WO2021196167A1 - 信息处理方法、装置、设备及存储介质 - Google Patents

信息处理方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2021196167A1
WO2021196167A1 PCT/CN2020/083242 CN2020083242W WO2021196167A1 WO 2021196167 A1 WO2021196167 A1 WO 2021196167A1 CN 2020083242 W CN2020083242 W CN 2020083242W WO 2021196167 A1 WO2021196167 A1 WO 2021196167A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
unit
electronic device
server
processing
Prior art date
Application number
PCT/CN2020/083242
Other languages
English (en)
French (fr)
Inventor
许阳
张立海
杨宁
Original Assignee
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Oppo广东移动通信有限公司 filed Critical Oppo广东移动通信有限公司
Priority to PCT/CN2020/083242 priority Critical patent/WO2021196167A1/zh
Priority to CN202080093621.2A priority patent/CN115004634B/zh
Publication of WO2021196167A1 publication Critical patent/WO2021196167A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to an information processing method, device, device, and storage medium.
  • the application program when an application program interacts with an operating system or a communication module within a terminal device, the application program usually carries certain parameter information, for example, the identification of the application program, to distinguish different application requirements, correspondingly, the operating system or The communication module will perform corresponding operations according to the received parameter information.
  • certain parameter information for example, the identification of the application program, to distinguish different application requirements, correspondingly, the operating system or The communication module will perform corresponding operations according to the received parameter information.
  • the embodiments of the present application provide an information processing method, device, equipment, and storage medium, which are used to solve the current security risks in information interaction within electronic equipment.
  • an embodiment of the present application provides an information processing method applied to an electronic device, including:
  • an embodiment of the present application provides an information processing method applied to a first server, and the method includes:
  • Determining first configuration information for a first unit the first unit being included in an electronic device or installed on the electronic device, and the first configuration information is used for secure processing of the information to be transmitted;
  • an embodiment of the present application provides an information processing method applied to a second server, and the method includes:
  • Determining second configuration information for a second unit Determining second configuration information for a second unit, the second unit being included in an electronic device or installed on the electronic device, and the second configuration information is used for security verification of target transmission information;
  • an embodiment of the present application provides an information processing device, including: an acquisition module and a processing module;
  • the acquisition module is used to acquire security protection information
  • the processing module is configured to perform security protection processing on the information transmitted inside the electronic device according to the security protection information.
  • an embodiment of the present application provides an information processing device, including: a processing module and a sending module;
  • the processing module is configured to determine first configuration information for a first unit, the first unit being included in or installed on an electronic device, and the first configuration information is used for secure processing of information to be transmitted;
  • the sending module is configured to send first target information to the electronic device, where the first target information is the first configuration information or information after security processing of the first configuration information.
  • an embodiment of the present application provides an information processing device, including: a processing module and a sending module;
  • the processing module is configured to determine second configuration information for a second unit, where the second unit is included in or installed on an electronic device, and the second configuration information is used for security verification of target transmission information;
  • the sending module is configured to send the second configuration information to the electronic device.
  • an electronic device including:
  • Processor memory, transceiver, and interface for communication with other devices;
  • the memory stores computer instructions
  • the processor executes the computer instructions stored in the memory, so that the processor executes the method according to the first aspect.
  • an embodiment of the present application provides a server, including:
  • Processor memory, transceiver, and interface for communication with other devices;
  • the memory stores computer instructions
  • the processor executes the computer instructions stored in the memory, so that the processor executes the method according to the second aspect.
  • an embodiment of the present application provides a server, including:
  • Processor memory, transceiver, and interface for communication with other devices;
  • the memory stores computer instructions
  • the processor executes the computer instructions stored in the memory, so that the processor executes the method according to the third aspect.
  • an embodiment of the present application provides a computer-readable storage medium that stores a computer-executable instruction, and when the computer-executable instruction is executed by a processor, it is used to implement the first aspect Methods.
  • an embodiment of the present application provides a computer-readable storage medium having computer-executable instructions stored in the computer-readable storage medium, and when the computer-executable instructions are executed by a processor, the The method described.
  • an embodiment of the present application provides a computer-readable storage medium that stores a computer-executable instruction, and when the computer-executable instruction is executed by a processor, it is used to implement what is described in the third aspect. The method described.
  • an embodiment of the present application provides a program, when the program is executed by a processor, it is used to execute the method described in the first aspect.
  • an embodiment of the present application provides a program, which is used to execute the method described in the second aspect when the program is executed by a processor.
  • an embodiment of the present application provides a program, which is used to execute the method described in the third aspect when the program is executed by a processor.
  • an embodiment of the present application provides a computer program product, including program instructions, and the program instructions are used to implement the method described in the first aspect.
  • an embodiment of the present application provides a computer program product, including program instructions, and the program instructions are used to implement the method described in the second aspect.
  • embodiments of the present application provide a computer program product, including program instructions, and the program instructions are used to implement the method described in the third aspect.
  • an embodiment of the present application provides a chip, including a processing module and a communication interface, and the processing module can execute the method described in the first aspect.
  • the chip also includes a storage module (such as a memory), the storage module is used to store instructions, the processing module is used to execute the instructions stored in the storage module, and the execution of the instructions stored in the storage module causes the processing module to perform the first aspect.
  • a storage module such as a memory
  • the storage module is used to store instructions
  • the processing module is used to execute the instructions stored in the storage module
  • the execution of the instructions stored in the storage module causes the processing module to perform the first aspect. The method described.
  • an embodiment of the present application provides a chip, which includes a processing module and a communication interface, and the processing module can execute the method described in the second aspect.
  • the chip also includes a storage module (such as a memory), the storage module is used to store instructions, the processing module is used to execute the instructions stored in the storage module, and the execution of the instructions stored in the storage module causes the processing module to execute the second aspect The method described.
  • a storage module such as a memory
  • the storage module is used to store instructions
  • the processing module is used to execute the instructions stored in the storage module
  • the execution of the instructions stored in the storage module causes the processing module to execute the second aspect The method described.
  • an embodiment of the present application provides a chip, including a processing module and a communication interface, and the processing module can execute the method described in the third aspect.
  • the chip also includes a storage module (such as a memory), the storage module is used to store instructions, the processing module is used to execute the instructions stored in the storage module, and the execution of the instructions stored in the storage module causes the processing module to execute the third aspect.
  • a storage module such as a memory
  • the storage module is used to store instructions
  • the processing module is used to execute the instructions stored in the storage module
  • the execution of the instructions stored in the storage module causes the processing module to execute the third aspect. The method described.
  • the twenty-second aspect of the present application provides a communication system, including: an electronic device, a first server, and a second server;
  • the electronic device is the device described in the foregoing fourth aspect
  • the first server is the device described in the foregoing fifth aspect
  • the second server is the device described in the foregoing sixth aspect.
  • the information processing method, device, equipment, and storage medium provided by the embodiments of the present application acquire security protection information inside the electronic device, and perform security protection processing on the information transmitted inside the electronic device based on the security protection information, thereby avoiding Transmission security problems caused by illegal messages transmitted inside electronic devices.
  • FIG. 1 is a schematic structural diagram of an electronic device provided by an embodiment of this application.
  • FIG. 2 is a schematic structural diagram of another electronic device provided by an embodiment of the application.
  • FIG. 3 is a schematic diagram of a flow of data in the electronic device shown in FIG. 2;
  • FIG. 4 is a schematic diagram of another flow of data in the electronic device shown in FIG. 2;
  • FIG. 5 is a schematic diagram of processing integrity protection involved in an embodiment of the application.
  • FIG. 6 is a schematic diagram of a process of encryption protection involved in an embodiment of this application.
  • FIG. 7 is a schematic flowchart of Embodiment 1 of the information processing method provided by this application.
  • FIG. 8 is a schematic structural diagram of an electronic device to which the information processing method provided in an embodiment of the application is applied;
  • Embodiment 9 is a schematic flowchart of Embodiment 2 of the information processing method provided by this application.
  • Embodiment 3 is a schematic diagram of interaction of Embodiment 3 of the information processing method provided by an embodiment of this application;
  • FIG. 11A is a schematic diagram of an application scenario of an information processing method provided by an embodiment of this application.
  • FIG. 11B is a schematic diagram of another application scenario of the information processing method provided by an embodiment of this application.
  • FIG. 12 is a schematic structural diagram of Embodiment 1 of an information processing apparatus according to an embodiment of this application.
  • FIG. 13 is a schematic structural diagram of Embodiment 2 of an information processing apparatus provided by an embodiment of this application;
  • FIG. 14 is a schematic structural diagram of Embodiment 3 of an information processing apparatus according to an embodiment of this application.
  • 15 is a schematic structural diagram of an embodiment of an electronic device provided by this application.
  • FIG. 16 is a schematic structural diagram of Embodiment 1 of a server provided by this application.
  • FIG. 17 is a schematic structural diagram of Embodiment 2 of the server provided by this application.
  • FIG. 1 is a schematic structural diagram of an electronic device provided by an embodiment of this application.
  • the electronic device may include a processor, an external memory interface, an internal memory, a bus interface, and so on.
  • the structure illustrated in this embodiment does not constitute a specific limitation on the electronic device.
  • the electronic device may include more or fewer components than those shown in the figure, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the processor may include one or more processing units.
  • the processor may include an application processor (AP), a modem processor, a graphics processing unit (GPU), and an image signal processor (image signal processor).
  • signal processor ISP, controller, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural-network processing unit (NPU), etc.
  • the different processing units may be independent devices or integrated in one or more processors.
  • the external memory interface can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device.
  • the external memory card communicates with the processor through the external memory interface to realize the data storage function.
  • the internal memory may be used to store one or more computer programs, and the one or more computer programs include instructions.
  • the processor can run the above-mentioned instructions stored in the internal memory to enable the electronic device to execute the information processing methods, various functional applications, and data processing provided in some embodiments of the present application.
  • the internal memory can include a program storage area and a data storage area. Among them, the storage program area can store the operating system; the storage program area can also store one or more application programs and so on.
  • the data storage area can store data created during the use of the electronic device, etc.
  • the processor may include one or more interfaces.
  • the interface can include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, and a universal asynchronous transmitter (universal asynchronous) interface.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • UART universal asynchronous transmitter
  • MIPI mobile industry processor interface
  • GPIO general-purpose input/output
  • SIM subscriber identity module
  • USB Universal Serial Bus
  • the USB interface is an interface that conforms to the USB standard specification, and specifically may be a Mini USB interface, a Micro USB interface, a USB Type C interface, and so on.
  • the USB interface can be used to connect a charger to charge an electronic device, or it can be used to transfer data between an electronic device and a peripheral device, or it can be used to connect a headset to play audio through the headset.
  • the interface connection relationship between the modules illustrated in the embodiment of the present invention is merely a schematic description, and does not constitute a structural limitation of the electronic device.
  • the electronic device may also adopt different interface connection modes in the foregoing embodiments, or a combination of multiple interface connection modes.
  • the electronic device may further include: a communication module, an antenna, etc., so that the electronic device can implement a communication function.
  • the communication module can be divided into a wireless communication module and a wireless communication module.
  • the antenna is used to transmit and/or receive electromagnetic wave signals.
  • the electronic device may include multiple antennas, and each antenna may be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.
  • the mobile communication module can provide wireless communication solutions such as 2G/3G/4G/5G that are applied to electronic devices.
  • the mobile communication module may include at least one filter, switch, power amplifier, low noise amplifier, etc.
  • at least part of the functional modules of the mobile communication module may be provided in the processor.
  • at least part of the functional modules of the mobile communication module and at least part of the modules of the processor may be provided in the same device.
  • the wireless communication module can provide applications on electronic devices including wireless local area networks (WLAN), Bluetooth, global navigation satellite system (GNSS), frequency modulation (FM), NFC, infrared technology (infrared, IR) and other wireless communication solutions.
  • the wireless communication module may be one or more devices integrating at least one communication processing module.
  • the electronic device includes multiple antennas, some antennas are coupled with a mobile communication module, and other antennas are coupled with a wireless communication module, so that the electronic device can communicate with the network and other devices through wireless communication technology.
  • wireless communication technologies may include GSM, GPRS, CDMA, WCDMA, TD-SCDMA, LTE, GNSS, WLAN, NFC, FM, and/or IR technologies.
  • the aforementioned GNSS may include global positioning system (GPS), global navigation satellite system (GLONASS), Beidou navigation satellite system (BDS), and quasi-zenith satellite system (quasi- Zenith satellite system, QZSS) and/or satellite-based augmentation systems (SBAS).
  • the electronic device may also include other functional modules, such as audio modules, sensors, buttons, cameras, display screens, and user identification modules. (subscriber identification module, SIM) card interface, etc. Regarding the functional realization of these modules, they can be determined according to actual needs, and this application will not repeat them.
  • functional modules such as audio modules, sensors, buttons, cameras, display screens, and user identification modules. (subscriber identification module, SIM) card interface, etc.
  • SIM subscriber identification module
  • FIG. 2 is a schematic structural diagram of another electronic device provided in an embodiment of the application.
  • multiple applications and operating systems may be installed on the electronic device, and the electronic device includes a protocol layer module.
  • the application is a client that uses an electronic device as a host and displays certain functions through the electronic device, and is located in the application layer of the electronic device.
  • An operating system (OS) is the software implementation basis for each function of an electronic device, and a protocol layer module can implement certain processing functions based on certain set protocols.
  • OS operating system
  • the following takes the electronic device as a mobile terminal as an example to briefly introduce the electronic device, applications, operating system, and protocol layer modules.
  • mobile terminals are the prerequisite and basis for realizing mobile interconnection.
  • Mobile terminals are devices with strong computing, storage and processing capabilities, and functional components such as touch screens, positioning, and video cameras, but are not limited to these functional components.
  • the mobile terminal has an intelligent operating system and an open software platform.
  • the operating system is the foundation of mobile Internet software technology.
  • the operating system and the mobile Internet software technology include basic middleware, business middleware, and communication middleware to realize application support together.
  • applications can include local applications and Web applications.
  • an application is composed of components, and the interaction, communication, and navigation between the components are realized through the network.
  • the operating system may be Android, or IOS, or other types of operating systems.
  • the embodiment of the present application does not limit it.
  • Android is an open source operating system based on Linux, mainly used for portable devices. It is the name of an open source mobile phone operating system based on the Linux platform, which consists of an operating system, middleware, user interface, and application software.
  • IOS is an operating system based on the UNIX kernel. It has a Darwin kernel based on the microkernel (partial tasks of the system kernel are handed over to the user layer process for processing) Mach.
  • the microkernel provides a set of "most basic” services and other services.
  • the "most basic” services such as process scheduling, inter-process communication, storage management, and processing I/O devices.
  • Other services such as file management, network support, etc., are connected to the microkernel through interfaces.
  • FIG. 3 is a schematic diagram of a flow of data in the electronic device shown in FIG. 2.
  • the electronic device may be a terminal device.
  • the following explains and explains the information interaction between the application installed on the terminal device and the protocol layer module included in the terminal device.
  • FIG. 3 uses three applications (APP-1, APP-2, and APP-3) installed on the electronic device for explanation.
  • the protocol layer module may include a policy processing module, a non-access (NAS) layer module, an access (AS) layer module, and other modules that process 3GPP protocols.
  • NAS non-access
  • AS access
  • the protocol layer module of the terminal device can perform connections (such as Protocol data unit (protocol data unit, PDU) session) binding.
  • connections such as Protocol data unit (protocol data unit, PDU) session
  • Data streams with different sources can be distinguished by the identification of the source.
  • data streams of different applications can be distinguished by APP ID.
  • a possible internal interaction of the terminal can be referred to as shown in FIG. 3.
  • APP-3 of the terminal device needs to send data, it first sends a request message to the OS, and the request message may carry parameters such as APP ID to indicate which APP is the request.
  • the OS sends the request message to the protocol layer module.
  • the policy processing module of the protocol layer module determines which URSP rule needs to be matched according to the processing policy and the APP ID carried in the received request message, and then the policy processing module sends it to the NAS layer
  • the PDU session binding or establishment request uses the NAS layer module to perform the corresponding connection binding or establishment according to the matching URSP rule, and finally transmits it to the access (AS) layer module and other modules for processing.
  • AS access
  • the data transmission method in Figure 3 helps to realize flexible APP data binding.
  • different APPs such as APP-1, APP-2, APP-3) can provide different APP ID characteristics, protocol layer modules
  • the policy processing module first determines the URSP rule corresponding to the APP ID carried in the received request message, and then interacts with the NAS layer module to bind the data stream of the requesting APP to a specific connection for transmission.
  • the data transmission method of FIG. 3 has security risks.
  • the APP at the application layer may provide an incorrect APP ID, which will cause the protocol layer module to bind the data stream of the APP to a connection that does not belong to the APP for transmission.
  • FIG. 4 is a schematic diagram of another flow direction of the data flow in the electronic device shown in FIG. 2.
  • the protocol layer module when the protocol layer module is processing, if the traffic descriptor in a certain URSP rule-1 only has APP-3ID, the PDU session corresponding to the URSP rule is only used for data transmission of APP-3 .
  • the protocol layer module When APP-1 and/or APP-2 also send a request message to the protocol layer module through the OS, if the APP-3ID is carried in the request message, the protocol layer module will also transfer the data flow of APP-1 and/or APP-2 Binding to the PDU session corresponding to URSP rule-1 for transmission, that is, the data stream of APP-1 and/or APP-2 is bound to the connection that does not originally belong to it for transmission, thereby occupying the connection resources of other applications , Disrupting the original processing rules, leading to potential safety hazards in the internal information interaction of electronic devices such as terminal devices.
  • the embodiments of the present application provide an information processing method.
  • the electronic device first obtains security protection information, and then performs security protection processing on the information transmitted inside the electronic device according to the security protection information, thereby avoiding the internal transmission of the electronic device.
  • Integrity protection complete protection
  • FIG. 5 is a schematic diagram of processing integrity protection involved in an embodiment of this application.
  • the sender and receiver will negotiate the information required to perform integrity protection, that is, the input parameters of the integrity protection algorithm (abbreviation, complete protection algorithm), for example, integrity protection Secret key (abbreviation, complete protection secret key), the first information (which can be a message or a parameter) that needs integrity protection, and other input information (such as count value, random number, etc.), this embodiment of the application does not do it Limited) and so on.
  • the integrity protection algorithm abbreviation, complete protection algorithm
  • integrity protection Secret key abbreviation, complete protection secret key
  • the first information which can be a message or a parameter
  • other input information such as count value, random number, etc.
  • the sender of the data takes the security key, the first information, and other input information as the input of the security algorithm, and the security algorithm processes them to generate an integrity message authentication code (message authentication code-integrity). , MAC-I).
  • an integrity message authentication code (message authentication code-integrity). , MAC-I).
