEE and SE.

In a possible design, the TEE security certificate may include TEE attribute information. In this design, the SE can determine that the TEE is in a safe state by determining that the TEE attribute information satisfies the preset security policy. In this way, the condition that the TEE is in a safe state can be set by the SE itself, so that the TEE can open the first capability realized based on the second capability of the TEE to a third party in the SE only when the TEE meets the safe status recognized by the SE Business can improve the security of business execution.

In the embodiment of the present application, the second capability of TEE is not limited. In a possible design, the second capability of TEE may include a trusted user interface (TUI) capability. In this design, the attribute information of TEE may include TEE platform attribute information and / or TUI capability Attribute information. Among them, the TEE platform attribute information may include but not limited to at least one of the following: TEE logo, TEE supplier or developer logo, TEE operating system version, TEE startup status, TEE life cycle status, TEE application Interface API version information, TEE's anti-rollback level, or version information of the interactive application in TEE. The interactive application is a trusted application in TEE that communicates with the SE. The attribute information of the TUI capability includes the peripheral type of TUI and / or the peripheral attribute of TUI.

In the embodiment of the present application, the establishment of a communication session between the SE and the TEE may be initiated by the SE or established by the TEE. This application focuses on the method for the SE to initiate the establishment of the session.

In one possible design, the SE actively initiates the establishment of a session for communication with the TEE. The SE sends a session establishment request message to the TEE. The session establishment request message is used to request to establish a session with the TEE. The SE receives the session establishment response message sent by the TEE. The session establishment response message is used to indicate confirmation to establish the session. With this method, the SE actively initiates the process of establishing a session, and can establish a session with the TEE when the SE has a communication requirement, which can avoid unnecessary waste of communication resources.

In a possible design, if the SE actively initiates the session establishment, before the SE sends the session establishment request message to the TEE, the SE may also trigger an interrupt signal through the communication module. The interrupt signal is used to instruct the TEE to receive the session establishment request message. With this method, the SE can trigger an interrupt signal before initiating the session establishment, and the interrupt signal is used to instruct the TEE to receive the session establishment request message that the SE is about to send, so that the TEE can receive the session establishment request message more accurately.

In a possible design, before determining that the TEE is in a safe state according to the security certificate and the preset security policy, the SE can also authenticate the security certificate and determine that the security certificate is generated by the TEE and has not been tampered with. In this way, the SE must verify the security certificate sent by the TEE to ensure that the security certificate is generated by the TEE and has not been tampered with. Through this method, double security verification of TEE is realized, so that the verification result of TEE is more accurate.

In a possible design, the SE may include the TEE attribute identifier in the acquisition instruction sent to the TEE. The acquisition instruction is used to instruct the TEE to use the TEE attribute identifier corresponding to the TEE attribute identifier to generate a security certificate. In this design, TEE can use the key to digitally sign or MAC the TEE attribute corresponding to the TEE attribute ID to generate a security certificate. With this method, the SE carries the TEE attribute identifier in the acquisition instruction sent to the TEE, which can indicate the attributes of the TEE that the SE needs to verify, without the TEE sending all of its attribute information, which can save signaling overhead.

In a possible design, after the SE determines that the TEE is in a safe state, it can also negotiate a communication key with the TEE, and the negotiated communication key is bound to the state of the TEE. The communication key is used for the SE to communicate with the TEE. When the SE determines that the TEE is restarted or the attributes of the TEE are changed, the communication key is deleted. Through this method, after verifying that TEE is in a safe state, the SE negotiates a communication key for communication with the TEE, which is bound to the state of the TEE, that is, as long as the state of the TEE has not changed, the TEE and the SE The communication key is always used for communication, and SE does not need to verify the security status of TEE every communication, which can improve communication efficiency. In addition, when the SE determines that the TEE status has changed, it can delete the communication key, use the method provided in this application to perform security verification on the TEE again, and renegotiate the communication key.

In a second aspect, an embodiment of the present application provides a capability opening device, the device having a function of implementing the SE behavior in the method example of the first aspect described above. The function can be realized by hardware, or can also be realized by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

In a possible design, the device includes a communication module and a processing module, and in some possible implementations, a storage module may also be included. These modules may perform the corresponding functions in the method examples in the first aspect above. For details, see the method examples The detailed description is not repeated here.

In another possible design, the structure of the device includes a processor, a memory, and a transceiver, wherein the processor, the memory, and the transceiver may be connected through a bus; the processor calls storage The instructions in the memory execute the above method.

In a third aspect, an embodiment of the present application provides a capability opening device, the device having a function of implementing the TEE behavior in the method example of the first aspect described above. The function can be realized by hardware, or can also be realized by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

According to a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the computer is caused to execute the first aspect or any of the first aspect A method provided by design.

In a fifth aspect, a computer program product is also provided in an embodiment of the present application, where the computer program product stores instructions that, when run on a computer, cause the computer to execute the first aspect or any one of the first aspects Design the method provided.

BRIEF DESCRIPTION

Figure 1 is a schematic diagram of an existing capability opening architecture;

2 is an implementation flowchart of a capability opening method provided by an embodiment of this application;

FIG. 3 is a schematic structural diagram of an embodiment provided by this application;

4 is an implementation flowchart of another capability opening method provided by an embodiment of this application;

5 is a schematic structural diagram of a capability opening device provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of another capability opening device provided by an embodiment of the present application.

detailed description

The application is described in detail below in conjunction with the accompanying drawings of the specification.

First, some terms in this application are explained to facilitate understanding by those skilled in the art.