  • the first information after the protection process is sent to the receiving end together with MAC-I, and the receiving end also uses the same method to input the previously negotiated integrity key, first information, and other input information to the end.
  • an XMAC-I is calculated, and the receiving end judges whether the XMAC-I is consistent with the MAC-I carried by the transmitting end, and if they are consistent, it is determined that the complete guarantee verification is successful.
  • the MAC-I can be a signature or a character string unique to the first message.
  • XMAC-I can be a desired signature or a desired character string unique to the first message; moreover, a different first message The character string unique to the message is different.
  • the embodiments of the present application do not limit the specific implementation of MAC-I and XMAC-I, which can be determined according to actual conditions, and will not be repeated here.
  • Encryption protection that is, to avoid being seen by other attackers during the parameter/message sending process.
  • FIG. 6 is a schematic diagram of a process of encryption protection involved in an embodiment of this application.
  • the sender and receiver will negotiate the information required to execute the encryption algorithm, that is, the input parameters of the encryption algorithm, for example, the encryption key and multiple input information (for example, input 1 , Input 2 and other inputs).
  • the input information may be a parameter such as a count value, a direction value, etc.
  • the embodiment of the present application does not limit the specific expression form of the input information.
  • the sender first uses the encryption key and certain input information to calculate the key stream block through the encryption algorithm, and then uses the key stream block to process the plaintext parameters/messages to be transmitted (Such as convolution operation) generate encrypted parameters/messages, and transmit the encrypted parameters/messages to the receiving end.
  • the receiving end first uses the same input parameters of the encryption algorithm (encryption key and multiple inputs) as the sender to calculate the key stream block, and then uses the key stream block to perform the encryption on the received encrypted parameters/messages.
  • Reverse processing such as deconvolution
  • the complete protection processing and the encryption processing can be used at the same time, or only one can be used, which is not limited in the embodiment of the present application.
  • the security algorithms and encryption algorithms used in 3GPP NR are mainly as follows:
  • NIA0 Null Integrity Protection algorithm, that is, empty complete protection algorithm (incomplete protection);
  • 128-NIA1 128-bit SNOW 3G based algorithm, that is, 128-bit SNOW 3G complete guarantee algorithm;
  • 128-NIA2 128-bit AES based algorithm, that is, 128-bit AES fully guaranteed algorithm
  • 128-NIA3 128-bit ZUC based algorithm, that is, 128-bit ZUC based algorithm.
  • NEA0 Null ciphering algorithm, that is, null encryption algorithm (no encryption);
  • 128-NEA1 128-bit Snow 3G based algorithm, that is, 128-bit Snow 3G encryption algorithm;
  • 128-NEA2 128-bit AES based algorithm, that is, 128-bit AES encryption algorithm
  • 128-NEA3 128-bit ZUC based algorithm, that is, 128-bit ZUC based encryption algorithm.
  • FIG. 7 is a schematic flowchart of Embodiment 1 of the information processing method provided by this application. This method can be applied to an electronic device.
  • the electronic device is a terminal device.
  • the schematic diagram of the structure of the electronic device can be referred to as shown in FIG. 2 above. Referring to FIG. 7, in this embodiment, the method may include the following steps:
  • the security protection information used to perform security protection processing on the information can be obtained first.
  • the security protection information may include one parameter, or may include two or more parameters.
  • the embodiment of the present application does not limit the specific implementation of the security protection information and the number of parameters included, which can be determined according to actual needs, and will not be repeated here.
  • the security protection information may be information pre-stored in the electronic device, or information received from other devices.
  • the embodiment of the present application does not limit it.
  • the security protection information is information pre-stored in the electronic device
  • the two units when there is a demand for information transmission between two units of the electronic device, the two units first obtain the corresponding information based on preset rules. Safely protect information.
  • the security protection information required for information transmission between different units may be the same or different, which is not limited in the embodiments of the present application.
  • S701 can be implemented in the following manner:
  • the electronic device may receive the security protection information from other devices.
  • other devices may send the content included in the security protection information to the electronic device through more than one message, and correspondingly, the electronic device may respectively parse and obtain the content of the security protection information from the received messages.
  • other devices can carry the content included in the security protection information in one message and send to the electronic device, or can carry the content included in the security protection information in two or more messages and send to the electronic device.
  • the embodiments of the present application do not limit the content included in the security protection information obtained by the electronic device from several messages, which can be determined according to actual conditions.
  • the security protection information includes at least one of the following information:
  • Security calculation information identification information of the first unit.
  • the first unit is the initiator of the information to be transmitted in the electronic device.
  • the recipient of the information to be transmitted can determine the initiator so as to perform corresponding operations.
  • the secure calculation information may enable the initiator of the information to be transmitted to perform security processing on the information to be transmitted, or enable the receiver of the information to be transmitted to perform security verification on the information to be transmitted.
  • the identification information of the first unit may be information that has been safely processed, or it may be information that has not been processed safely, which can be determined according to actual conditions, and will not be repeated here.
  • the security information received by the initiator may not carry the foregoing secure computing information.
  • the security information received by the recipient may not carry the identification information of the first unit. Therefore, the content actually included in the security protection information can be determined according to the actual scenario, and will not be repeated here.
  • the foregoing secure computing information includes at least one of the following information:
  • the content included in secure computing information is mainly used for the realization of security protection processing.
  • the embodiments of this application do not limit the specific content included in secure computing information. As long as the initiator and receiver of the information to be transmitted have agreed in advance, it can be It is sufficient to implement a security protection process.
  • the security protection information may further include: the corresponding relationship between the identification information of the first unit and the security computing information. In this way, the information transmitted inside the electronic device can be targeted for security protection processing, and the processing efficiency is improved.
  • the identification information of the first unit included in it can be understood as the descriptor of the first unit, which can be Used to distinguish the security calculation information corresponding to different units in the electronic device.
  • the descriptor of the first unit and the identifier of the first unit transmitted inside the electronic device may be the same parameter or different parameters, which are not limited in the embodiment of the present application.
  • S702 Perform security protection processing on the information transmitted inside the electronic device according to the foregoing security protection information.
  • the initiator and the receiver can respectively process the internally transmitted information, so as to ensure the legitimacy and security of the information transmitted by the initiator and the receiver It can receive correct and legal information, so as to ensure that the internal processing rules of the electronic device are correct, and solve the hidden security problems of internal transmission.
  • the electronic device first obtains security protection information, and then performs security protection processing on the information transmitted inside the electronic device according to the security protection information, thereby avoiding the illegal transmission of messages inside the electronic device. Transmission security problems.
  • FIG. 8 is a schematic structural diagram of an electronic device to which the information processing method provided in an embodiment of the application is applied.
  • the electronic device may include: a first unit and a second unit that can communicate with each other.
  • an operating system and at least one application are installed on the electronic device, and the electronic device includes a protocol layer module.
  • the specific implementation of the first unit and the second unit may include the following situations:
  • the first unit is any one of at least one application
  • the second unit is an operating system or a protocol layer module. That is, the first unit is an application installed on the electronic device, and the second unit is an operating system installed on the electronic device, or the first unit is an application installed on the electronic device, and the second unit is a protocol layer included in the electronic device. Module.
  • the first unit is the aforementioned operating system
  • the second unit is any application or protocol layer module among at least one application. That is, the first unit is an operating system installed on the electronic device, and the second unit is an application installed on the electronic device, or the first unit is an operating system installed on the electronic device, and the second unit is a protocol layer included in the electronic device. Module.
  • the first unit is the aforementioned protocol layer module
  • the second unit is any one of the operating system or at least one application. That is, the first unit is a protocol layer module included in the electronic device, and the second unit is an application installed on the electronic device, or the first unit is a protocol layer module included in the electronic device, and the second unit is an operation installed on the electronic device system.
  • first unit and the second unit may change according to actual scenarios or system changes, which are not limited in the embodiments of the present application.
  • FIG. 9 is a schematic flowchart of Embodiment 2 of the information processing method provided by this application. As shown in FIG. 9, in this embodiment, the above S702 can be implemented through the following steps:
  • the first unit transmits the security-processed target transmission information to the second unit.
  • the target transmission information is first determined.
  • the target transmission information is a message that has undergone security processing.
  • the target transmission information is obtained by performing security processing on the first unit of the information to be transmitted.
  • the first unit when the first unit needs to transmit the information to be transmitted to the second unit, it first performs security processing on the information to be transmitted according to the received security protection information to obtain the target transmission information, and then transmit the target transmission information To the second unit.
  • the target transmission information is obtained by performing security processing on other devices on the information to be transmitted.
  • the first unit needs to transmit to the second unit the target transmission information that has been safely processed, that is, other devices have performed security processing on the information to be transmitted based on the security protection information, and the target transmission information is obtained. It is directly transmitted to the first unit, so that the first unit can directly transmit the received target transmission information to the second unit.
  • the embodiment of the present application does not limit it.
  • the security processing may include: encrypting information and/and integrity protection.
  • the second unit uses the security protection information to perform security verification on the received target transmission information.
  • the second unit may perform security verification on the target transmission information according to the received security protection information.
  • the security verification includes: decrypting information and/or integrity protection authentication.
  • the second unit may perform reverse processing on the target transmission information according to the specific operation of the receiving end in FIG. 5 or FIG. 6 described above. For example, if the target transmission information is obtained through integrity protection processing, the second unit can perform integrity protection authentication on the target transmission information; if the target transmission information is obtained through encryption processing, the second unit can perform integrity protection authentication on the target transmission information. Encrypted authentication.
  • the electronic device includes a first unit and a second unit
  • the first unit can transmit the target transmission information of the secure processing to the second unit
  • the second unit uses the secure
  • the protection information performs security verification on the received target transmission information, thereby ensuring the security and legality of the information transmission between the first unit and the second unit.
  • the foregoing security protection information may include: first configuration information and/or second configuration information.
  • the first configuration information is received by the first unit from the first server
  • the second configuration information is received by the second unit from the second server.
  • the acquired security protection information can be divided into first configuration information and/or second configuration information.
  • the security protection information includes the first configuration information and the second configuration information, it may be received from the corresponding server respectively.
  • the first unit receives the first configuration information from the first server
  • the second unit receives the second configuration information from the second server.
  • the first server may be a device for supporting the realization of the functions of the first unit and providing services required by the first unit
  • the second server may be a device for supporting the realization of functions of the second unit and providing the second unit.
  • the service equipment required by the unit may be a device for supporting the realization of the functions of the first unit and providing services required by the first unit
  • the second server may be a device for supporting the realization of functions of the second unit and providing the second unit.
  • the first unit is an application installed on an electronic device
  • the first server is an application server
  • the first unit is an operating system installed on an electronic device
  • the first server is a manufacturer's server
  • the first unit is an operating system installed on the electronic device
  • One unit is a protocol layer module included in the electronic device, and the first server is an operator server.
  • the second server is an application server; or, if the second unit is an operating system installed on the electronic device, the second server is a manufacturer's server; or, if The second unit is a protocol layer module included in the electronic device, and the second server is an operator server.
  • the specific implementation of the first unit and the first server, the second unit and the second server can be determined according to actual conditions, and will not be repeated here.
  • FIG. 10 is a schematic diagram of interaction in Embodiment 3 of the information processing method provided by an embodiment of the application.
  • the information interaction between the electronic device, the first server, and the second server is used for explanation.
  • the information processing method may include the following steps:
  • the first server and the second server respectively determine security protection information.
  • the first server corresponding to the first unit and the second server corresponding to the second unit may first determine to perform the transmission of the information.
  • Security protection information required for processing.
  • the aforementioned security protection information may include first configuration information for the first unit and second configuration information for the second unit.
  • the first server and the second server may directly determine the aforementioned security protection information through information exchange negotiation, that is, the first server determines the first configuration information for the first unit, Correspondingly, the second server determines the second configuration information for the second unit.
  • the first server and the second server may both be connected to a third-party management node, and the third-party management node is used to manage the security protection information of the communication between the first unit and the second unit
  • the first server can obtain the aforementioned security protection information by communicating with the third-party management node
  • the second server can also obtain the aforementioned security protection information by communicating with the third-party management node.
  • the embodiment of the present application does not limit the manner in which the first server and the second server obtain the security protection information, which can be determined according to actual needs.
  • the first configuration information can be used for the security processing of the information to be transmitted; the second configuration information can be used for Security verification of target transmission information.
  • the security protection information may include at least one of secure computing information and identification information of the first unit. Therefore, in this embodiment
  • the first configuration information and/or the second configuration information may also include at least one of the following information: secure computing information and identification information of the first unit.
  • the security calculation information includes at least one of the following information: secret key, algorithm identification information, and algorithm content information.
  • the second configuration information may further include: the corresponding relationship between the identification information of the first unit and the secure computing information.
  • different first units can use different secure computing information for processing.
  • the second unit can use The corresponding security calculation information processes the received target transmission information.
  • the first server sends first target information to the electronic device, where the first target information is first configuration information or information that has undergone security processing of the first configuration information.
  • the processing operation on the first configuration information may include the following specific implementations:
  • the first server directly sends the first configuration information to the electronic device. Specifically, the first server directly sends the first configuration information to the first unit of the electronic device, so that the first unit uses The first configuration information is sent to the second unit after performing security processing such as encryption and/and integrity protection on the information to be transmitted.
  • the first configuration information may include information such as the descriptor of the first unit, which is mainly used to distinguish different units in the electronic device.
  • the first server first uses the determined first configuration information to perform security processing such as encryption and/or integrity protection on the information to be transmitted to obtain the first target information, and then send the first target information To the first unit of the electronic device, so that the first unit directly sends it to the second unit, or performs other operations.
  • security processing such as encryption and/or integrity protection
  • the embodiment of the present application does not limit the specific content of the first target information, which can be determined according to actual conditions.
  • the second server sends second configuration information to the electronic device.
  • the second server after the second server determines the second configuration information, it can send the second configuration information to the electronic device. Specifically, the second server sends the second configuration information to the second unit of the electronic device. So that when the second unit receives the target transmission information from the first unit, it can use the second configuration information to decrypt the target transmission information and/or perform security verification processing such as integrity verification.
  • the second configuration information may be included in other information sent by the second server to the electronic device. That is, when the second server needs to transmit other information to the second unit of the electronic device, the second server can include the second configuration information in other information and transmit it to the second unit, which can reduce the resources for information transmission. Consumption, improve resource utilization.
  • the first unit of the electronic device performs security processing on the received first target information to obtain the target transmission information.
  • the first unit when the first target information is the first configuration information, the first unit can use it to perform encryption processing or integrity protection processing on the information transmitted inside the electronic device.
  • the first target information is information that has undergone security processing of the first configuration information
  • S1004 is optional.
  • the first target information is the target transmission information to be transmitted by the first unit.
  • the first unit may perform security processing on the information to be transmitted according to the first configuration information, for example, perform processing procedures such as encryption and/or integrity protection on the information to be transmitted.
  • the first unit transmits the securely processed target transmission information to the second unit.
  • the second unit uses the second configuration information to perform security verification on the received target transmission information.
  • the second configuration information is included in other information received by the second unit from the second server.
  • the security verification includes: decrypting information and/or integrity protection authentication.
  • the first server may send the first target information to the electronic device.
  • the first target information is the first configuration information or the After the first configuration information is safely processed, the second server sends the second configuration information to the electronic device.
  • the first unit of the electronic device can perform security processing on the received first target information to obtain the target transmission information, and transmit it
  • the second unit uses the second configuration information to perform security verification on the received target transmission information.
  • FIG. 11A is a schematic diagram of an application scenario of the information processing method provided by an embodiment of this application.
  • the electronic device is a terminal device
  • the first unit is one of multiple applications installed on the electronic device
  • the second unit is a protocol layer module included in the electronic device, for example, a UE module
  • the UE module includes: a policy processing module, a NAS layer and an AS layer.
  • the first unit is APP-3
  • the first server is the application server of APP-3
  • the second unit is the policy processing module of the protocol layer module
  • the second server is the operator server.
  • the electronic device is a terminal device
  • the operator server is a core network element, such as a policy control function (PCF). Therefore, when the PCF sends the determined security protection information and other parameters to the protocol layer module of the terminal device, in an embodiment, the PCF may first encapsulate the security protection information through a container, and then encapsulate the encapsulated Container It is sent to the access management function (AMF), and finally the AMF sends the encapsulated Container to the protocol layer module of the terminal device through the NAS message; in another embodiment, the PCF does not pass through the container (Container ) Encapsulates the security protection information, but is directly transmitted by the PCF to the AMF, so that the AMF uses the NAS message to send the security protection information to the protocol layer module.
  • the PCF does not pass through the container (Container ) Encapsulates the security protection information, but is directly transmitted by the PCF to the AMF, so that the AMF uses the NAS message to send the security protection information to the protocol layer module.
  • the security calculation information and the identification of the first unit included in the security protection information may be transmitted through one message, or may be transmitted through different messages.