1) Terminal, which can be a device that provides users with voice and / or data connectivity, also known as user equipment (UE), mobile station (MS), mobile terminal (MT) Wait. For example, hand-held devices with wireless connection, in-vehicle devices, etc. At present, some examples of terminals are: mobile phones, tablets, laptops, PDAs, mobile Internet devices (MID), wearable devices, virtual reality (VR) devices, and augmented reality (augmented reality, AR) equipment, wireless terminals in industrial control, wireless terminals in self-driving, self-driving wireless terminals, wireless terminals in remote medical surgery, and smart grids Wireless terminals, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc.

2). Rich execution environment (REE) refers to the operating environment that does not have specific security functions in the terminal. For example, the Android operating system is a rich execution environment.

3). A trusted execution environment (trusted execution environment) TEE is an operating environment that coexists in a terminal with a common execution environment (or rich execution environment (REE)).

Supported by hardware, TEE has security capabilities and can meet certain security requirements, and can achieve an operating mechanism isolated from REE. TEE has its own operating space and defines strict protection measures, so it has a higher security level than REE, and can protect assets (such as data, software, etc.) in TEE from software attacks and resist specific types of security threats. Only authorized security software can be executed in TEE, and it also protects the confidentiality of security software resources and data. Compared with REE, TEE can better protect the security of data and resources due to its protection mechanisms such as isolation and permission control.

4). Trusted application (TA) refers to an application running in TEE, which can provide security-related services for client applications (CA) running outside TEE.

5). Client application (CA) usually refers to an application running in REE, but in the case of some TA calling TA, the TA that initiates the call can also serve as CA. The CA can call the TA through the client application programming interface (API) and make the TA perform corresponding security operations.

6). Security unit (SE) refers to a hardware unit with anti-tampering and anti-hardware attack capabilities, with an independent processor that can provide security for applets or third-party services running in it Operating environment, and can guarantee the security and confidentiality of the assets stored in it. Common security units are embedded security unit (embedded security element (eSE), inSE integrated into mobile phone system-on-chip (SoC), universal integrated circuit card (UICC), etc.).

7). Trusted user interface (TUI) is a security function provided by the TEE operating system. It can be understood as a secure display interface controlled by TEE and can provide trust for each TA running in TEE. The user interaction interface ensures that when used by the TA, the content cannot be obtained by REE or even other TAs, which can improve the security of the business. The global platform organization (global platform) has standardized the common APIs of TUI, which is convenient for TA developers to use these APIs to develop TUI. Through TUI, the three most basic safe user interaction functions of safe display, safe input and safe indication mark can be realized. Businesses developed under the TEE + SE-based security architecture usually provide TUI capabilities. For example, in the financial field, the central bank's mobile phone shield specifications clearly require TUI to ensure the security of the interface for displaying secret passwords and signing content.

8) Root of trust refers to the computing engine, code and some data that may coexist on the same platform, which can provide security services. No other entity can provide credible proof (in summary or other form) for the initial state of code and data in the root of trust. In a more common understanding, some codes or hardware have been hardened enough to be unlikely to be destroyed, or cannot be modified at all, or cannot be modified without password credentials, so these codes or hardware can be used as The basis of trust, the relevant field is called the root of trust. The root of trust is generally the first piece of code that is loaded into random access memory (RAM) after the device is started or directly runs in the chip. Taking the secure boot process as an example, based on the root of trust, a chain of trust can be extended-the root of trust holds the signature of the next module / boot code (bootloader), and the code in the root of trust before running the next module during the boot process First verify the signature of the next module (ensure that only authorized and tampered code can be executed), and the next module is allowed to execute after verification; in the same way, the verified module continues to verify the signature of its next-level module, This step by step verification until the system is fully started. In this scenario, the startup process starts from the root of trust and extends a chain of trust for secure startup.

Security services that can be provided based on the root of trust include authentication, authorization, encryption, identification, integrity verification, measurement, measurement, reporting, and update , Or verification, etc.

Among them, metrics can provide a capability to reliably generate platform characteristics. The report can report platform features in an undeniable way. Combining measurement and reporting allows the device to generate a security certificate. The remote server can verify the status and credibility of the device's software, hardware, and firmware by verifying the security certificate reported by the device.

9). Trusted execution environment (TEE) + security unit (SE) security architecture refers to the architecture that provides security services for applications through the combination of TEE and SE.

10). Mobile phone shield is a product or application that uses a mobile phone to implement the USB key function of the bank. The mobile phone shield adopts the TEE + SE security architecture. The SE of the mobile phone can provide the mobile phone shield with a high security environment required for all functions such as cryptographic operations and CA digital certificates. The mobile phone shield provides cryptographic computing support for mobile Internet applications and is used for identity authentication, electronic signatures, and data protection.

The mobile shield business is taken as an example to introduce the business execution process under the existing TEE + SE security architecture. Under the TEE + SE security architecture, the mobile phone shield signature key is stored in the SE, and all signature operations are performed in the SE, thereby ensuring that the signing process reaches financial-level security. The user can perform some large-value transactions or other highly sensitive operations on the mobile phone. When a business requires the signature of the mobile phone shield, the signature information is sent to TEE, displayed through the TUI and confirmed by the user. After the user confirms the error, enter Mobile phone shield personal universal identification number (personal identification number, PIN), the PIN is sent to the signature applet in the SE for verification, after verification, the transaction information confirmed by the user is sent to the applet for signature, through digital signature Technology ensures that transactions are non-repudiation.

In the above mobile phone shield business execution process, TUI has two important functions: 1. To ensure the security of the user's PIN input, only the mobile phone shield can be accessed, and the applications on the REE side and other applications in TEE cannot pass the screen reading, reading Obtain user input through keyboard and other methods to ensure that the PIN will not be leaked, and also ensure that the PIN is entered in real time. 2. Ensure that "seeing is what you sign" (or vice versa "signing what you see"), that is, the transaction information sent to the mobile phone shield for signature through TUI will not be tampered with or replaced. After confirming that the transaction information is correct, the information sent to the SE for signature is the information confirmed by the user. At present, the industry generally believes that the REE side is insecure, and various attack methods can be implemented. Without the introduction of TEE, transaction information, user PIN, etc. may be acquired and tampered by malicious programs, and thus malicious programs / hackers can skip Users conduct transactions, or modify transaction content to commit fraud. Obviously, the introduction of TUI plays an obvious defensive role against the conventional malicious attacks on the REE side.

11) In the description of this application, unless otherwise stated, "plurality" means two or more, and other quantifiers are similar. "And / or" describes the relationship of the related objects, indicating that there can be three relationships, for example, A and / or B, which can indicate: there are three conditions: A exists alone, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the related object is a "or" relationship.

Refer to FIG. 1, which is a schematic diagram of an existing capability opening architecture. As shown in Figure 1, the architecture includes three parts, namely SE, TEE and REE. Among them, CA can be run in REE, TA can be run in TEE, and third-party services (also called third parties) can be run in SE. Applet), in addition, REE can also include SE access interface, SE access interface can be used to access the third-party business in SE, TEE can also include SE driver, SE driver to achieve communication capabilities with SE, TEE It can also include the TEE operating system (TEE OS). TEE OS is used to manage and maintain the operation of TEE. TEE OS can provide some TEE functions for the SE, for example, it can provide TUI capabilities, and the SE can also include a communication module. Send messages to TEE or receive messages sent by TEE through this communication module. It should be understood that only some of the modules are shown in the architecture shown in FIG. 1. In actual applications, the architecture may further include more or fewer modules. This application is only illustrated by the architecture in FIG. 1 and is not limited.

When performing a business based on the architecture shown in Figure 1, SE can cooperate with TEE to execute the business. TEE mainly provides TUI capabilities, and SE mainly performs security or cryptography-related operations. When the SE uses TEE's TUI capability, after the TA in the TEE interacts with the user through the TUI, the SE driver returns the interaction result to the SE communication module. The SE directly executes the interaction result after receiving the interaction result through the communication module. The security level is lower than the SE. In this way, in the case of a security hole in TEE itself, the security of executing business through the TEE + SE security architecture may not be guaranteed.

Based on the above problems, this application provides a capability opening method to solve the problem that the security of executing services through the TEE + SE security architecture in the prior art cannot be guaranteed.

Refer to FIG. 2, which is an implementation flowchart of a capability opening method provided by an embodiment of the present application. Referring to Figure 2, the method includes:

S101: The SE and TEE establish a session for communication.

In the embodiment of the present application, the SE and the TEE establish a communication session, which may be initiated by the SE or established by the TEE. In the method of actively initiating the establishment of the session by TEE, after detecting / scanning the SE that can establish a connection, TEE can actively establish a session with the SE through the SE driver, send a session establishment request to the SE, and the SE passively responds to the request In this application, the method for actively establishing the session initiated by TEE will not be described in detail. This application focuses on the method for actively establishing the session initiated by the SE.

When the SE initiates the establishment of a session for communication with the TEE, the SE sends a session establishment request message to the TEE. The session establishment request message is used to request a session establishment with the TEE. After receiving the session establishment request message, the TEE sends the session establishment request message to the SE A session establishment response message, which is used to indicate confirmation of the establishment of the session, and the SE receives the session establishment response message sent by the TEE to complete the session establishment with the TEE. With this method, the SE actively initiates the process of establishing a session, and can establish a session with the TEE when the SE has communication needs, which can avoid unnecessary waste of communication resources. In this application, there is no limitation on the timing for the SE to initiate the establishment of a session. In a possible implementation manner, the above-mentioned process for the SE to initiate the establishment of the session can be in the process of initializing the SE's operating environment (which can be understood as the power-on startup process of the SE), or after the SE's operating environment is initialized Execute after a period of time.

In a possible example, if the SE actively initiates the session establishment, before the SE sends the session establishment request message to the TEE, the SE may also trigger an interrupt signal through the communication module. The interrupt signal is used to instruct the TEE to receive the session establishment request message. It can be understood that the interrupt signal can be used as a signal for the SE to initiate session establishment actively. In this way, once the SE triggers the interrupt signal through the underlying communication module, both SE and TEE can learn that the SE is about to initiate session establishment actively, and then can complete the session For the establishment of preparation, the upper layer of SE and TEE realizes the interaction of instructions through the standard API interface of TEE and SE interaction, which can make TEE receive the session establishment request message more accurately.

Optionally, the above communication module for triggering the interrupt signal may be an inter-core communication (IPC) module or other underlying hardware modules.

In this application, the session establishment request message sent by the SE to the TEE may be an IPC instruction specifically set for the SE to initiate a session establishment, and the flag bit of the IPC instruction may be used to instruct the SE to establish a session with the TEE. When TEE receives the IPC instruction through the mailbox, it executes to receive the session establishment request message sent by the SE.

In the embodiment of the present application, in order to realize that the SE initiates session establishment and uses TUI, a TUI agent (TUI agent) can be set up specifically in the SE. In addition, in order to cooperate with the SE to use the TUI, an application module (SE -TA), as shown in Figure 3. See the description below for specific functions.

Optionally, the SE and the TEE establish a session for communication. The TUI agent in the SE and the SE-TA in the TEE can establish the session through the standard API for interaction between the TEE and the SE.

In one implementation, when the session is established by the TUI agent in the SE and the SE-TA in the TEE, the SE driver in the TEE (which can act as the communication agent of the SE) parses the interrupt signal after obtaining the interrupt signal , And trigger the SE-TA in TEE to establish a session with the TUI agent in SE through the API between TEE and SE.