  • the APP-3 application server and the operator server first determine the secure computing information, for example, the secret key and/or algorithm information used; then, the APP-3 application server converts the secret key and/or algorithm Secure computing information such as information is sent to APP-3 of the terminal device, and the operator server sends secure computing information such as secret key and/or algorithm information to the protocol layer module (specifically, the policy processing module) of the terminal device; then, APP-3
  • the application server and the operator server respectively determine the corresponding APP, that is, the APP descriptor, for example, the APP-3 descriptor, and the APP-3 application server sends the determined APP-3 descriptor to the APP-3 of the terminal device ,
  • the operator server sends the determined APP-3 descriptor to the protocol layer module (specifically, the policy processing module) of the terminal device.
  • the above-mentioned secret key may be one or two of an encryption key and a complete secret key.
  • the above algorithm information can be an algorithm identification or specific content of the algorithm.
  • the algorithms that can be used in the embodiments of the present application may include, but are not limited to, the security algorithms and encryption algorithms defined by 3GPP, and they may also be other algorithms, which are not limited here.
  • the operator server when the operator server sends the secret key and/or algorithm information to the protocol layer module (specifically, the policy processing module) of the terminal device, it may also include secure computing information such as the secret key and/or algorithm information and the identification information of the APP.
  • secure computing information such as the secret key and/or algorithm information and the identification information of the APP.
  • the corresponding relationship between the two is because different APPs can correspond to different secret keys and/or algorithm information (for example, APP-1, APP-2, and APP-3 respectively correspond to different secret keys and/or algorithm information).
  • Table 1 is an example in which the security processing of the information to be transmitted is performed at the APP layer of the terminal.
  • the security protection information mainly includes the identification information of the APP (using the APP descriptor to indicate the APP in the terminal), the key corresponding to each APP (the complete security key and/or the encryption key), and the corresponding key of each APP
  • the algorithm complete protection algorithm and/or encryption algorithm
  • the content that the APP transmits to the OS or protocol layer module is the information to be transmitted, for example, the corresponding APP ID.
  • the APP descriptor and the APP ID may be the same parameter or different parameters, which may be determined according to actual conditions.
  • the parameters in Table 1 may be sent by the application server to the corresponding APP of the terminal device through the application layer, and sent by the operator server to the policy processing module of the protocol layer module through 3GPP signaling (such as NAS signaling).
  • the operator server may send the identification information of the APP to the protocol layer module (specifically the policy processing module) through the processing policy rules, and then there is no need to separately send the APP's information to the protocol layer module (specifically the policy processing module).
  • Identification information for example, APP-3descriptor.
  • the application server of the APP can respectively send the above-mentioned secure computing information (key and/or algorithm information) and the identification information of the APP, or it can be sent by the same message, and the operator server can send it separately.
  • the aforementioned secure computing information (secret key and/or algorithm information) and APP identification information can also be sent through the same message.
  • the safety computing information and the identification information of the APP can be sent separately.
  • the secure computing information and the identification information of the APP can also be sent through the same message.
  • the identification information of the APP may be a string or a domain name, as long as the specific APP can be distinguished, and the specific format of the identification information of the APP is not limited in the embodiment of the present application.
  • FIG. 11B is a schematic diagram of another application scenario of the information processing method provided in an embodiment of the present application.
  • the schematic diagrams of FIG. 11B and FIG. 11A include the same structure of the device. The difference is: in FIG. 11A, the security processing of the information to be transmitted is performed on the APP side of the terminal device, while in FIG. 11B, the security processing of the information to be transmitted is performed in the APP application. After being executed on the server side, it is transmitted to the corresponding APP.
  • the application server of the APP can first process the information to be transmitted (for example, the application server of APP-3 corresponds to the APP-3ID), for example, first use the secret key and/or algorithm information on the application server of the APP.
  • the secure computing information processes the APP ID to obtain the processed APP ID, and then sends it together with the APP descriptor to the corresponding APP of the terminal device.
  • the operator server can still send the clear text APP ID and APP ID as usual. Descriptor, secret key and/or algorithm information.
  • the advantage of this is that the APP of the terminal device will not obtain the secret key and/or algorithm information, which avoids the security risk of the plaintext APP ID being leaked.
  • Table 2 is an example in which the security processing of the information to be transmitted is performed on the application server of the APP.
  • the security protection information mainly includes APP identification information (using the APP descriptor to indicate the APP in the terminal), the secret key corresponding to each APP (complete security key and/or encryption key), and each APP Corresponding algorithm (complete security algorithm and/or encryption algorithm); optionally, the content delivered by the APP to the OS or protocol layer module is the information to be transmitted after security processing, for example, the APP ID after security processing.
  • APP descriptor and APP ID can be the same parameter or different parameters, which can be determined according to actual conditions.
  • the parameters in the first column identification information of the APP
  • the parameters in the fourth column the content passed by the APP to the OS layer or protocol layer module
  • the APP of the terminal device, and all the parameters in Table 2 can be passed through 3GPP signaling (such as NAS signaling) )
  • the policy processing module sent by the operator server to the protocol layer module.
  • APP-3 of the terminal device when APP-3 of the terminal device needs to send data, it first sends a request message to the OS layer.
  • the request message can carry the security-processed APP ID.
  • the OS layer sends a request message to the OS layer.
  • the policy processing module of the protocol layer module sends the request message and includes the processed APP ID.
  • the policy processing module decrypts the processed APP ID and/or complete security verification according to the key corresponding to the APP ID previously configured or received from the operator server.
  • the plaintext APP is used
  • the ID and policy processing rules are evaluated to determine the policy rule corresponding to the APP (such as URSP Rule), and the binding of the connection or the establishment of a new connection is triggered according to the content of the URSP rule.
  • the technical solution of this application can ensure that the 3GPP layer module in the terminal device receives the correct information sent by the APP. Since other APPs have not received the secret key and algorithm, they cannot fake the same APP ID.
  • the scenario where the merchant server and different over-the-top (OTT) devices negotiate different APP IDs plays a role of security protection.
  • the technical solution of this application is not limited to the 5G system, any other systems are applicable, and the technical solution of this application is not limited to APP ID verification, for the information sent to the OS or protocol layer module from the APP layer of any terminal device
  • the parameters/parameters can all be secured through the same mechanism, and other information/parameters can include network slicing parameters, data network (DN) parameters, access APNs, and so on.
  • the embodiment of the present application does not limit the parameters that need to be processed, which can be determined according to the actual situation, and will not be repeated here.
  • the technical solution of this application does not limit the direction of the APP to the OS layer or protocol layer module.
  • the AS/NAS in the protocol layer module sends information (for example, quality of service) to the APP.
  • QoS includes any parameter and UE location information, cell identification, tracking area adjustment information), can also be fully protected by the same mechanism, and will not be repeated here.
  • FIG. 12 is a schematic structural diagram of Embodiment 1 of an information processing apparatus according to an embodiment of this application.
  • the device can be integrated in an electronic device or realized by an electronic device. As shown in FIG. 12, the device may include: an acquisition module 1201 and a processing module 1202.
  • the obtaining module 1201 is used to obtain security protection information
  • the processing module 1202 is configured to perform security protection processing on the information transmitted inside the electronic device according to the security protection information.
  • the electronic device includes: a first unit and a second unit;
  • the processing module 1202 is specifically configured to transmit securely processed target transmission information to the second unit through the first unit, and use the security protection information to secure the received target transmission information through the second unit verify.
  • the target transmission information is obtained by performing security processing on the information to be transmitted on the first unit, or the target transmission information is obtained by performing security processing on the information to be transmitted on other devices.
  • the security processing includes: encrypting information and/and integrity protection
  • the security verification includes: decrypting information and/or integrity protection authentication.
  • the security protection information includes: first configuration information and/or second configuration information
  • the first configuration information is received by the first unit from a first server
  • the second configuration information is received by the second unit from a second server.
  • the second configuration information is included in other information received by the second unit from the second server.
  • an operating system and at least one application are installed on the electronic device, and the electronic device includes a protocol layer module;
  • the first unit is any one of the at least one application, and the second unit is the operating system or the protocol layer module; or
  • the first unit is the operating system, and the second unit is any one of the at least one application or the protocol layer module; or
  • the first unit is the protocol layer module
  • the second unit is any one of the operating system or the at least one application.
  • the first unit is any one of the at least one application, and the second unit is the protocol layer module.
  • the security protection information includes at least one of the following information:
  • Security calculation information identification information of the first unit.
  • the security protection information further includes: the corresponding relationship between the identification information of the first unit and the security computing information.
  • the secure computing information includes at least one of the following information:
  • the obtaining module 1201 is specifically configured to obtain the content included in the security protection information from at least one message received.
  • the electronic device is a terminal device.
  • the device provided in this embodiment is used to implement the technical solutions of the electronic equipment in the embodiments shown in FIG. 7 to FIG. 10, and its implementation principles and technical effects are similar, and will not be repeated here.
  • FIG. 13 is a schematic structural diagram of Embodiment 2 of an information processing apparatus provided by an embodiment of this application.
  • the device can be integrated in the server or realized by the server. As shown in FIG. 13, the device may include: a processing module 1301 and a sending module 1302.
  • the processing module 1301 is used to determine first configuration information for a first unit, the first unit being included in or installed on an electronic device, and the first configuration information is used for secure processing of the information to be transmitted ;
  • the sending module 1302 is configured to send first target information to the electronic device, where the first target information is the first configuration information or information after the first configuration information is safely processed.
  • the security processing includes: encrypting and/and integrity protection of information.
  • the first unit is an application installed on the electronic device, and the device is an application server; or
  • the first unit is an operating system installed on the electronic device, and the device is a vendor server; or
  • the first unit is a protocol layer module included in the electronic device, and the device is an operator server.
  • the first configuration information includes at least one of the following information:
  • Safe computing information identification information of the first unit.
  • the secure computing information includes at least one of the following information:
  • the device provided in this embodiment is used to implement the technical solutions of the first server in the embodiments shown in FIG. 7 to FIG. 10, and its implementation principles and technical effects are similar, and will not be repeated here.
  • FIG. 14 is a schematic structural diagram of Embodiment 3 of an information processing apparatus provided by an embodiment of this application.
  • the device can be integrated in the server or realized by the server. As shown in FIG. 14, the device may include: a processing module 1401 and a sending module 1402.
  • the processing module 1401 is configured to determine second configuration information for a second unit, the second unit is included in or installed on an electronic device, and the second configuration information is used for security verification of target transmission information ;
  • the sending module 1402 is used to send the second configuration information to the electronic device.
  • the security verification includes: decrypting information and/or integrity protection authentication.
  • the second unit is an application installed on the electronic device, and the device is an application server; or
  • the second unit is an operating system installed on the electronic device, and the device is a vendor server; or
  • the second unit is a protocol layer module included in the electronic device, and the device is an operator server.
  • the second configuration information includes at least one of the following information:
  • the first unit is a unit included or installed in the electronic device that can perform information transmission with the second unit.
  • the second configuration information further includes: a correspondence between the identification information of the first unit and the secure computing information.
  • the secure computing information includes at least one of the following information:
  • the second configuration information is included in other information sent by the apparatus to the electronic device.
  • the device provided in this embodiment is used to implement the technical solutions of the second server in the embodiments shown in FIG. 7 to FIG. 10, and its implementation principles and technical effects are similar, and will not be repeated here.
  • the division of the various units of the above device is only a division of logical functions, and may be fully or partially integrated into a physical entity during actual implementation, or may be physically separated. And these units can all be implemented in the form of software called by processing elements; they can also be implemented in the form of hardware; part of the units can be implemented in the form of calling software by processing elements, and some of the units can be implemented in the form of hardware.
  • the first processing unit and/or the second processing unit may be separately established processing elements, or they may be integrated in a chip of the above-mentioned device for implementation, in addition, they may also be stored in the memory of the above-mentioned device in the form of program code.
  • the function of the above first processing unit and/or second processing unit is invoked and executed by a certain processing element of the above-mentioned device.
  • the implementation of other units is similar.
  • all or part of these units can be integrated together or implemented independently.
  • the processing element described here may be an integrated circuit with signal processing capability.
  • each step of the above method or each of the above units can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.
  • the above units may be one or more integrated circuits configured to implement the above methods, for example: one or more application specific integrated circuits (ASIC), or one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (FPGA), etc.
  • ASIC application specific integrated circuit
  • DSP digital signal processor
  • FPGA field programmable gate arrays
  • the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processors that can call program codes.
  • CPU central processing unit
  • these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • FIG. 15 is a schematic structural diagram of an embodiment of an electronic device provided by this application. As shown in FIG. 15, the electronic device may include: a processor 1501, a memory 1502, a transceiver 1503, and an interface 1504 for communicating with other devices.
  • the memory 1502 is used to store computer execution instructions; the transceiver 1503 is used to communicate with other devices through the interface 1504, and the processor 1501 executes the computer execution instructions stored in the memory 1502, so that the processor 1501 executes as shown in the previous figure. 7 to FIG. 10 show the technical solutions of the electronic equipment in the embodiments.
  • FIG. 16 is a schematic structural diagram of Embodiment 1 of a server provided by this application.
  • the server may include a processor 1601, a memory 1602, a transceiver 1603, and an interface 1604 for communicating with other devices.
  • the memory 1602 is used to store computer execution instructions; the transceiver 1603 is used to communicate with other devices through the interface 1604, and the processor 1601 executes the computer execution instructions stored in the memory 1602, so that the processor 1601 executes as shown in the previous figure. 7 to the technical solutions of the first server in the embodiments shown in FIG. 10.
  • FIG. 17 is a schematic structural diagram of Embodiment 2 of the server provided by this application.
  • the server may include: a processor 1701, a memory 1702, a transceiver 1703, and an interface 1704 for communicating with other devices.
  • the memory 1702 is used to store computer-executed instructions; the transceiver 1703 is used to communicate with other devices through the interface 1704, and the processor 1701 executes the computer-executed instructions stored in the memory 1702, so that the processor 1701 executes as shown in the previous figure. 7 to the technical solutions of the second server in the embodiments shown in FIG. 10.
  • the present application also provides a communication system.
  • the communication system includes an electronic device, a first server, and a second server.
  • the electronic device may be the information processing apparatus shown in FIG. 12 or the device shown in FIG.
  • the first server may be the information processing device shown in FIG. 13 or the server shown in FIG. 16, and the second server may be the information processing device shown in FIG. 14 or the server shown in FIG. 17.
  • the first server, and the second server reference may be made to the record in the foregoing embodiment, which will not be repeated here.
  • the present application also provides a computer-readable storage medium in which computer-executable instructions are stored.
  • the computer-executable instructions are executed by a processor, they are used to implement the electronic device side in any of the foregoing method embodiments.
  • the present application also provides a computer-readable storage medium in which computer-executable instructions are stored.
  • the computer-executable instructions are executed by a processor, they are used to implement the first server in any of the foregoing method embodiments. Side technical solutions.
  • the present application also provides a computer-readable storage medium in which computer-executable instructions are stored.
  • the computer-executable instructions are executed by a processor, they are used to implement the second server in any of the foregoing method embodiments. Side technical solutions.
  • the embodiment of the present application also provides a program, when the program is executed by the processor, it is used to execute the technical solution on the electronic device side in the foregoing method embodiment.
  • the embodiment of the present application also provides a program, which is used to execute the technical solution on the first server side in the foregoing method embodiment when the program is executed by the processor.
  • the embodiment of the present application also provides a program, which is used to execute the technical solution on the second server side in the foregoing method embodiment when the program is executed by the processor.
  • the embodiments of the present application also provide a computer program product, including program instructions, which are used to implement the technical solutions on the electronic device side in the foregoing method embodiments.
  • the embodiments of the present application also provide a computer program product, including program instructions, which are used to implement the technical solutions on the first server side in the foregoing method embodiments.
  • the embodiments of the present application also provide a computer program product, including program instructions, and the program instructions are used to implement the technical solutions on the second server side in the foregoing method embodiments.
  • the embodiment of the present application also provides a chip, which includes a processing module and a communication interface, and the processing module can execute the technical solution on the electronic device side in the foregoing method embodiment.
  • the chip also includes a storage module (such as a memory), the storage module is used to store instructions, the processing module is used to execute the instructions stored in the storage module, and the execution of the instructions stored in the storage module causes the processing module to execute the electronic device side Technical solutions.
  • a storage module such as a memory
  • the storage module is used to store instructions
  • the processing module is used to execute the instructions stored in the storage module
  • the execution of the instructions stored in the storage module causes the processing module to execute the electronic device side Technical solutions.
  • An embodiment of the present application also provides a chip, which includes a processing module and a communication interface, and the processing module can execute the technical solution on the first server side in the foregoing method embodiment.
  • the chip further includes a storage module (such as a memory), the storage module is used to store instructions, the processing module is used to execute the instructions stored in the storage module, and the execution of the instructions stored in the storage module causes the processing module to execute the first server Side technical solutions.
  • a storage module such as a memory
  • the storage module is used to store instructions
  • the processing module is used to execute the instructions stored in the storage module
  • the execution of the instructions stored in the storage module causes the processing module to execute the first server Side technical solutions.
  • An embodiment of the present application also provides a chip, which includes a processing module and a communication interface, and the processing module can execute the technical solution on the second server side in the foregoing method embodiment.
  • the chip also includes a storage module (such as a memory), the storage module is used to store instructions, the processing module is used to execute the instructions stored in the storage module, and the execution of the instructions stored in the storage module causes the processing module to execute the second server Side technical solutions.
  • a storage module such as a memory
  • the storage module is used to store instructions
  • the processing module is used to execute the instructions stored in the storage module
  • the execution of the instructions stored in the storage module causes the processing module to execute the second server Side technical solutions.
  • the disclosed system, device, and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the processor may be a central processing unit (English: Central Processing Unit, abbreviated as: CPU), or other general-purpose processors, digital signal processors (English: Digital Signal Processor, referred to as DSP), application specific integrated circuit (English: Application Specific Integrated Circuit, referred to as ASIC), etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The steps in the method disclosed in this application can be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
  • All or part of the steps in the foregoing method embodiments may be implemented by a program instructing relevant hardware.
  • the aforementioned program can be stored in a readable memory.
  • the program executes the steps of the above-mentioned method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (English: read-only memory, abbreviated as: ROM), RAM, flash memory, hard disk, Solid state hard disk, magnetic tape (English: magnetic tape), floppy disk (English: floppy disk), optical disc (English: optical disc) and any combination thereof.