In another implementation, during the establishment of the session between the TUI agent in the SE and the SE-TA in the TEE, the client API (client API) communication module is set / implemented in the SE, and the TUI agent in the SE passes the standard The TA access interface, as a client, actively sends a command to establish a session to the SE-TA in the TEE.

In another implementation, during the process of establishing the session by the TUI agent in the SE and the SE-TA in the TEE, the SE driver in the TEE acts as the communication agent of the SE after obtaining the interrupt signal, and the SE driver acts as the client Establish a session with the SE-TA in the TEE through the client API.

S102: The SE sends an acquisition instruction for acquiring the security certificate of the TEE to the TEE through the session, and the TEE receives the acquisition instruction from the SE through the session.

In a possible example, the SE may send the acquisition instruction to the SE-TA in the TEE through the TUI agent in the SE, and the TEE receives the acquisition instruction through the SE-TA in the TEE. In this example, after receiving the acquisition instruction, the SE-TA in the TEE can verify the identification information of the TUI agent, and obtain the attribute information of the TEE after the verification is passed to generate a security certificate.

In the embodiment of the present application, the TEE attribute information may include TEE platform attribute information and / or TUI capability attribute information. Among them, the TEE platform attribute information may include but not limited to at least one of the following: TEE logo, TEE supplier or developer logo, TEE operating system version, TEE startup status, TEE life cycle status, TEE application Interface API version information, TEE's anti-rollback level, or version information of the interactive application in TEE. The interactive application is a trusted application in TEE that communicates with the SE. The attribute information of the TUI capability may include the peripheral type of TUI and / or the peripheral attribute of TUI. Among them, the TEE logo is used to uniquely identify the TEE. The TEE supplier or developer logo is used to uniquely identify the TEE supplier or developer.

In some possible examples, the TEE platform attribute information may also include SE-TA version information, device certificate, SE-TA application certificate, and so on.

Among them, the start state of TEE may include TEE safe start or TEE unsafe start.

Among them, the peripheral attributes of TUI can include TEE control (TEE controllable) or TEE exclusive (TEE owned). When the TUI peripheral attribute is TEE controllable, the TUI peripheral can be used by both TEE and REE, but controlled by TEE. When the peripheral attribute of the TUI is TEE ownable, the peripheral of the TUI is exclusively owned by TEE.

Optionally, the acquisition instruction may include a TEE attribute identifier. In this case, the acquisition instruction is used to instruct TEE to use the TEE attribute identifier corresponding to the TEE attribute identifier to generate a security certificate.

It should be noted that when the TEE attribute identifier is included in the acquisition instruction, the TEE attribute identifier may be determined by the SE according to a preset security policy. For example, if the preset security policy includes that the operating system version of the TEE needs to be a version above a certain version, the attribute identification of the TEE may include the identification of the operating system version of the TEE.

S103: After receiving the acquisition instruction, the TEE generates a security certificate according to the attribute information of the TEE.

In a possible implementation manner, the acquisition instruction does not include the TEE attribute identifier. In this case, the TEE generates a security certificate based on all attribute information that can be acquired by itself or preset attribute information. Specifically, TEE uses a key to perform digital signature or message authentication code (MAC) operation on the TEE attribute information to generate a security certificate. TEE uses a key to perform MAC operations on TEE's attribute information. It can be understood that TEE uses a key to generate a MAC and ensure the integrity of TEE's attribute information through the MAC.

Among them, the security certificate includes the attribute information of TEE, and the key includes the private key of TEE, the pre-configured key, or the key negotiated by TEE and SE. The key can be a symmetric key or an asymmetric key.

In another possible implementation manner, the acquisition instruction includes a TEE attribute identifier. In this case, the TEE generates a security certificate according to the TEE attribute corresponding to the TEE attribute identifier included in the acquisition instruction. Specifically, the TEE queries / obtains the TEE attributes corresponding to the attribute identifier, and arranges them according to a preset format, and uses the key to digitally sign or MAC the TEE attributes corresponding to the TEE attribute identifier to generate a security certificate. The security certificate includes the TEE attribute information corresponding to the TEE attribute identifier.

Optionally, TEE can also use the root of trust (RoT) service interfaces (such as metrics and reports) provided by TEE to generate TEE security certificates.

Understandably, TEE can generate a security certificate through SE-TA within TEE.

S104: The TEE sends the generated security certificate to the SE through the session, and the SE receives the security certificate sent by the TEE through the session.

It can be understood that the TEE can send the generated security certificate to the TUI agent in the SE through the SE-TA in the TEE.

S105: After the SE receives the security certificate sent by the TEE through the session, the SE determines that the TEE is in a safe state according to the security certificate and the preset security policy.

In one implementation, the security certificate includes the TEE attribute information. When the SE determines that the TEE attribute information satisfies the preset security policy, the SE determines that the TEE is in a safe state. In this application, the number of security policies may be one or more. When the number of security policies is multiple, the SE determines that the TEE is in a safe state when it determines that the TEE attribute information satisfies all security policies.

It can be understood that the SE can determine that the TEE is in a safe state through the TUI agent in the SE.

The following describes how the SE determines the TEE is in a safe state according to the TEE attribute information and the preset security policy through the TUI agent in the SE.

For example, the security strategy preset by the TUI agent in the SE is to determine TEE security only when the TUI peripheral attribute is TEE ownable. In this way, when the SE determines that the TUI peripheral attribute is TEE exclusive, it can be determined that the TEE is in a safe state.

For another example, the preset security policy of the TUI agent in the SE is to determine the TEE security when the operating system version of the TEE is 20180101xxx or higher. In this way, when the SE determines that the operating system version of the TEE is 20180101xxx or higher, it can be determined that the TEE is in a safe state.