Abstract

本申请实施例提供一种信息处理方法、装置、设备及存储介质，在电子设备内部，通过获取安全保护信息，并根据该安全保护信息对电子设备内部传输的信息进行安全保护处理，从而避免了由于电子设备内部传输的消息不合法导致的传输安全隐患问题。

Description

信息处理方法、装置、设备及存储介质 技术领域
本申请实施例涉及通信技术领域，尤其涉及一种信息处理方法、装置、设备及存储介质。
背景技术
随着电子科技以及移动互联网技术的发展，电子设备的功能越来越强大，例如，只要用户按照自身的需求在终端设备上安装各种应用程序(APP)，便可以通过选定的应用程序执行相应的事务或获取各种信息等，故终端设备上安装的各应用程序需要与终端设备的操作系统或通信模块进行通信。
目前，在终端设备内部，应用程序与操作系统或通信模块进行信息交互时，应用程序通常会携带某些参数信息，例如，应用程序的标识，以区分不同的应用需求，相应的，操作系统或通信模块会根据接收到的参数信息执行相应的操作。
然而，在实际应用中，某些应用程序为了达到某些目的，可能会冒充其他应用程序向操作系统或通信模块发送一些信息，从而打乱了原有的处理规则，导致终端设备等电子设备内部的信息交互存在安全隐患问题。
发明内容
本申请实施例提供一种信息处理方法、装置、设备及存储介质，用于解决目前电子设备内部的信息交互存在的安全隐患问题。
第一方面，本申请实施例提供一种信息处理方法，应用于电子设备，包括：
获取安全保护信息；
根据所述安全保护信息对所述电子设备内部传输的信息进行安全保护处理。
第二方面，本申请实施例提供一种信息处理方法，应用于第一服务器，所述方法包括：
确定针对第一单元的第一配置信息，所述第一单元包含于电子设备或者安装在电子设备上，所述第一配置信息用于待传输信息的安全处理；
向所述电子设备发送第一目标信息，所述第一目标信息为所述第一配置信息或者经过所述第一配置信息安全处理后的信息。
第三方面，本申请实施例提供一种信息处理方法，应用于第二服务器，所述方法包括：
确定针对第二单元的第二配置信息，所述第二单元包含于电子设备或者安装在电子设备上，所述第二配置信息用于目标传输信息的安全验证；
向所述电子设备发送所述第二配置信息。
第四方面，本申请实施例提供一种信息处理装置，包括：获取模块和处理模块；
所述获取模块，用于获取安全保护信息；
所述处理模块，用于根据所述安全保护信息对电子设备内部传输的信息进行安全保护处理。
第五方面，本申请实施例提供一种信息处理装置，包括：处理模块和发送模块；
所述处理模块，用于确定针对第一单元的第一配置信息，所述第一单元包含于电子设备或者安装在电子设备上，所述第一配置信息用于待传输信息的安全处理；
所述发送模块，用于向所述电子设备发送第一目标信息，所述第一目标信息为所述第一配置信息或者经过所述第一配置信息安全处理后的信息。
第六方面，本申请实施例提供一种信息处理装置，包括：处理模块和发送模块；
所述处理模块，用于确定针对第二单元的第二配置信息，所述第二单元包含于电子设备或者安装在电子设备上，所述第二配置信息用于目标传输信息的安全验证；
所述发送模块，用于向所述电子设备发送所述第二配置信息。
第七方面，本申请实施例提供一种电子设备，包括：
处理器、存储器、收发器，以及与其他设备进行通信的接口；
所述存储器存储计算机指令；
所述处理器执行所述存储器存储的计算机指令，使得所述处理器执行如第一方面所述的方法。
第八方面，本申请实施例提供一种服务器，包括：
处理器、存储器、收发器，以及与其他设备进行通信的接口；
所述存储器存储计算机指令；
所述处理器执行所述存储器存储的计算机指令，使得所述处理器执行如第二方面所述的方法。
第九方面，本申请实施例提供一种服务器，包括：
处理器、存储器、收发器，以及与其他设备进行通信的接口；
所述存储器存储计算机指令；
所述处理器执行所述存储器存储的计算机指令，使得所述处理器执行如第三方面所述的方法。
第十方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机执行指令，当所述计算机执行指令被处理器执行时用于实现第一方面所述的方法。
第十一方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机执行指令，当所述计算机执行指令被处理器执行时用于实现第二方面所述的方法。
第十二方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机执行指令，当所述计算机执行指令被处理器执行时用于实现第三方面所述的方法。
第十三方面，本申请实施例提供一种程序，当该程序被处理器执行时，用于执行如第一方面所述的方法。
第十四方面，本申请实施例提供一种程序，当该程序被处理器执行时，用于执行如第二方面所述的方法。
第十五方面，本申请实施例提供一种程序，当该程序被处理器执行时，用于执行如第三方面所述的方法。
第十六方面，本申请实施例提供一种计算机程序产品，包括程序指令，程序指令用于实现如第一方面所述的方法。
第十七方面，本申请实施例提供一种计算机程序产品，包括程序指令，程序指令用于实现如第二方面所述的方法。
第十八方面，本申请实施例提供一种计算机程序产品，包括程序指令，程序指令用于实现如第三方面所述的方法。
第十九方面，本申请实施例提供了一种芯片，包括：处理模块与通信接口，该处理模块能执行第一方面所述的方法。
进一步地，该芯片还包括存储模块(如，存储器)，存储模块用于存储指令，处理模块用于执行存储模块存储的指令，并且对存储模块中存储的指令的执行使得处理模块执行第一方面所述的方法。
第二十方面，本申请实施例提供了一种芯片，包括：处理模块与通信接口，该处理模块能执行第二方面所述的方法。
进一步地，该芯片还包括存储模块(如，存储器)，存储模块用于存储指令，处理模块用于执行存储模块存储的指令，并且对存储模块中存储的指令的执行使得处理模块执行第二方面所述的方法。
第二十一方面，本申请实施例提供了一种芯片，包括：处理模块与通信接口，该处理模块能执行第三方面所述的方法。
进一步地，该芯片还包括存储模块(如，存储器)，存储模块用于存储指令，处理模块用于执行存储模块存储的指令，并且对存储模块中存储的指令的执行使得处理模块执行第三方面所述的方法。
本申请第二十二方面提供一种通信系统，包括：电子设备、第一服务器和第二服务器；
所述电子设备为上述第四方面所述的装置，所述第一服务器为上述第五方面所述的装置，所述第二服务器为上述第六方面所述的装置。
本申请实施例提供的信息处理方法、装置、设备及存储介质，在电子设备内部，通过获取安全保护信息，并根据该安全保护信息对电子设备内部传输的信息进行安全保护处理，从而避免了由于电子设备内部传输的消息不合法导致的传输安全隐患问题。
附图说明
图1为本申请实施例提供的一种电子设备的结构示意图；
图2为本申请实施例提供的另一种电子设备的结构示意图；
图3为图2所示的电子设备中数据流的一种流向示意图；
图4为图2所示的电子设备中数据流的另一种流向示意图；
图5为本申请实施例中涉及的一种完整性保护的处理示意图；
图6为本申请实施例中涉及的一种加密保护的处理示意图；
图7为本申请提供的信息处理方法实施例一的流程示意图；
图8为本申请实施例提供的信息处理方法应用的电子设备的结构示意图；
图9为本申请提供的信息处理方法实施例二的流程示意图；
图10为本申请实施例提供的信息处理方法实施例三的交互示意图；
图11A为本申请实施例提供的信息处理方法的一种应用场景示意图；
图11B为本申请实施例提供的信息处理方法的另一种应用场景示意图；
图12为本申请实施例提供的信息处理装置实施例一的结构示意图；
图13为本申请实施例提供的信息处理装置实施例二的结构示意图；
图14为本申请实施例提供的信息处理装置实施例三的结构示意图；
图15为本申请提供的电子设备实施例的结构示意图；
图16为本申请提供的服务器实施例一的结构示意图；
图17为本申请提供的服务器实施例二的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例的说明书、权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述之外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请下述各实施例提供的信息处理方法，可适用于电子设备中。图1为本申请实施例提供的一种电子设备的结构示意图。如图1所示，该电子设备可以包括处理器、外部存储器接口、内部存储器、总线接口等。
可以理解的是，本实施例示意的结构并不构成对电子设备的具体限定。在本申请另一些实施例中，电子设备可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件，或软件和硬件的组合实现。
处理器可以包括一个或多个处理单元，例如：处理器可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
在一些实施例中，外部存储器接口可以用于连接外部存储卡，例如Micro SD卡，实现扩展电子设备的存储能力。外部存储卡通过外部存储器接口与处理器通信，实现数据存储功能。
内部存储器可以用于存储一个或多个计算机程序，该一个或多个计算机程序包括指令。处理器可以通过运行存储在内部存储器的上述指令，从而使得电子设备执行本申请一些实施例中所提供的信息处理方法，以及各种功能应用以及数据处理等。内部存储器可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统；该存储程序区还可以存储一个或多个应用程序等。存储数据区可存储电子设备使用过程中所创建的数据等。
在一些实施例中，处理器可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，移动产业处理器接口(mobile industry processor interface，MIPI)，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module，SIM)接口，和/或通用串行总线(universal serial bus，USB)接口等。其中，USB接口是符合USB标准规范的接口，具体可以是Mini USB接口，Micro USB接口，USB Type C接口等。USB接口可以用于连接充电器为电子设备充电，也可以用于电子设备与外围设备之间传输数据，也可以用于连接耳机，通过耳机播放音频。
可以理解的是，本发明实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对电子设备的结构限定。在本申请另一些实施例中，电子设备也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
在另一些实施例中，该电子设备还可以包括：通信模块和天线等，使得电子设备可以实现通信功能。其中，通信模块可以分为无线通信模块和无线通信模块。天线用于发射和/或接收电磁波信号。电子设备可以包括多个天线，每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。
其中，移动通信模块可以提供应用在电子设备上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块可以包括至少一个滤波器，开关，功率放大器，低噪声放大器等。在一些实施例中，移动通信模块的至少部分功能模块可以被设置于处理器中。在一些实施例中，移动通信模块的至少部分功能模块可以与处理器的至少部分模块被设置在同一个器件中。
无线通信模块可以提供应用在电子设备上的包括无线局域网(wireless local area networks，WLAN)，蓝牙，全球导航卫星系统(global navigation satellite system，GNSS)，调频(frequency modulation，FM)，NFC，红外技术(infrared，IR)等无线通信的解决方案。无线通信模块可以是集成至少一个通信处理模块的一个或多个器件。
在一些实施例中，电子设备包括多个天线，一些天线和移动通信模块耦合，另一些天线和无线通信模块耦合，使得电子设备可以通过无线通信技术与网络以及其他设备通信。其中，无线通信技术可以包括GSM，GPRS，CDMA，WCDMA，TD-SCDMA，LTE，GNSS，WLAN，NFC，FM，和/或IR技术等。上述GNSS可以包括全球卫星定位系统(global positioning system，GPS)，全球导航卫星系统(global navigation satellite system，GLONASS)，北斗卫星导航系统(beidou navigation satellite system，BDS)，准天顶卫星系统(quasi-zenith satellite system，QZSS)和/或星基增强系统(satellite based augmentation systems，SBAS)。
可以理解的是，上述内容仅是对电子设备包括的部分内容进行说明，在实际应用中，电子设备还可以包括其他功能模块，例如，音频模块，传感器，按键，摄像头，显示屏以及用户标识模块(subscriber identification module，SIM)卡接口等。关于这些模块的功能实现，其可以根据实际需求确定，本申请不对其进行赘述。
基于上述图1所示的电子设备的结构示意图，下述通过一个示例简单介绍一下本申请提供的技术方案的产生背景和本申请技术的技术构思。
示例性的，图2为本申请实施例提供的另一种电子设备的结构示意图。如图2所示，该电子设备上可以安装有多个应用和操作系统，且该电子设备包括：协议层模块。其中，应用是以电子设备为宿主，通过电子设备展示某些功能的客户端，其位于电子设备的应用层。操作系统(operating system，OS)是电子设备各功能的软件实现基础，协议层模块可以基于某些设定的协议实现某些处理功能。
可选的，下面以电子设备为移动终端为例，对电子设备、应用、操作系统和协议层模块进行简单介绍。
其中，移动终端是实现移动互联的前提和基础，移动终端是具备较强的计算、存储和处理能力，具有触摸屏、定位、视频摄像头等功能组件但不限于这些功能组件的设备。移动终端拥有智能的操作系统和开放的软件平台。
操作系统是移动互联网软件技术的基础，操作系统与移动互联网软件技术包括的基础中间件、业务中间件、通信中间件共同实现应用支撑。其中，应用可以包括本地应用和Web应用。通常情况下，应用由组件组成，组件之间的交互、通信和导航通过网络实现。
可选的，在本申请的实施例中，操作系统可以是安卓系统(Android)，也可以是IOS，还可以是其他类型的操作系统。对于操作系统的具体实现，本申请实施例不对其进行限定。
其中，Android是一种以Linux为基础的开放源码操作系统，主要用于便携设备，其是基于Linux平台开源手机操作系统名称，该Linux平台由操作系统、中间件、用户界面和应用软件组成。