S106: After the SE determines that the TEE is in a safe state, the SE opens the first capability to third-party services in the SE. The first capability is implemented based on the second capability of TEE, which can be understood as the first capability is obtained based on the second capability encapsulation. In the embodiment of the present application, the second capability of TEE is not limited, and the second capability of TEE may include a TUI capability.

In the embodiment of the present application, after determining that the TEE is in a safe state, the SE may also notify the TEE to complete the authentication process.

Taking the second capability of TEE as the TUI capability as an example, after determining that the TEE is in a safe state, the SE can register the first capability (which can be called the TUI service of the SE within the SE) based on the TEE capability of the SE as the SE Global service (global service) is open to third-party services within the SE.

After the first capability is registered as the global service of the SE, all third-party services in the SE can call the first capability.

In a possible example, the SE may send a broadcast to a third-party service that needs to use the global service for registration.

In the embodiment of the present application, after receiving the TEE security certificate, the SE may also store the security certificate. When the third-party service registers to use the global service, in response to the request of the third-party service, the security certificate can be sent to the third-party service at the same time. At this time, the third-party service can also set some security policies to determine whether to use the global service.

In a possible example, before determining that the TEE is in a safe state according to the security certificate and the preset security policy, the SE can also authenticate the security certificate to determine that the security certificate is generated by the TEE and has not been tampered with. It can be understood that the SE certifies the safety certificate to ensure that the safety certificate comes from a legal TEE.

Take the TUI agent in the SE to authenticate the security certificate as an example. In a possible implementation, the TUI agent can call a preset verification key to verify the security certificate and ensure that the security certificate comes from a legal or trusted TEE.

Through the method provided by the embodiment of the present application, the SE must verify the security certificate sent by the TEE to ensure that the security certificate is generated by the TEE and has not been tampered with, that is, to ensure the integrity and authenticity of the security certificate, It is also necessary to determine that the TEE is in a safe state recognized by the SE based on the security strategy. This method realizes double security verification of the TEE, which enables the SE to use and open the TEE capability for higher security.

In a possible example, after the SE determines that the TEE is in a safe state, it can also negotiate a communication key with the TEE, and the negotiated communication key is bound to the state of the TEE, and the communication key is used by the SE to subsequently use the second capability process The encryption is performed during the process, and when the SE determines that the TEE is restarted or the attributes of the TEE are changed, the communication key is deleted.

Through this method, after verifying that TEE is in a safe state, the SE negotiates a communication key for communication with the TEE, which is bound to the state of the TEE, that is, as long as the state of the TEE has not changed, the TEE and the SE The communication key is always used for communication, and SE does not need to verify the security status of TEE every communication, which can improve communication efficiency. In addition, when the SE determines that the TEE status has changed, it can delete the communication key, use the method provided in this application to perform security verification on the TEE again, and renegotiate the communication key.

Optionally, the communication key may include a session key derived based on the communication key.

It should be noted that when multiple TEEs exist in the equipment where the SE is located, the SE can obtain the security certificates of multiple TEEs, and verify the security certificates of multiple TEEs respectively to determine multiple TEEs that meet the security policy. After multiple TEEs satisfying the security policy are determined, the corresponding first capabilities can also be implemented based on the TUI capabilities of the TEEs satisfying the security policy, respectively. When the SE opens the first capability to the third-party service in the SE, it can display that multiple first capabilities realized by TEE-based TUI capabilities are available, and the third-party service selects which first capability to use.

The embodiments of the present application provide a method for performing security verification on the TEE at the SE, but the application is not limited to performing security verification on the TEE at the SE. In a possible implementation, the SE may send the preset security policy to TEE, complete the TEE certification of the SE at the TEE, and send the certification result to the SE. If the verification result is verified, that is, the attributes of the TEE satisfy the SE With the preset security policy, after receiving the authentication result, the SE may open the first capability to the third-party service in the SE.

The following describes the capability opening method provided by the embodiments of the present application with reference to FIGS. 3 to 4.

Refer to FIG. 3, which is a schematic diagram of an architecture provided by an embodiment of the present application. In addition to all the modules in the architecture shown in FIG. 1, the architecture in FIG. 3 also includes the initiative to initiate session establishment by the SE and use TUI , You can set up a TUI agent (TUI agent) in the SE. In addition, it also includes a dedicated application module (SE-TA) in the TEE for the use of the TUI for the implementation of the SE. The same module in the architecture as in Figure 1 also functions The same, no longer repeat. It should be understood that only some of the modules are shown in the architecture shown in FIG. 3, and the architecture may also include more or fewer modules in actual applications. FIG. 3 is only for illustration, not for limitation.

Embodiments of the present application The following provides a method for implementing embodiments of the present application based on the architecture shown in FIG. 3. Referring to FIG. 4, which is a flowchart of another capability opening method provided by an embodiment of the present application, in FIG. 4, the capability opening method provided by the present application is implemented by SE through the TUI agent in the SE and TEE through the SE-TA in the TEE For example.

The method shown in Figure 4 includes the following steps:

S201: The TUI agent establishes a communication session with the SE-TA.

It should be noted that the TUI agents involved in this application refer to the TUI agents in the SE, and the SE-TAs involved refer to the SE-TAs in the TEE.

The following uses the TUI agent to initiate session establishment as an example.

Before the TUI agent actively initiates session establishment, the SE can also trigger an interrupt signal through the communication module. The interrupt signal is used to instruct the TUI agent to initiate session establishment actively. For details on how to trigger, please refer to the related description in FIG. 2, which will not be repeated here.

S202: The TUI agent sends the SE-TA an acquisition instruction for acquiring the TEE security certificate through the established session, and the SE-TA receives the acquisition instruction through the established session.

S203: After receiving the acquisition instruction, the SE-TA can verify the identification information of the TUI agent, and after the verification is passed, the attribute information of the TUI capability and the platform attribute information of the TEE can be acquired.

In a possible implementation manner, the SE-TA may obtain TUI capability attribute information through the TUI query interface provided by the TEE operating system, and obtain TEE platform attribute information through the platform attribute query interface provided by the TEE operating system.

S204: After obtaining the attribute information of the TUI capability and the platform attribute information of the TEE, the SE-TA generates a security certificate.

In a possible example, after SE-TA obtains TUI capability attribute information and TEE platform attribute information, it can also send the acquired TUI capability attribute information and TEE platform attribute information to the TEE operating system. The operating system generates a security certificate based on the TEE platform attribute information and the TUI capability attribute information. The TEE operating system generates the security certificate and sends the security certificate to the SE-TA, see S205-S207.

S205: The SE-TA sends TUI capability attribute information and TEE platform attribute information to the TEE operating system.

S206: The TEE operating system generates a security certificate according to TEE platform attribute information and TUI capability attribute information.

S207: The TEE operating system sends the security certificate to the SE-TA.

For details on how to generate the security certificate, and the content contained in the TEE platform attribute information and TUI capability attribute information, please refer to the description in the method shown in FIG. 2 above.

S208: The SE-TA sends a security certificate to the TUI agent through the session, and the TUI agent receives the security certificate through the session.

S209: After the TUI agent receives the security certificate through the session, the TUI agent can call a preset verification key to verify the security certificate, to ensure that the security certificate comes from a legal or trusted TEE.

S210: The TUI agent determines that the TEE is in a safe state according to the security certificate and the preset security policy. For details, please refer to the description in the method shown in FIG. 2 above.

S211: After determining that the TEE is in a safe state, the TUI agent opens the first capability to the third-party service in the SE.

Optionally, the TUI agent can send broadcasts to third-party services that need to use the global service. Of course, the broadcast can also be sent to SE-TA, see S212 of FIG. 4.

Optionally, after determining that the TEE is in a safe state, the TUI agent may also negotiate a communication key with the TEE, and the negotiated communication key is bound to the state of the TEE, and the communication key is used by the SE to subsequently use the second capability The encryption is performed during the process, and when the SE determines that the TEE is restarted or the attributes of the TEE are changed, the communication key is deleted. For the process, please refer to S213 in FIG. 4.

Through the method provided in this application, when executing a business through the TEE + SE security architecture, the SE can establish a communication session with the TEE before performing the business, and can obtain the TEE security certificate through the session request, and then can be based on the TEE security Proof and pre-defined security strategy to determine that TEE is in a safe state, and after determining that TEE is in a safe state, the first capability is opened to third-party services within the SE, so that only when the TEE itself is guaranteed to be in a safe state Opening up capabilities to third-party services within the SE can ensure the security of business execution under the TEE + SE security architecture.

Based on the same inventive concept as the method embodiment, an embodiment of the present application also provides a capability opening device. It can be understood that, in order to realize the above-mentioned functions, the capability opening device includes a hardware structure and / or a software module corresponding to each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of the examples described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed by hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

In the case of using an integrated unit, FIG. 5 shows a possible structural schematic diagram of a capability opening device according to an embodiment of the present application. The capability opening device 500 may exist in the form of software, or may be an SE in a terminal. As shown in FIG. 5, the capability opening device 500 includes a processing module 501 and a communication module 502. The communication module 502 is used to support the interaction between the capability opening device 500 and other devices or modules, and the processing module 501 is used to control and manage the actions of the capability opening device 500. For example, the processing module 501 can be used to perform the technical processes such as S105-S106 in FIG. 2, and can also be used to perform the technical processes such as S208-S210 in FIG. 4, and the communication module 502 can be used to perform S101, S102 in FIG. 2. The technical process can also be used to perform S201, S202, S211-S212 and other technical processes in FIG. 4, and the communication module 502 can be used to perform the S104 technical process in FIG. 2 and can also be used to perform S207 and S212 in FIG. 4. And other technical processes. The capability opening device 500 may further include a storage module 503 for storing program codes and data of the capability opening device 500.

In the case of using an integrated unit, FIG. 6 shows another possible structural schematic diagram of a capability opening device according to an embodiment of the present application. The capability opening device 600 may exist in the form of software, or may be a TEE in a terminal. . As shown in FIG. 6, the capability opening device 600 includes a processing module 601 and a communication module 602. The communication module 602 is used to support the interaction between the capability opening device 600 and other devices or modules, and the processing module 601 is used to control and manage the actions of the capability opening device 600. For example, the processing module 601 can be used to perform the technical processes such as S103 in FIG. 2, can also be used to perform the technical processes such as S203 and S205 in FIG. 4, and the communication module 602 can be used to perform the technical processes S101 and S104 in FIG. It can also be used to perform the technical processes of S201, S207, and S212 in FIG. 4, and the communication module 602 can be used to perform the technical process of S102 in FIG. 2 and can also be used to perform the technologies of S202, S211-S212 in FIG. 4. process. The capability opening device 600 may further include a storage module 603 for storing program codes and data of the capability opening device 600.

It should be understood that the division of the units in the above device is only a division of logical functions, and in actual implementation, it may be fully or partially integrated into a physical entity or may be physically separated. Moreover, the units in the device can be implemented in the form of software calling through processing elements; they can also be implemented in the form of hardware; some units can also be implemented in software through processing elements, and some units can be implemented in hardware. For example, each unit can be a separate processing element, or it can be integrated in a chip of the device. In addition, it can also be stored in the memory in the form of a program, which is called and executed by a processing element of the device. Features. In addition, all or part of these units can be integrated together or can be implemented independently. The processing element described here can become a processor again, which can be an integrated circuit with signal processing capability. In the implementation process, each step of the above method or each unit above may be implemented by an integrated logic circuit of hardware in a processor element or in the form of software invoking through a processing element.