IOS是一个基于UNIX内核的操作系统，其有一个基于微内核(将系统内核的部分任务交给用户层进程处理)Mach的Darwin内核。微内核提供一组“最基本”的服务和其他服务。“最基本”的服务，如进程调度、进程间通信、存储管理、处理I/O设备。其他服务，如文件管理、网络支持等通过接口连到微内核。
可以理解的是，本申请实施例不对每个操作系统的功能实现进行限定，其可以根据实际确定，此处不再赘述。
示例性的，图3为图2所示的电子设备中数据流的一种流向示意图。在图3中，该电子设备可以为终端设备。如图3所示，下述以终端设备上安装的应用与终端设备包括的协议层模块之间的信息交互进行解释说明。示例性的，图3以电子设备上安装的3个应用(APP-1、APP-2、APP-3)进行解释说明。该协议层模块可以包括策略处理模块、非接入(NAS)层模块、接入(AS)层模块等处理3GPP协议的模块。
在实际应用中，终端设备的协议层模块可以根据从运营商网络接收到的处理策略(例如，用户设备路由选择策略(user equipment routing selection policy，URSP)规则)对特定的数据流执行连接(如协议数据单元(protocol data unit，PDU)会话)的绑定。来源不同的数据流可以通过来源的标识进行区分。示例性的，不同应用的数据流可以使用APP ID进行区分。
在终端设备内部，一种可能的终端内部交互可以参照图3所示。示例性的，当终端设备的APP-3需要发送数据时，首先向OS发送请求消息，该请求消息中可以携带APP ID等参数以指示是哪一个APP的请求。OS将该请求消息发送给协议层模块，协议层模块的策略处理模块根据处理策略和接收到的请求消息中携带的APP ID来判断需要匹配到了哪一个URSP规则，然后策略处理模块向NAS层发送PDU会话绑定或建立请求，利用NAS层模块根据匹配的URSP规则执行相应的连接绑定或建立，最后再传输至接入(AS)层模块等模块进行处理。在本实施例中，不限定NAS层模块和AS层模块的具体实现，其可以根据实际需求执行，此处不作过多赘述。
图3的数据传输方式有助于实现灵活的APP数据绑定，具体的，基于不同的APP(如APP-1、APP-2、APP-3)可以提供不同的APP ID的特点，协议层模块的策略处理模块首先确定接收到的请求消息中携带的APP ID对应的URSP规则，再通过与NAS层模块进行交互，将发起请求的APP的数据流绑定到特定的连接上进行传输。然而，图3的数据传输方式存在安全隐患，例如，应用层的APP可能提供错误的APP ID，这样会致使协议层模块将该APP的数据流绑定到不属于该APP的连接上进行传输。
示例性的，图4为图2所示的电子设备中数据流的另一种流向示意图。如图4所示，协议层模块在处理时，若某个URSP规则-1中的业务描述(traffic descriptor)只有APP-3ID，则该URSP规则对应的PDU会话只用于APP-3的数据传输。当APP-1和/或APP-2也通过OS向协议层模块发送请求消息时，若在请求消息中携带APP-3ID，协议层模块也会将APP-1和/或APP-2的数据流绑定到URSP规则-1对应的PDU会话上进行传输，即使得APP-1和/或APP-2的数据流绑定到原本不属于该自己的连接上进行传输，从而占据其他应用的连接资源，打乱了原有的处理规则，导致终端设备等电子设备内部的信息交互存在安全隐患问题。
因而，对于应用层APP提供的参数/消息，如何对电子设备内部传输的参数或信息进行合法性验证是本申请实施例亟待解决的问题。
针对上述问题，本申请实施例提供了一种信息处理方法，电子设备首先获取安全保护信息，然后根据该安全保护信息对电子设备内部传输的信息进行安全保护处理，从而避免了由于电子设备内部传输的消息不合法导致的传输安全隐患问题。
可选的，在介绍本申请的具体实现方案之前，首先对本申请涉及到的技术进行解释说明：
完整性保护(完保)，即验证发送的消息/参数没有被篡改。
示例性，图5为本申请实施例中涉及的一种完整性保护的处理示意图。参照图5所示，在进行数据传输之前，发送端和接收端会协商好执行完整性保护所需的信息，即完整性保护算法(简称，完保算法)的输入参数，例如，完整性保护秘钥(简称，完保秘钥)，需要完整性保护的第一信息(可以是消息，也可以是参数)，其他输入信息(如计数值、随机数等，本申请实施例对其不做限定)等。
当需要发送数据时，数据的发送端将完保秘钥、第一信息以及其他输入信息作为完保算法的输入，完保算法对其进行处理生成一个完整性消息认证码(message authentication code-integrity，MAC-I)。这样，完保处理后的第一信息与MAC-I一并发送到接收端，接收端也使用同样的方法，将之前协商好的完保秘钥、第一信息、其他输入信息等输入到完保算法中，计算出一个XMAC-I，接收端判断该XMAC-I与发送端携带的MAC-I是否一致，如果一致，则确定完保校验成功。
其中，该MAC-I可以是签名，可以是第一信息特有的字符串，相应的，XMAC-I可以是期望的签名，也可以是第一信息特有的期望字符串；而且，不同的第一信息特有的字符串不同。本申请实施例并不限定MAC-I和XMAC-I的具体实现，其可以根据实际情况确定，此处不再赘述。
加密保护，即避免参数/消息发送过程中被其他攻击者看到内容。
示例性，图6为本申请实施例中涉及的一种加密保护的处理示意图。参照图6所示，在进行数据传输之前，发送端和接收端会协商好执行加密算法所需的信息，即加密算法的输入参数，例如，加密秘钥和多个输入信息(例如，输入1、输入2和其他输入)。其中，输入信息可以是计数值、方向值等参数，本申请实施例不对输入信息的具体表现形式进行限定。
当发送端和接收端需要传输数据时，发送端首先使用加密秘钥和确定的多个输入信息通过加密算法计算出密钥流块，然后使用密钥流块对待传输的明文参数/消息进行处理(如卷积操作)生成加密的参数/消息，并将加密的参数/消息传输至接收端。同理，接收端首先使用与发送端相同的加密算法的输入参数(加密密钥和多个输入)计算出密钥流块，再利用该密钥流块对接收到的加密的参数/消息进行反处理(如反卷积)，最后解密出发送端传输的明文参数/消息。
有上述图5和图6的分析可以看出，使用不同的秘钥执行不同的完保和/或加密，可以对不同的数据(如不同应用的参数)进行安全保护。
可以理解的是，对于数据的安全保护，完保处理和加密处理可以同时使用，也可以只是用一个，本申请实施例并不对其进行限定。
可选的，完保算法和加密算法有多种，例如3GPP NR中使用的完保算法和加密算法主要有如下几种：
完保算法：
NIA0：Null Integrity Protection algorithm，即空完保算法(不完保)；
128-NIA1：128-bit SNOW 3G based algorithm，即128位SNOW 3G完保算法；
128-NIA2：128-bit AES based algorithm，即128位AES完保算法；
128-NIA3：128-bit ZUC based algorithm，即128位祖冲之完保算法。
加密算法：
NEA0：Null ciphering algorithm，即空加密算法(不加密)；
128-NEA1：128-bit SNOW 3G based algorithm，即128位SNOW 3G加密算法；
128-NEA2：128-bit AES based algorithm，即128位AES加密算法；
128-NEA3：128-bit ZUC based algorithm，即128位祖冲之加密算法。
可以理解的是，上述示出的是一些示例，在实际应用中实际使用的算法可以根据实际需求和场景确定，本实施例并不对其进行限定。
结合上述对本申请的应用场景和涉及知识的内容介绍，下述通过具体实施例对本申请的技术方案进行详细说明。需要说明的是，本申请的技术方案可以包括以下内容中的部分或全部，下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。
图7为本申请提供的信息处理方法实施例一的流程示意图。该方法可以应用在电子设备中，在本申请的一种实施例中，电子设备为终端设备。可选的，电子设备的结构示意图可以参照上述图2所示。参照图7所示，在本实施例中，该方法可以包括如下步骤：
S701、获取安全保护信息。
在本申请的实施例中，当电子设备的内部各单元之间有数据传输的需求时，可以首先获取用于对信息进行安全保护处理的安全保护信息。其中，该安全保护信息可以包括一个参数，也可以包括两个或两个以上的参数。本申请实施例并不限定安全保护信息的具体实现和包括的参数个数，其可以根据实际需求确定，此处不再赘述。
可选的，该安全保护信息可以是预先存储在电子设备中的信息，也可以是从其他设备接收的信息。关于安全保护信息的具体来源，本申请实施例并不对其进行限定。
作为一种示例，若该安全保护信息是预先存储在电子设备中的信息时，当电子设备的两个单元之间有信息传输需求时，这两个单元首先基于预设规则，分别获取相应的安全保护信息。
可以理解的是，在本申请的实施例中，不同单元之间进行信息传输所需的安全保护信息可以相同，也可以不同，本申请实施例并不对其进行限定。
作为另一种示例，若安全保护信息是从其他设备接收的信息，那么该S701可以通过如下方式实现：
从接收到的至少一个消息中获取安全保护信息包括的内容。
示例性的，电子设备可以从其他设备中接收该安全保护信息。具体的，其他设备可以通过一个以上的消息将安全保护信息包括的内容发送给该电子设备，相应的，该电子设备可以分别从接收到的消息中解析获取安全保护信息的内容。
也即，其他设备可以将安全保护信息包括的内容承载到一个消息中发送给电子设备，也可以将安全保护信息包括的内容承载到两个或两个以上的消息中发送给电子设备。本申请实施例并不对电子设备从几个消息中获取安全保护信息包括的内容进行限定，其可以根据实际情况确定。
示例性的，在本申请的实施例中，为了对待传输信息进行安全保护处理，则该安全保护信息包括如下信息中至少一种：
安全计算信息、第一单元的标识信息。
其中，第一单元是电子设备中待传输信息的发起者，通过在安全保护信息中携带该第一单元的标识信息可以使得待传输信息的接收者确定发起者，以便做出相应操作。
安全计算信息可以使得待传输信息的发起者对待传输信息进行安全处理，或则使得待传输信息的接收者对待传输信息进行安全验证。
可以理解的是，第一单元的标识信息可以安全处理后的信息，也可以是未安全处理的信息，其可以根据实际情况确定，此处不再赘述。
可选的，在第一单元的标识信息是安全处理后的信息时，发起者接收到的安全信息中可以不携带上述安全计算信息。当待传输信息的接收者已知发起者时，接收者接收到的安全信息中也可以不携带上述第一单元的标识信息。因而，关于安全保护信息实际包括的内容可以根据实际场景确定，此处不再赘述。
示例性的，在本申请的实施例中，上述安全计算信息包括如下信息中的至少一种：
秘钥、算法标识信息、算法内容信息。
可以理解的是，安全计算信息包括的内容主要用于安全保护处理的实现，本申请实施例并不限定安全计算信息具体包括的内容，只要待传输信息的发起者和接收者事先约定好，能够实现安全保护处理的方案即可。
进一步的，在本申请的实施例中，该安全保护信息还可以包括：第一单元的标识信息与安全计算信息的对应关系。这样可以有针对性的对电子设备内部传输的信息进行安全保护处理，提高了处理效率。
可以理解的是，在实际应用中，对于电子设备从第一服务器和/或第二服务器接收到的安全保护信息，其包括的第一单元的标识信息可以理解为第一单元的描述符，可以用于区分电子设备内部不同单元对应的安全计算信息。该第一单元的描述符与电子设备内部传输的第一单元的标识可以是相同的参数，也可以是不同的参数，本申请实施例不对其进行限定。
S702、根据上述安全保护信息对电子设备内部传输的信息进行安全保护处理。
在本申请实施例中，电子设备获取到安全保护信息后，可以分别由发起者和接收者对内部传输的信息进行处理，以使得发起者传输信息的合法性和安全性，也可以使得接收者能够接收到正确、合法的信息，从而保证电子设备内部的处理规则正确，解决了内部传输存在的安全隐患问题。
关于该步骤的具体实现可以参照下述图9所示实施例的记载，此处不再赘述。
本申请实施例提供的信息处理方法，电子设备首先获取安全保护信息，然后根据该安全保护信息对电子设备内部传输的信息进行安全保护处理，从而避免了由于电子设备内部传输的消息不合法导致的传输安全隐患问题。
在上述实施例的基础上，图8为本申请实施例提供的信息处理方法应用的电子设备的结构示意图。参照图8所示，电子设备可以包括：可以相互通信的第一单元和第二单元。可选的，在本申请的实施例中，假设电子设备上安装有操作系统和至少一个应用，且电子设备包括协议层模块。这时，第一单元和第二单元的具体实现可以包括如下几种情况：
作为一种示例，第一单元为至少一个应用中的任意一个应用，第二单元为操作系统或协议层模块。即，第一单元为电子设备上安装的一个应用，第二单元为电子设备上安装的操作系统，或者，第一单元为电子设备上安装的一个应用，第二单元为电子设备包括的协议层模块。
作为另一种示例，第一单元为上述操作系统，第二单元为至少一个应用中的任意一个应用或协议层模块。即，第一单元为电子设备上安装的操作系统，第二单元为电子设备上安装的一个应用，或者，第一单元为电子设备上安装的操作系统，第二单元为电子设备包括的协议层模块。
作为再一种示例，第一单元为上述协议层模块，第二单元为操作系统或至少一个应用中的任意一个应用。即，第一单元为电子设备包括的协议层模块，第二单元为电子设备上安装的一个应用，或者，第一单元为电子设备包括的协议层模块，第二单元为电子设备上安装的操作系统。
关于第一单元和第二单元的具体实现可以根据实际场景或系统的变更而发生变化，本申请实施例并不对其进行限定。
下面图9所示的实施例以图8所示的电子设备中第一单元和第二单元之间的信息传输进行解释说明。图9为本申请提供的信息处理方法实施例二的流程示意图。如图9所示，在本实施例中，上述S702可以通过如下步骤实现：
S901、第一单元将安全处理的目标传输信息传输至第二单元。
在本申请的实施例中，电子设备内部的第一单元向第二单元传输信息时，首先确定目标传输信息。可选的，该目标传输信息是经过安全处理的消息。
在本申请的一种可能设计中，该目标传输信息是待传输信息在第一单元上进行安全处理得到的。
在这种可能设计中，第一单元需要向第二单元传输待传输信息时，首先根据接收到的上述安全保护信息对待传输信息进行安全处理，得到该目标传输信息，然后将该目标传输信息传输至第二单元。
在本申请的另一种可能设计中，目标传输信息是待传输信息在其他设备上进行安全处理得到的。
在这种可能设计中，第一单元需要向第二单元传输是已经被安全处理过的目标传输信息，即其他设备已经基于安全保护信息对待传输信息进行了安全处理，得到了目标传输信息，然后直接传输给第一单元，这样第一单元可以直接将接收到的该目标传输信息传输至第二单元。
关于目标传输信息生成的具体位置，本申请实施例并不对其进行限定。
示例性的，在本申请的实施例中，该安全处理可以包括：对信息进行加密和/和完整性保护。
关于信息加密或完整性保护的具体实现可以参见上述图5或图6中发送端的具体操作，此处不再赘述。
S902、第二单元利用该安全保护信息对接收到的目标传输信息进行安全验证。
在本申请的实施例中，第二单元从第一单元接收到目标传输信息后，可以根据接收到的安全保护信息对该目标传输信息进行安全验证。
示例性的，该安全验证包括：对信息进行解密和/或完整性保护认证。
具体的，第二单元可以根据上述图5或图6中接收端的具体操作，对目标传输信息进行反向处理。例如，目标传输信息是通过完整性保护处理得到的，则第二单元可以对目标传输信息进行完整性保护认证；若目标传输信息是通过加密处理得到的，则第二单元可以对目标传输信息进行加密认证。
本申请实施例提供的信息处理方法，在具体实现时，若电子设备包括第一单元和第二单元，则第一单元可以将安全处理的目标传输信息传输至第二单元，第二单元利用安全保护信息对接收到的目标传输信息进行安全验证，从而保证了第一单元和第二单元之间信息传输的安全性和合法性。
进一步的，在本申请的上述各实施例中，上述安全保护信息可以包括：第一配置信息和/或第二配置信息。其中，第一配置信息是第一单元从第一服务器接收的，第二配置信息是第二单元从第二服务器接收的。
在本实施例中，根据第一单元和第二单元的属性，可以将获取到的安全保护信息分为第一配置信息和/或第二配置信息。在安全保护信息包括第一配置信息和第二配置信息时，其可以分别从对应的服务器接收。示例性的，第一单元从第一服务器接收第一配置信息，第二单元从第二服务器接收第二配置信息。
可选的，该第一服务器可以是用于支撑第一单元的功能实现并提供第一单元所需的服务的设备，该第二服务器可以是用于支撑第二单元的功能实现并提供第二单元所需的服务的设备。
例如，若第一单元为电子设备上安装的一个应用，则第一服务器为应用服务器；或者，若第一单元为电子设备上安装的操作系统，则第一服务器为厂商服务器；或者，若第一单元为所述电子设备包括的协议层模块，则第一服务器为运营商服务器。
同理，若第二单元为电子设备上安装的一个应用，则第二服务器为应用服务器；或者，若第二单元为电子设备上安装的操作系统，则第二服务器为厂商服务器；或者，若第二单元为电子设备包括的协议层模块，第二服务器为运营商服务器。
在本申请的实施例中，关于第一单元和第一服务器、第二单元和第二服务器的具体实现可以根据实际情况确定，此处不再赘述。
示例性的，图10为本申请实施例提供的信息处理方法实施例三的交互示意图。本实施例以电子设备、第一服务器、第二服务器之间的信息交互进行解释说明。如图10所示，该信息处理方法可以包括如下步骤：
S1001、第一服务器和第二服务器分别确定安全保护信息。
在本申请的实施例中，在电子设备的第一单元和第二单元需要进行信息传输时，第一单元对应的第一服务器和第二单元对应的第二服务器可以首先确定对传输的信息进行安全保护处理所需要的安全保护信息。
示例性的，第一单元和第二单元均包含于电子设备或者安装在电子设备上时，上述安全保护信息可以包括针对第一单元的第一配置信息和针对第二单元的第二配置信息。
可选的，在本申请的一种可能设计中，第一服务器和第二服务器可以直接通过信息交互协商，确定上述安全保护信息，即第一服务器确定出针对第一单元的第一配置信息，相应的，第二服务器确定出针对第二单元的第二配置信息。
可选的，在本申请的另一种可能设计中，第一服务器、第二服务器可以均与第三方管理节点连接，第三方管理节点用于管理第一单元和第二单元通信的安全保护信息，这样，第一服务器通过与第三方管理节点通信，可以获取上述安全保护信息，相应的，第二服务器通过与第三方管理节点通信，也可以获取上述安全保护信息。
本申请实施例并不对第一服务器和第二服务器获取安全保护信息的方式进行限定，其可以根据实际需求确定。
在本实施例中，假设第一单元为信息传输的发起方，第二单元为信息传输的接收方时，该第一配置信息可以用于待传输信息的安全处理；第二配置信息可以用于目标传输信息的安全验证。
可选的，根据上述图7所示实施例中S701中关于安全保护信息的记载可知，安全保护信息可以包括安全计算信息、第一单元的标识信息中至少一种，因而，在本实施例中，该第一配置信息和/或第二配置信息也可以包括如下信息中的至少一种：安全计算信息、第一单元的标识信息。相应的，该安全计 算信息包括如下信息中的至少一种：秘钥、算法标识信息、算法内容信息。
在本申请的一种实施例中，第二配置信息还可以包括：第一单元的标识信息与安全计算信息的对应关系。
具体的，在实际应用中，不同的第一单元可以采用不同安全计算信息进行处理，通过在第二配置信息中携带第一单元的标识信息与安全计算信息的对应关系，这样第二单元可以使用对应的安全计算信息对接收到的目标传输信息进行处理。
S1002、第一服务器向电子设备发送第一目标信息，该第一目标信息为第一配置信息或者经过第一配置信息安全处理后的信息。
在本实施例中，第一服务器确定出第一配置信息后，对第一配置信息的处理操作可以包括如下具体实现：
在一种实现方式中，第一服务器直接将该第一配置信息发送给电子设备，具体的，第一服务器直接将该第一配置信息发送给电子设备的第一单元，以使得第一单元利用该第一配置信息对待传输信息进行加密和/和完整性保护等安全处理后，再将其发送给第二单元。
可选的，在该种实现方式中，第一配置信息包括的可以是第一单元的描述符等信息，其主要用于区别电子设备中的不同单元。
在另一种实现方式中，第一服务器首先利用确定的第一配置信息对待传输信息进行进行加密和/和完整性保护等安全处理，得到第一目标信息，然后再将该第一目标信息发送给电子设备的第一单元，以使得第一单元直接将其发送给第二单元，或者执行其他的操作。
本申请实施例并不对第一目标信息的具体内容进行限定，其可以根据实际情况确定。
S1003、第二服务器向电子设备发送第二配置信息。
在本实施例中，第二服务器确定出第二配置信息后，便可以将第二配置信息发送给电子设备，具体的，第二服务器将该第二配置信息发送给电子设备的第二单元，以使得第二单元从第一单元接收到目标传输信息时，能够利用该第二配置信息对目标传输信息进行解密和/和完整性验证等安全验证处理过程。
在本申请的一种可能设计中，第二配置信息可以包含在第二服务器发送给电子设备的其他信息中。也即，当第二服务器需要向电子设备的第二单元传输其他的信息时，第二服务器可以将该第二配置信息包含在其他的信息中传输给第二单元，这样可以降低信息传输的资源消耗，提高资源利用率。
值得说明的是，本申请实施例并不限定S1002和S1003的执行顺序，其可以同时执行，也可以有顺序的执行，S1002和S1003有顺序执行时，S1003的执行可以在前，也可以在后，本实施例不对其进行限定。
S1004、电子设备的第一单元对接收到第一目标信息进行安全处理，得到目标传输信息。
在本实施例中，当第一目标信息是第一配置信息，第一单元可以利用其对电子设备内部传输的信息进行加密处理或完整性保护处理。当第一目标信息是经过第一配置信息安全处理后的信息时，该S1004是可选的，此时，该第一目标信息即是第一单元要传输的目标传输信息。
可选的，在电子设备中，第一单元可以根据第一配置信息对待传输信息进行安全处理，例如，对待传输信息进行加密和/和完整性保护等处理过程。
S1005、第一单元将安全处理的目标传输信息传输至第二单元。
S1006、第二单元利用第二配置信息对接收到的目标传输信息进行安全验证。
可选的，第二配置信息包含在第二单元从第二服务器接收的其他信息中。
在本实施例中，该安全验证包括：对信息进行解密和/或完整性保护认证。
关于S1005和S1006的具体实现可以参见上述图9所示实施例中S901和S902的记载，此处不再赘述。
本申请实施例提供的信息处理方法，第一服务器和第二服务器分别确定出安全保护信息后，第一服务器可以向电子设备发送第一目标信息，该第一目标信息为第一配置信息或者经过第一配置信息安全处理后的信息，第二服务器向电子设备发送第二配置信息，这样，电子设备的第一单元可以对接收到第一目标信息进行安全处理得到目标传输信息，并将其传输至第二单元，第二单元利用第二配置信息对接收到的目标传输信息进行安全验证。该技术方案通过第一服务器、第二服务器以及电子设备的信息交互，能够最大限度的保证电子设备内部单元之间传输信息的合法性和安全性，避免了电子设备内部处理规则被打扰的风险，起到了安全保护作用。
上述各实施例对本申请的技术方案进行了说明，下面通过一个具体的示例对上述方案进行进一步的解释说明。
示例性的，图11A为本申请实施例提供的信息处理方法的一种应用场景示意图。在图11A所示的应用场景中，电子设备为终端设备，第一单元为在电子设备上安装的多个应用中的一个，第二单元为电 子设备包括的协议层模块，例如，UE模块，该UE模块包括：策略处理模块、NAS层和AS层。
图11A所示的应用场景中，电子设备上安装有3个应用，分别为APP-1，APP-2和APP-3，第一单元为APP-3，第一服务器为APP-3的应用服务器，第二单元为协议层模块的策略处理模块，第二服务器为运营商服务器。
在本申请的实施例中，电子设备为终端设备，运营商服务器是核心网网元，如策略控制功能网元(policy control function，PCF)。因而，PCF将确定的安全保护信息等参数发送参数给终端设备的协议层模块时，在一种实施例中，PCF可以首先通过容器(Container)对安全保护信息进行封装，再将封装后的Container发送给接入管理功能网元(access management function，AMF)，最后由AMF通过NAS消息将封装后的Container发送给终端设备的协议层模块；在另一种实施例中，PCF不通过容器(Container)对安全保护信息进行封装，而是由PCF直接传输给AMF，使得AMF使用NAS消息将安全保护信息发送给协议层模块。
在图11A所示的应用场景中，下述以APP-3向协议层模块传输APP-3ID进行解释说明。示例性的，安全保护信息包括的安全计算信息和第一单元的标识可以通过一条消息传输，也可以通过不同的消息传输。
在一种实施例中，APP-3的应用服务器和运营商服务器首先确定安全计算信息，例如，使用的秘钥和/或算法信息；随后，APP-3的应用服务器将秘钥和/或算法信息等安全计算信息发送给终端设备的APP-3，运营商服务器将秘钥和/或算法信息等安全计算信息发送给终端设备的协议层模块(具体为策略处理模块)；然后，APP-3的应用服务器和运营商服务器分别确定对应的APP，即APP的描述符，例如，APP-3的描述符，APP-3应用服务器将确定的APP-3的描述符发送给终端设备的APP-3，运营商服务器将确定的APP-3的描述符发送给终端设备的协议层模块(具体为策略处理模块)。
可选的，在本实施例中，上述秘钥可以是加密密钥和完保秘钥中的一种或两种。值得注意的是，上述算法信息可以是算法标识，也可以是算法的具体内容。本申请实施例可以使用的算法可以包括但不限于3GPP定义的完保算法和加密算法，其还可以是其他的算法，此处不对其进行限定。
可选的，运营商服务器向终端设备的协议层模块(具体为策略处理模块)发送秘钥和/或算法信息时，还可以包含秘钥和/或算法信息等安全计算信息与APP的标识信息之间的对应关系，这是因为不同的APP可以对应不同的秘钥和/或算法信息(例如，APP-1、APP-2、APP-3分别对应不同的秘钥和/或算法信息)。
示例性的，表1为待传输信息的安全处理在终端的APP层进行的一种示例。参照表1所示，安全保护信息主要包括APP的标识信息(利用APP的descriptor指示终端中APP)、每个APP对应的秘钥(完保秘钥和/或加密秘钥)、每个APP对应的算法(完保算法和/或加密算法)；可选的，APP传递给OS或协议层模块的内容为待传输信息，例如，对应APP ID。
表1安全处理在终端APP层进行
Figure PCTCN2020083242-appb-000001
值得注意的是，在本申请的实施例中，APP descriptor和APP ID可以是同一个参数，也可以是不同参数，其可以根据实际情况确定。此外，上述表1中的参数可以分别通过应用层由应用服务器发给终端设备的对应APP，以及通过3GPP信令(如NAS信令)由运营商服务器发送给协议层模块的策略处理模块。示例性的，运营商服务器可以通过处理策略规则将APP的标识信息发送给协议层模块(具体为策略处理模块)，这时不需要单独向协议层模块(具体为策略处理模块)发送该APP的标识信息，例如，APP-3descriptor。
可以理解的是，本申请实施例以APP-3为例进行说明，实际上，还可以为其他的APP，此处不再赘述。
值得说明的是，在本实施例中，APP的应用服务器可以分别发送上述安全计算信息(秘钥和/或算法信息)、APP的标识信息，也可以通过同一个消息发送，运营商服务器分别发送上述安全计算信息(秘钥和/或算法信息)、APP的标识信息，也可以通过同一个消息发送。
在一种可选的实施例中，由于APP的标识信息的更新频率和安全计算信息的更新频率可以不同，所以，安全计算信息、APP的标识信息可以分开发送。在另一种可选的实施例中，安全计算信息、APP的标识信息也可以通过同一个消息发送。
示例性的，APP的标识信息可以是一个字符串(string)或者一个域名，只要能够区分出特定的APP即可，本申请实施例并不对APP的标识信息的具体格式进行限定。
进一步的，在本申请的另一种可能设计中，图11B为本申请实施例提供的信息处理方法的另一种应用场景示意图。图11B与图11A的示意图包括设备的结构相同，区别在于：在图11A中，待传输信息的安全处理在终端设备的APP侧执行，而在图11B中，待传输信息的安全处理在APP应用服务器侧执行后传输给对应的APP。
参照图11B所示，APP的应用服务器可以首先对待传输信息(例如，APP-3的应用服务器对应APP-3ID)进行处理，例如，首先在APP的应用服务器上使用秘钥和/或算法信息等安全计算信息对APP ID进行处理，得到处理后的APP ID，再将其和APP的描述符一同发送给终端设备的对应APP，相应的，运营商服务器可以还是照常发送明文的APP ID、APP的描述符、秘钥和/或算法信息。这样做的好处的终端设备的APP不会获得秘钥和/或算法信息，避免了明文APP ID被泄露的安全风险。
示例性的，表2为待传输信息的安全处理在APP的应用服务器进行的一种示例。参照表2所示，安全保护信息主要包括APP的标识信息(利用APP的descriptor指示终端中的APP)、每个APP对应的秘钥(完保秘钥和/或加密秘钥)、每个APP对应的算法(完保算法和/或加密算法)；可选的，APP传递给OS或协议层模块的内容为安全处理后的待传输信息，例如，安全处理后的APP ID。
表2安全处理在APP的应用服务器完成后发给终端设备的APP
Figure PCTCN2020083242-appb-000002