In one example, the unit in any of the above devices may be one or more integrated circuits configured to implement the above method, for example: one or more specific integrated circuits (application specific integrated circuits, ASIC), or, one or Multiple microprocessors (DSPs), or one or more field programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms. As another example, when the unit in the device can be implemented in the form of a processing element scheduling program, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call a program. As another example, these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).

Based on the same concept as the above method embodiment, a computer storage medium is also provided in an embodiment of the present application. The computer storage medium stores computer-executable instructions. When the computer-executable instructions are called by a computer, the computer The specific process of each of the method embodiments provided above is performed. In the embodiment of the present application, the computer-readable storage medium is not limited, for example, it may be RAM (random-access memory), ROM (read-only memory).

Based on the same concept as the above method embodiment, a computer program product is also provided in an embodiment of the present application, where the computer program product stores instructions that, when run on the computer, cause the computer to perform any of the above possible designs The method provided in.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

This application is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the application. It should be understood that each flow and / or block in the flowchart and / or block diagram and a combination of the flow and / or block in the flowchart and / or block diagram may be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, embedded processing machine, or other programmable data processing device to produce a machine that enables the generation of instructions executed by the processor of the computer or other programmable data processing device An apparatus for realizing the functions specified in one block or multiple blocks of one flow or multiple flows of a flowchart and / or one block or multiple blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, the instructions The device implements the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operating steps are performed on the computer or other programmable device to produce computer-implemented processing, which is executed on the computer or other programmable device The instructions provide steps for implementing the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.

Although some possible embodiments in the present application have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic inventive concept. Therefore, the appended claims are intended to be construed as including the embodiments of the present application and all changes and modifications falling within the scope of the present application.

Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

A capability opening method, characterized by including:

The security unit SE establishes a session for communication with the trusted execution environment TEE;

The SE sends an acquisition instruction for acquiring the security certificate of the TEE to the TEE through the session;

The SE receives the security certificate sent by the TEE through the session;

The SE determines that the TEE is in a safe state according to the safety certificate and a preset safety policy;

The SE opens the first capability to third-party services in the SE, and the first capability is implemented based on the second capability of the TEE.
The method according to claim 1, wherein the security certificate includes attribute information of the TEE;

The SE determines that the TEE is in a safe state according to the safety certificate and a preset safety policy, including:

When the SE determines that the attribute information of the TEE meets a preset security policy, it determines that the TEE is in a safe state.
The method according to claim 2, wherein the second capability includes a trusted user interface TUI capability, and the attribute information of the TEE includes platform attribute information of the TEE and / or attribute information of the TUI capability ;

The TEE platform attribute information includes at least one of the following:

The TEE logo, the TEE developer logo, the TEE operating system version, the TEE startup state, the TEE life cycle state, the TEE application program interface API version information, the TEE Anti-rollback level or version information of the interactive application in the TEE, the interactive application is a trusted application in the TEE for communicating with the SE;

The attribute information of the TUI capability includes a peripheral type of TUI and / or a peripheral attribute of TUI.
The method according to any one of claims 1 to 3, wherein the establishment of a communication session between the SE and the TEE includes:

The SE sends a session establishment request message to the TEE, and the session establishment request message is used to request the establishment of the session with the TEE;

The SE receives the session establishment response message sent by the TEE, and the session establishment response message is used to instruct to confirm the establishment of the session.
The method according to claim 4, wherein before the SE sends a session establishment request message to the TEE, the method further comprises:

The SE triggers an interrupt signal through the communication module, and the interrupt signal is used to instruct the TEE to receive the session establishment request message.
The method according to any one of claims 1 to 5, wherein the SE determines that the TEE is in a safe state according to the security certificate and a preset security policy, further comprising:

The SE authenticates the security certificate, and determines that the security certificate is generated by the TEE and has not been tampered with.
The method according to any one of claims 1 to 6, wherein the acquisition instruction includes an attribute identifier of the TEE, and the acquisition instruction is used to instruct the TEE to use the attribute identifier of the TEE The TEE attribute generates the security certificate.
The method according to any one of claims 1 to 7, wherein after the SE determines that the TEE is in a safe state, the method further includes:

The SE negotiates a communication key with the TEE, the communication key is bound to the state of the TEE, and the communication key is used for the SE to communicate with the TEE;

When the SE determines that the TEE is restarted or the attribute of the TEE is changed, the communication key is deleted.
A capability opening method, characterized by including:

The trusted execution environment TEE and the security unit SE establish a session for communication;

The TEE receives an acquisition instruction from the SE for acquiring the security certificate of the TEE through the session;

The TEE generates the security certificate according to the attribute information of the TEE;

The TEE sends the security certificate to the SE through the session.
The method according to claim 9, wherein the TEE generating the security certificate according to the attribute information of the TEE includes:

The TEE uses a key to perform digital signature or message authentication code MAC operation on the attribute information of the TEE to generate the security certificate, the security certificate includes the attribute information of the TEE, and the key includes the TEE Private key, pre-configured key, or key negotiated between the TEE and the SE.
The method according to claim 9 or 10, wherein the attribute information of the TEE includes platform attribute information and / or TUI capability attribute information of the TEE;

The TEE platform attribute information includes at least one of the following:

The TEE logo, the TEE developer logo, the TEE operating system version, the TEE startup state, the TEE life cycle state, the TEE application program interface API version information, the TEE Anti-rollback level or version information of the interactive application in the TEE, the interactive application is a trusted application in the TEE for communicating with the SE;

The attribute information of the TUI capability includes a peripheral type of TUI and / or a peripheral attribute of TUI.
The method according to claim 10, wherein the acquisition instruction includes an attribute identifier of the TEE, and the acquisition instruction is used to instruct the TEE to use the TEE attribute corresponding to the TEE attribute identifier to generate the TEE attribute. Safety certificate

The TEE generating the security certificate according to the attribute information of the TEE includes:

The TEE uses the key to perform a digital signature or a message authentication code MAC operation on the TEE attribute corresponding to the TEE attribute identifier to generate the security certificate.
The method according to any one of claims 9 to 12, wherein after the TEE sends the security certificate to the SE through the session, the method further includes:

The TEE negotiates a communication key with the SE, the communication key is bound to the state of the TEE, and the communication key is used for the SE to communicate with the TEE;

When the TEE restarts or the attributes of the TEE change, the communication key is deleted.
A capability opening device, applied to the security unit SE, characterized by including:

Communication module, used to establish a communication session with the trusted execution environment TEE;

The communication module is further configured to send an acquisition instruction for acquiring the security certificate of the TEE to the TEE through the session, and receive the security certificate sent by the TEE through the session;

A processing module, configured to determine that the TEE is in a safe state according to the security certificate received by the communication module and a preset security policy, and open the first capability to a third-party service in the SE, the The first capability is realized based on the second capability of the TEE.
The device according to claim 14, wherein the security certificate includes attribute information of the TEE;

The processing module determines that the TEE is in a safe state according to the security certificate and the preset security policy in the following manner:

When the processing module determines that the attribute information of the TEE meets a preset security policy, it determines that the TEE is in a safe state.
The apparatus according to claim 15, wherein the second capability includes a trusted user interface TUI capability, and the attribute information of the TEE includes platform attribute information of the TEE and / or attribute information of the TUI capability ;

The TEE platform attribute information includes at least one of the following:

The TEE logo, the TEE developer logo, the TEE operating system version, the TEE startup state, the TEE life cycle state, the TEE application program interface API version information, the TEE Anti-rollback level or version information of the interactive application in the TEE, the interactive application is a trusted application in the TEE for communicating with the SE;

The attribute information of the TUI capability includes a peripheral type of TUI and / or a peripheral attribute of TUI.
The device according to any one of claims 14 to 16, wherein the communication module establishes a communication session with TEE in the following manner:

Sending a session establishment request message to the TEE, where the session establishment request message is used to request the establishment of the session with the TEE;

Receiving a session establishment response message sent by the TEE, where the session establishment response message is used to indicate confirmation to establish the session.
The device according to claim 17, wherein the communication module is further configured to:

Before sending a session establishment request message to the TEE, an interrupt signal is triggered, and the interrupt signal is used to instruct the TEE to receive the session establishment request message.
The device according to any one of claims 14 to 18, wherein the processing module is further configured to:

Before determining that the TEE is in a safe state according to the security certificate and a preset security policy, authenticate the security certificate and determine that the security certificate is generated by the TEE and has not been tampered with.
The apparatus according to any one of claims 14 to 19, wherein the acquisition instruction includes an attribute identifier of the TEE, and the acquisition instruction is used to instruct the TEE to use the attribute identifier of the TEE The TEE attribute generates the security certificate.
The device according to any one of claims 14 to 20, wherein the communication module is further used to:

After the processing module determines that the TEE is in a safe state, a communication key is negotiated with the TEE, the communication key is bound to the state of the TEE, and the communication key is used for the SE and the TEE communicates;

The processing module is also used to:

When it is determined that the TEE is restarted or the attribute of the TEE is changed, the communication key is deleted.
A capability opening device applied to the trusted execution environment TEE, which is characterized by including:

The communication module is used to establish a communication session with the security unit SE;

The communication module is further configured to receive an acquisition instruction from the SE for acquiring the security certificate of the TEE through the session;

A processing module, configured to generate the security certificate according to the attribute information of the TEE;

The communication module is also used to send the security certificate to the SE through the session.
The apparatus according to claim 22, wherein the processing module generates the security certificate based on the TEE attribute information in the following manner:

Use a key to perform digital signature or message authentication code MAC operation on the TEE attribute information to generate the security certificate, where the security certificate includes the TEE attribute information, and the key includes the TEE private key , A pre-configured key or a key negotiated between the TEE and the SE.
The device according to claim 22 or 23, wherein the attribute information of the TEE includes platform attribute information and / or TUI capability attribute information of the TEE;

The TEE platform attribute information includes at least one of the following:

The TEE logo, the TEE developer logo, the TEE operating system version, the TEE startup state, the TEE life cycle state, the TEE application program interface API version information, the TEE Anti-rollback level or version information of the interactive application in the TEE, the interactive application is a trusted application in the TEE for communicating with the SE;

The attribute information of the TUI capability includes a peripheral type of TUI and / or a peripheral attribute of TUI.
The apparatus according to claim 23, wherein the acquisition instruction includes an attribute identifier of the TEE, and the acquisition instruction is used to instruct the TEE to use the TEE attribute corresponding to the TEE attribute identifier to generate the TEE attribute Safety certificate

The processing module generates the security certificate according to the attribute information of the TEE in the following manner:

Use the key to perform a digital signature or a message authentication code MAC operation on the TEE attribute corresponding to the TEE attribute identifier to generate the security certificate.
The device according to any one of claims 22 to 25, wherein the communication module is further used to:

After sending the security certificate to the SE through the session, negotiate a communication key with the SE, the communication key is bound to the state of the TEE, and the communication key is used for the SE and The TEE communicates;

The processing module is also used to:

When it is determined that the TEE is restarted or the attribute of the TEE is changed, the communication key is deleted.
A computer-readable storage medium on which a computer program is stored, characterized in that, when the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.
A computer-readable storage medium on which a computer program is stored, characterized in that, when the program is executed by a processor, the method according to any one of claims 9 to 13 is implemented.