值得注意的是，参照上述对表1中的参数介绍，在表2中，APP descriptor和APP ID可以是同一个参数，也可以是不同参数，其可以根据实际情况确定。此外，在本实施例中，表2中第一列的参数(APP的标识信息)和第四列的参数(APP传递给OS层或协议层模块的内容)可以通过应用层由应用服务器发给终端设备的APP，而表2中所有的参数(APP的标识信息、对应的秘钥、对应的算法和APP传递给OS层或协议层模块的内容)均可以通过3GPP信令(如NAS信令)由运营商服务器发送给协议层模块的策略处理模块。
参照图11A和图11B所示，在实际应用中，终端设备的APP-3需要发送数据时，首先向OS层发送请求消息，该请求消息可以携带安全处理后的APP ID，这样，OS层向协议层模块的策略处理模块发送该请求消息并包含该处理后的APP ID。策略处理模块根据之前配置的或从运营商服务器接收到的APP ID对应的秘钥对该处理后的APP ID进行解密和/或完保验证，解密和/或完保验证后，使用明文的APP ID以及策略处理规则进行评估，以确定该APP对应的策略规则(如URSP Rule)，并根据URSP rule的内容触发连接的绑定或新连接的建立。
综上所述，本申请的技术方案可以保证终端设备中的3GPP层模块接收到正确的APP发送的信息，其他APP由于没有接收到秘钥和算法，无法仿冒发送相同的APP ID，其对于运营商服务器和不同的过顶(over-the-top，OTT)设备之间协商不同的APP ID的场景起到安全保护作用。
可以理解的是，本申请的技术方案不限于5G系统，任何其他系统均适用，本申请的技术方案也不限于APP ID的验证，对于任何终端设备的APP层发送给OS或协议层模块的信息/参数，都可以通过同样的机制进行安全保护，其他的信息/参数可以包括网络切片参数、数据网络(data network，DN)参数、接入APN等。本申请实施例并不对需要处理的参数进行限定，其可以根据实际情况确定，此处不再赘述。
可选的，本申请的技术方案并不限定APP到OS层或协议层模块的方向，对于相反方向，例如，协议层模块中的AS/NAS向APP发送信息(例如，服务质量(quality of service，QoS)包括的任意一个参数以及UE位置信息、小区标识、跟踪区域调整信息)，也可以用相同的机制进行完全保护，此处不再赘述。
上述介绍了本申请实施例提到的信息处理方法的具体实现，下述为本申请装置实施例，可以用于执行本申请方法实施例。对于本申请装置实施例中未披露的细节，请参照本申请方法实施例。
图12为本申请实施例提供的信息处理装置实施例一的结构示意图。该装置可以集成在电子设备中，也可以通过电子设备实现。如图12所示，该装置可以包括：获取模块1201和处理模块1202。
其中，该获取模块1201，用于获取安全保护信息；
该处理模块1202，用于根据所述安全保护信息对电子设备内部传输的信息进行安全保护处理。
在本申请的一种可能设计中，所述电子设备包括：第一单元和第二单元；
该处理模块1202，具体用于通过所述第一单元将安全处理的目标传输信息传输至所述第二单元，通过所述第二单元利用所述安全保护信息对接收到的目标传输信息进行安全验证。
可选的，所述目标传输信息是待传输信息在所述第一单元上进行安全处理得到的，或所述目标传输信息是待传输信息在其他设备上进行安全处理得到的。
示例性的，所述安全处理包括：对信息进行加密和/和完整性保护；
所述安全验证包括：对信息进行解密和/或完整性保护认证。
在本申请的另一种可能设计中，所述安全保护信息包括：第一配置信息和/或第二配置信息；
所述第一配置信息是所述第一单元从第一服务器接收的，所述第二配置信息是所述第二单元从第二服务器接收的。
可选的，所述第二配置信息包含在所述第二单元从所述第二服务器接收的其他信息中。
在本申请的再一种可能设计中，所述电子设备上安装有操作系统和至少一个应用，所述电子设备包括协议层模块；
所述第一单元为所述至少一个应用中的任意一个应用，所述第二单元为所述操作系统或所述协议层模块；或者
所述第一单元为所述操作系统，所述第二单元为所述至少一个应用中的任意一个应用或所述协议层模块；或者
所述第一单元为所述协议层模块，所述第二单元为所述操作系统或所述至少一个应用中的任意一个应用。
可选的，所述第一单元为所述至少一个应用中的任意一个应用，所述第二单元为所述协议层模块。
可选的，所述安全保护信息包括如下信息中至少一种：
安全计算信息、第一单元的标识信息。
进一步的，所述安全保护信息还包括：所述第一单元的标识信息与所述安全计算信息的对应关系。
示例性的，所述安全计算信息包括如下信息中的至少一种：
秘钥、算法标识信息、算法内容信息。
在本申请的又一种可能设计中，该获取模块1201，具体用于从接收到的至少一个消息中获取所述安全保护信息包括的内容。
在本申请的上述各可能设计中，所述电子设备为终端设备。
本实施例提供的装置，用于执行前述图7至图10所示实施例中电子设备的技术方案，其实现原理和技术效果类似，此处不再赘述。
图13为本申请实施例提供的信息处理装置实施例二的结构示意图。该装置可以集成在服务器中，也可以通过服务器实现。如图13所示，该装置可以包括：处理模块1301和发送模块1302。
其中，该处理模块1301，用于确定针对第一单元的第一配置信息，所述第一单元包含于电子设备或者安装在电子设备上，所述第一配置信息用于待传输信息的安全处理；
该发送模块1302，用于向所述电子设备发送第一目标信息，所述第一目标信息为所述第一配置信息或者经过所述第一配置信息安全处理后的信息。
在本申请的一种可能设计中，所述安全处理包括：对信息进行加密和/和完整性保护。
可选的，所述第一单元为所述电子设备上安装的一个应用，所述装置为应用服务器；或者
所述第一单元为所述电子设备上安装的操作系统，所述装置为厂商服务器；或者
所述第一单元为所述电子设备包括的协议层模块，所述装置为运营商服务器。
在本申请的另一种可能设计中，所述第一配置信息包括如下信息中的至少一种：
安全计算信息、所述第一单元的标识信息。
可选的，所述安全计算信息包括如下信息中的至少一种：
秘钥、算法标识信息、算法内容信息。
本实施例提供的装置，用于执行前述图7至图10所示实施例中第一服务器的技术方案，其实现原理和技术效果类似，此处不再赘述。
图14为本申请实施例提供的信息处理装置实施例三的结构示意图。该装置可以集成在服务器中，也可以通过服务器实现。如图14所示，该装置可以包括：处理模块1401和发送模块1402。
其中，该处理模块1401，用于确定针对第二单元的第二配置信息，所述第二单元包含于电子设备或者安装在电子设备上，所述第二配置信息用于目标传输信息的安全验证；
该发送模块1402，用于向所述电子设备发送所述第二配置信息。
在本申请的一种可能设计中，所述安全验证包括：对信息进行解密和/或完整性保护认证。
可选的，所述第二单元为所述电子设备上安装的一个应用，所述装置为应用服务器；或者
所述第二单元为所述电子设备上安装的操作系统，所述装置为厂商服务器；或者
所述第二单元为所述电子设备包括的协议层模块，所述装置为运营商服务器。
在本申请的另一种可能设计中，所述第二配置信息包括如下信息中的至少一种：
安全计算信息、第一单元的标识信息；
所述第一单元为所述电子设备包括或安装的能够与所述第二单元进行信息传输的一个单元。
可选的，所述第二配置信息还包括：所述第一单元的标识信息与所述安全计算信息的对应关系。
可选的，所述安全计算信息包括如下信息中的至少一种：
秘钥、算法标识信息、算法内容信息。
在本申请的再一种可能设计中，所述第二配置信息包含在所述装置发送给所述电子设备的其他信息中。
本实施例提供的装置，用于执行前述图7至图10所示实施例中第二服务器的技术方案，其实现原理和技术效果类似，此处不再赘述。
需要说明的是，应理解以上装置的各个单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且这些单元可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分单元通过处理元件调用软件的形式实现，部分单元通过硬件的形式实现。例如，第一处理单元和/或第二处理单元可以为单独设立的处理元件，也可以集成在上述装置的某一个芯片中实现，此外，也可以以程序代码的形式存储于上述装置的存储器中，由上述装置的某一个处理元件调用并执行以上第一处理单元和/或第二处理单元的功能。其它单元的实现与之类似。此外这些单元全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件可以是一种集成电路，具有信号的处理能力。在实现过程中，上述方法的各步骤或以上各个单元可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
例如，以上这些单元可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(application specific integrated circuit，ASIC)，或，一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)等。再如，当以上某个单元通过处理元件调度程序代码的形式实现时，该处理元件可以是通用处理器，例如中央处理器(central processing unit，CPU)或其它可以调用程序代码的处理器。再如，这些单元可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘solid state disk(SSD))等。
图15为本申请提供的电子设备实施例的结构示意图。如图15所示，该电子设备可以包括：处理器1501、存储器1502、收发器1503，以及与其他设备进行通信的接口1504。
其中，存储器1502用于存储计算机执行指令；该收发器1503用于通过接口1504和其他设备进行通信，处理器1501执行所述存储器1502存储的计算机执行指令，使得所述处理器1501执行如前述图7至图10所示实施例中的电子设备的技术方案。
图16为本申请提供的服务器实施例一的结构示意图。如图16所示，该服务器可以包括：处理器1601、存储器1602、收发器1603，以及与其他设备进行通信的接口1604。
其中，存储器1602用于存储计算机执行指令；该收发器1603用于通过接口1604和其他设备进行通信，处理器1601执行所述存储器1602存储的计算机执行指令，使得所述处理器1601执行如前述图7至图10所示实施例中的第一服务器的技术方案。
图17为本申请提供的服务器实施例二的结构示意图。如图17所示，该服务器可以包括：处理器1701、存储器1702、收发器1703，以及与其他设备进行通信的接口1704。
其中，存储器1702用于存储计算机执行指令；该收发器1703用于通过接口1704和其他设备进行通信，处理器1701执行所述存储器1702存储的计算机执行指令，使得所述处理器1701执行如前述图7至图10所示实施例中的第二服务器的技术方案。
进一步的，本申请还提供一种通信系统，所述通信系统包括：电子设备、第一服务器和第二服务器，该电子设备可以是上述图12所示的信息处理装置或者图15所示的设备，该第一服务器可以是上述图13所示的信息处理装置或者图16所示的服务器，该第二服务器可以是上述图14所示的信息处理装置或者图17所示的服务器。关于该电子设备、第一服务器和第二服务器的具体实现可以参见上述实施例的记载，此处不再赘述。
本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机执行指令，当所述计算机执行指令被处理器执行时用于实现前述任一方法实施例中电子设备侧的技术方案。
本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机执行指令，当所述计算机执行指令被处理器执行时用于实现前述任一方法实施例中第一服务器侧的技术方案。
本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机执行指令，当所述计算机执行指令被处理器执行时用于实现前述任一方法实施例中第二服务器侧的技术方案。
本申请实施例还提供一种程序，当该程序被处理器执行时，用于执行前述方法实施例中电子设备侧的技术方案。
本申请实施例还提供一种程序，当该程序被处理器执行时，用于执行前述方法实施例中第一服务器侧的技术方案。
本申请实施例还提供一种程序，当该程序被处理器执行时，用于执行前述方法实施例中第二服务器侧的技术方案。
本申请实施例还提供一种计算机程序产品，包括程序指令，程序指令用于实现前述方法实施例中电子设备侧的技术方案。
本申请实施例还提供一种计算机程序产品，包括程序指令，程序指令用于实现前述方法实施例中第一服务器侧的技术方案。
本申请实施例还提供一种计算机程序产品，包括程序指令，程序指令用于实现前述方法实施例中第二服务器侧的技术方案。
本申请实施例还提供了一种芯片，包括：处理模块与通信接口，该处理模块能执行前述方法实施例中电子设备侧的技术方案。
进一步地，该芯片还包括存储模块(如，存储器)，存储模块用于存储指令，处理模块用于执行存储模块存储的指令，并且对存储模块中存储的指令的执行使得处理模块执行电子设备侧的技术方案。
本申请实施例还提供了一种芯片，包括：处理模块与通信接口，该处理模块能执行前述方法实施例中第一服务器侧的技术方案。
进一步地，该芯片还包括存储模块(如，存储器)，存储模块用于存储指令，处理模块用于执行存储模块存储的指令，并且对存储模块中存储的指令的执行使得处理模块执行第一服务器侧的技术方案。
本申请实施例还提供了一种芯片，包括：处理模块与通信接口，该处理模块能执行前述方法实施例中第二服务器侧的技术方案。
进一步地，该芯片还包括存储模块(如，存储器)，存储模块用于存储指令，处理模块用于执行存储模块存储的指令，并且对存储模块中存储的指令的执行使得处理模块执行第二服务器侧的技术方案。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
在上述用户设备和网络设备的具体实现中，应理解，处理器可以是中央处理单元(英文：Central Processing Unit，简称：CPU)，还可以是其他通用处理器、数字信号处理器(英文：Digital Signal Processor，简称：DSP)、专用集成电路(英文：Application Specific Integrated Circuit，简称：ASIC)等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一可读取存储器中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储器(存储介质)包括：只读存储器(英文：read-only memory，简称：ROM)、RAM、快闪存储器、硬盘、固态硬盘、磁带(英文：magnetic tape)、软盘(英文：floppy disk)、光盘(英文：optical disc)及其任意组合。

Claims (56)

  1. 一种信息处理方法，其特征在于，应用于电子设备，所述方法包括：
    获取安全保护信息；
    根据所述安全保护信息对所述电子设备内部传输的信息进行安全保护处理。
  2. 根据权利要求1所述的方法，其特征在于，所述电子设备包括：第一单元和第二单元；
    所述根据所述安全保护信息对所述电子设备内部传输的信息进行安全保护处理，包括：
    所述第一单元将安全处理的目标传输信息传输至所述第二单元；
    所述第二单元利用所述安全保护信息对接收到的目标传输信息进行安全验证。
  3. 根据权利要求2所述的方法，其特征在于，所述目标传输信息是待传输信息在所述第一单元上进行安全处理得到的，或所述目标传输信息是待传输信息在其他设备上进行安全处理得到的。
  4. 根据权利要求2或3所述的方法，其特征在于，所述安全处理包括：对信息进行加密和/和完整性保护；
    所述安全验证包括：对信息进行解密和/或完整性保护认证。
  5. 根据权利要求2-4任一项所述的方法，其特征在于，所述安全保护信息包括：第一配置信息和/或第二配置信息；
    所述第一配置信息是所述第一单元从第一服务器接收的，所述第二配置信息是所述第二单元从第二服务器接收的。
  6. 根据权利要求5所述的方法，其特征在于，所述第二配置信息包含在所述第二单元从所述第二服务器接收的其他信息中。
  7. 根据权利要求2-6任一项所述的方法，其特征在于，所述电子设备上安装有操作系统和至少一个应用，所述电子设备包括协议层模块；
    所述第一单元为所述至少一个应用中的任意一个应用，所述第二单元为所述操作系统或所述协议层模块；或者
    所述第一单元为所述操作系统，所述第二单元为所述至少一个应用中的任意一个应用或所述协议层模块；或者
    所述第一单元为所述协议层模块，所述第二单元为所述操作系统或所述至少一个应用中的任意一个应用。
  8. 根据权利要求7所述的方法，其特征在于，所述第一单元为所述至少一个应用中的任意一个应用，所述第二单元为所述协议层模块。
  9. 根据权利要求8所述的方法，其特征在于，所述安全保护信息包括如下信息中至少一种：
    安全计算信息、第一单元的标识信息。
  10. 根据权利要求9所述的方法，其特征在于，所述安全保护信息还包括：所述第一单元的标识信息与所述安全计算信息的对应关系。
  11. 根据权利要求9或10所述的方法，其特征在于，所述安全计算信息包括如下信息中的至少一种：
    秘钥、算法标识信息、算法内容信息。
  12. 根据权利要求9-11任一项所述的方法，其特征在于，所述获取安全保护信息，包括：
    从接收到的至少一个消息中获取所述安全保护信息包括的内容。
  13. 根据权利要求1-12任一项所述的方法，其特征在于，所述电子设备为终端设备。
  14. 一种信息处理方法，其特征在于，应用于第一服务器，所述方法包括：
    确定针对第一单元的第一配置信息，所述第一单元包含于电子设备或者安装在电子设备上，所述第一配置信息用于待传输信息的安全处理；
    向所述电子设备发送第一目标信息，所述第一目标信息为所述第一配置信息或者经过所述第一配置信息安全处理后的信息。
  15. 根据权利要求14所述的方法，其特征在于，所述安全处理包括：对信息进行加密和/和完整性保护。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第一单元为所述电子设备上安装的一个应用，所述第一服务器为应用服务器；或者
    所述第一单元为所述电子设备上安装的操作系统，所述第一服务器为厂商服务器；或者
    所述第一单元为所述电子设备包括的协议层模块，所述第一服务器为运营商服务器。
  17. 根据权利要求14-16任一项所述的方法，其特征在于，所述第一配置信息包括如下信息中的至 少一种：
    安全计算信息、所述第一单元的标识信息。
  18. 根据权利要求17所述的方法，其特征在于，所述安全计算信息包括如下信息中的至少一种：
    秘钥、算法标识信息、算法内容信息。
  19. 一种信息处理方法，其特征在于，应用于第二服务器，所述方法包括：
    确定针对第二单元的第二配置信息，所述第二单元包含于电子设备或者安装在电子设备上，所述第二配置信息用于目标传输信息的安全验证；
    向所述电子设备发送所述第二配置信息。
  20. 根据权利要求19所述的方法，其特征在于，所述安全验证包括：对信息进行解密和/或完整性保护认证。
  21. 根据权利要求19或20所述的方法，其特征在于，所述第二单元为所述电子设备上安装的一个应用，所述第二服务器为应用服务器；或者
    所述第二单元为所述电子设备上安装的操作系统，所述第二服务器为厂商服务器；或者
    所述第二单元为所述电子设备包括的协议层模块，所述第二服务器为运营商服务器。
  22. 根据权利要求19-21任一项所述的方法，其特征在于，所述第二配置信息包括如下信息中的至少一种：
    安全计算信息、第一单元的标识信息；
    所述第一单元为所述电子设备包括或安装的能够与所述第二单元进行信息传输的一个单元。
  23. 根据权利要求22所述的方法，其特征在于，所述第二配置信息还包括：所述第一单元的标识信息与所述安全计算信息的对应关系。
  24. 根据权利要求22或23所述的方法，其特征在于，所述安全计算信息包括如下信息中的至少一种：
    秘钥、算法标识信息、算法内容信息。
  25. 根据权利要求19-24任一项所述的方法，其特征在于，所述第二配置信息包含在所述第二服务器发送给所述电子设备的其他信息中。
  26. 一种信息处理方法装置，其特征在于，包括：获取模块和处理模块；
    所述获取模块，用于获取安全保护信息；
    所述处理模块，用于根据所述安全保护信息对电子设备内部传输的信息进行安全保护处理。
  27. 根据权利要求26所述的装置，其特征在于，所述电子设备包括：第一单元和第二单元；
    所述处理模块，具体用于通过所述第一单元将安全处理的目标传输信息传输至所述第二单元，通过所述第二单元利用所述安全保护信息对接收到的目标传输信息进行安全验证。
  28. 根据权利要求27所述的装置，其特征在于，所述目标传输信息是待传输信息在所述第一单元上进行安全处理得到的，或所述目标传输信息是待传输信息在其他设备上进行安全处理得到的。
  29. 根据权利要求27或28所述的装置，其特征在于，所述安全处理包括：对信息进行加密和/和完整性保护；
    所述安全验证包括：对信息进行解密和/或完整性保护认证。
  30. 根据权利要求27-29任一项所述的装置，其特征在于，所述安全保护信息包括：第一配置信息和/或第二配置信息；
    所述第一配置信息是所述第一单元从第一服务器接收的，所述第二配置信息是所述第二单元从第二服务器接收的。
  31. 根据权利要求30所述的装置，其特征在于，所述第二配置信息包含在所述第二单元从所述第二服务器接收的其他信息中。
  32. 根据权利要求27-31任一项所述的装置，其特征在于，所述电子设备上安装有操作系统和至少一个应用，所述电子设备包括协议层模块；
    所述第一单元为所述至少一个应用中的任意一个应用，所述第二单元为所述操作系统或所述协议层模块；或者
    所述第一单元为所述操作系统，所述第二单元为所述至少一个应用中的任意一个应用或所述协议层模块；或者
    所述第一单元为所述协议层模块，所述第二单元为所述操作系统或所述至少一个应用中的任意一个应用。
  33. 根据权利要求32所述的装置，其特征在于，所述第一单元为所述至少一个应用中的任意一个应用，所述第二单元为所述协议层模块。
  34. 根据权利要求33所述的装置，其特征在于，所述安全保护信息包括如下信息中至少一种：
    安全计算信息、第一单元的标识信息。
  35. 根据权利要求34所述的装置，其特征在于，所述安全保护信息还包括：所述第一单元的标识信息与所述安全计算信息的对应关系。
  36. 根据权利要求34或35所述的装置，其特征在于，所述安全计算信息包括如下信息中的至少一种：
    秘钥、算法标识信息、算法内容信息。
  37. 根据权利要求34-36任一项所述的装置，其特征在于，所述获取模块，具体用于从接收到的至少一个消息中获取所述安全保护信息包括的内容。
  38. 根据权利要求26-37任一项所述的装置，其特征在于，所述电子设备为终端设备。
  39. 一种信息处理装置装置，其特征在于，包括：处理模块和发送模块；
    所述处理模块，用于确定针对第一单元的第一配置信息，所述第一单元包含于电子设备或者安装在电子设备上，所述第一配置信息用于待传输信息的安全处理；
    所述发送模块，用于向所述电子设备发送第一目标信息，所述第一目标信息为所述第一配置信息或者经过所述第一配置信息安全处理后的信息。
  40. 根据权利要求39所述的装置，其特征在于，所述安全处理包括：对信息进行加密和/和完整性保护。
  41. 根据权利要求39或40所述的装置，其特征在于，所述第一单元为所述电子设备上安装的一个应用，所述装置为应用服务器；或者
    所述第一单元为所述电子设备上安装的操作系统，所述装置为厂商服务器；或者
    所述第一单元为所述电子设备包括的协议层模块，所述装置为运营商服务器。
  42. 根据权利要求39-41任一项所述的装置，其特征在于，所述第一配置信息包括如下信息中的至少一种：
    安全计算信息、所述第一单元的标识信息。
  43. 根据权利要求42所述的装置，其特征在于，所述安全计算信息包括如下信息中的至少一种：
    秘钥、算法标识信息、算法内容信息。
  44. 一种信息处理装置，其特征在于，包括：处理模块和发送模块；
    所述处理模块，用于确定针对第二单元的第二配置信息，所述第二单元包含于电子设备或者安装在电子设备上，所述第二配置信息用于目标传输信息的安全验证；
    所述发送模块，用于向所述电子设备发送所述第二配置信息。
  45. 根据权利要求44所述的装置，其特征在于，所述安全验证包括：对信息进行解密和/或完整性保护认证。
  46. 根据权利要求44或45所述的装置，其特征在于，所述第二单元为所述电子设备上安装的一个应用，所述装置为应用服务器；或者
    所述第二单元为所述电子设备上安装的操作系统，所述装置为厂商服务器；或者
    所述第二单元为所述电子设备包括的协议层模块，所述装置为运营商服务器。
  47. 根据权利要求44-46任一项所述的装置，其特征在于，所述第二配置信息包括如下信息中的至少一种：
    安全计算信息、第一单元的标识信息；
    所述第一单元为所述电子设备包括或安装的能够与所述第二单元进行信息传输的一个单元。
  48. 根据权利要求47所述的装置，其特征在于，所述第二配置信息还包括：所述第一单元的标识信息与所述安全计算信息的对应关系。
  49. 根据权利要求47或48所述的装置，其特征在于，所述安全计算信息包括如下信息中的至少一种：
    秘钥、算法标识信息、算法内容信息。
  50. 根据权利要求44-49任一项所述的装置，其特征在于，所述第二配置信息包含在所述装置发送给所述电子设备的其他信息中。
  51. 一种电子设备，其特征在于，包括：
    处理器、存储器、收发器，以及与其他设备进行通信的接口；
    所述存储器存储计算机指令；
    所述处理器执行所述存储器存储的计算机指令，使得所述处理器执行如权利要求1-13任一项所述的方法。
  52. 一种服务器，其特征在于，包括：
    处理器、存储器、收发器，以及与其他设备进行通信的接口；
    所述存储器存储计算机指令；
    所述处理器执行所述存储器存储的计算机指令，使得所述处理器执行如权利要求14-18任一项所述的方法。
  53. 一种服务器，其特征在于，包括：
    处理器、存储器、收发器，以及与其他设备进行通信的接口；
    所述存储器存储计算机指令；
    所述处理器执行所述存储器存储的计算机指令，使得所述处理器执行如权利要求19-25任一项所述的方法。
  54. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令被处理器执行时用于实现如权利要求1-13任一项所述的方法。
  55. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令被处理器执行时用于实现如权利要求14-18任一项所述的方法。
  56. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令被处理器执行时用于实现如权利要求19-25任一项所述的方法。
PCT/CN2020/083242 2020-04-03 2020-04-03 信息处理方法、装置、设备及存储介质 WO2021196167A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2020/083242 WO2021196167A1 (zh) 2020-04-03 2020-04-03 信息处理方法、装置、设备及存储介质
CN202080093621.2A CN115004634B (zh) 2020-04-03 2020-04-03 信息处理方法、装置、设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/083242 WO2021196167A1 (zh) 2020-04-03 2020-04-03 信息处理方法、装置、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2021196167A1 true WO2021196167A1 (zh) 2021-10-07

Family

ID=77927353

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/083242 WO2021196167A1 (zh) 2020-04-03 2020-04-03 信息处理方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN115004634B (zh)
WO (1) WO2021196167A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114500095A (zh) * 2022-02-25 2022-05-13 上海富数科技有限公司 数据处理方法、装置、电子设备及存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101242630A (zh) * 2007-02-05 2008-08-13 华为技术有限公司 安全算法协商的方法、装置及网络系统
CN101854625A (zh) * 2009-04-03 2010-10-06 华为技术有限公司 安全算法选择处理方法与装置、网络实体及通信系统
CN107294723A (zh) * 2016-03-31 2017-10-24 中兴通讯股份有限公司 消息完整性认证信息的生成和验证方法、装置及验证系统
CN108347410A (zh) * 2017-01-24 2018-07-31 华为技术有限公司 安全实现方法、设备以及系统
CN109362108A (zh) * 2017-09-30 2019-02-19 华为技术有限公司 一种安全保护的方法、装置和系统
CN110035042A (zh) * 2018-01-12 2019-07-19 华为技术有限公司 一种数据传输方法及装置
US20190372995A1 (en) * 2017-08-11 2019-12-05 Huawei Technologies Co., Ltd. Data integrity protection method and apparatus

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050289311A1 (en) * 2004-06-29 2005-12-29 David Durham System and method for secure inter-platform and intra-platform communications
CN101175074A (zh) * 2006-11-01 2008-05-07 华为技术有限公司 一种实现端到端媒体流密钥协商的方法和系统
CN108156143A (zh) * 2017-12-14 2018-06-12 上海格尔安全科技有限公司 基于可信执行环境的Android应用程序之间的安全通信方法

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101242630A (zh) * 2007-02-05 2008-08-13 华为技术有限公司 安全算法协商的方法、装置及网络系统
CN101854625A (zh) * 2009-04-03 2010-10-06 华为技术有限公司 安全算法选择处理方法与装置、网络实体及通信系统
CN107294723A (zh) * 2016-03-31 2017-10-24 中兴通讯股份有限公司 消息完整性认证信息的生成和验证方法、装置及验证系统
CN108347410A (zh) * 2017-01-24 2018-07-31 华为技术有限公司 安全实现方法、设备以及系统
US20190372995A1 (en) * 2017-08-11 2019-12-05 Huawei Technologies Co., Ltd. Data integrity protection method and apparatus
CN109362108A (zh) * 2017-09-30 2019-02-19 华为技术有限公司 一种安全保护的方法、装置和系统
CN110035042A (zh) * 2018-01-12 2019-07-19 华为技术有限公司 一种数据传输方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114500095A (zh) * 2022-02-25 2022-05-13 上海富数科技有限公司 数据处理方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN115004634A (zh) 2022-09-02
CN115004634B (zh) 2023-12-19

Similar Documents

Publication Publication Date Title
US10372656B2 (en) System, apparatus and method for providing trusted input/output communications
WO2016082801A1 (zh) 一种用于建立无线连接的方法及设备
WO2017082966A1 (en) Integrated universal integrated circuit card on mobile computing environments
US20220321455A1 (en) Multipath transmission method and device
JP6661706B2 (ja) 可聴周波数を用いてデバイス間でデータ通信を確立するシステム及び方法
US20230155996A1 (en) Method and electronic device for managing digital keys
CN111357255B (zh) 构建多个应用通用的可信应用
WO2019196766A1 (zh) 通信方法和装置
JP2023515139A (ja) セッション確立方法及び関連装置
WO2021196167A1 (zh) 信息处理方法、装置、设备及存储介质
EP4152791A1 (en) Electronic device and method for electronic device to provide ranging-based service
CN108322464B (zh) 一种密钥验证方法及设备
US20230199482A1 (en) Method for routing access, user equipment, and storage medium
WO2021196047A1 (zh) 密钥处理方法和装置
US20230075275A1 (en) Secure pairing and pairing lock for accessory devices
EP3028429B1 (en) Local communication interception
WO2022143157A1 (zh) 一种密钥协商的方法及其相关设备
WO2022166746A1 (zh) 一种签约配置信息的方法、通信装置、芯片及模组设备
CN106055989B (zh) 一种数据传递方法及终端
WO2023207758A1 (zh) 数据处理方法及装置
WO2023124258A1 (zh) 远程访问用户识别模块sim卡的方法和装置
CN116049839B (zh) 一种数据传输方法和电子设备
US20120173879A1 (en) Secure transfer of data using a file transfer application over a usb transport layer
JP2013070374A (ja) 安全なモバイル通信のためのネットワークスイッチング方法、その機能を有する携帯用通信端末機、記録媒体及び配布装置
WO2022021087A1 (zh) 一种蓝牙节点配对方法及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20929093

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20929093

Country of ref document: EP

Kind code of ref document: A1