WO2023131209A1 - 终端防盗方法及终端设备 - Google Patents

终端防盗方法及终端设备 Download PDF

Info

Publication number
WO2023131209A1
WO2023131209A1 PCT/CN2023/070550 CN2023070550W WO2023131209A1 WO 2023131209 A1 WO2023131209 A1 WO 2023131209A1 CN 2023070550 W CN2023070550 W CN 2023070550W WO 2023131209 A1 WO2023131209 A1 WO 2023131209A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
account
theft
mobile phone
interface
Prior art date
Application number
PCT/CN2023/070550
Other languages
English (en)
French (fr)
Other versions
WO2023131209A9 (zh
Inventor
殷高生
李任鹏
Original Assignee
荣耀终端有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 荣耀终端有限公司 filed Critical 荣耀终端有限公司
Priority to EP23737072.1A priority Critical patent/EP4290844A4/en
Priority to US18/282,150 priority patent/US20240054208A1/en
Publication of WO2023131209A1 publication Critical patent/WO2023131209A1/zh
Publication of WO2023131209A9 publication Critical patent/WO2023131209A9/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/72—Mobile telephones; Cordless telephones, i.e. devices for establishing wireless links to base stations without route selection
    • H04M1/724—User interfaces specially adapted for cordless or mobile telephones
    • H04M1/72448—User interfaces specially adapted for cordless or mobile telephones with means for adapting the functionality of the device according to specific conditions
    • H04M1/72463—User interfaces specially adapted for cordless or mobile telephones with means for adapting the functionality of the device according to specific conditions to restrict the functionality of the device
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/77—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/88—Detecting or preventing theft or loss
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/66—Substation equipment, e.g. for use by subscribers with means for preventing unauthorised or fraudulent calling
    • H04M1/667—Preventing unauthorised calls from a telephone set
    • H04M1/67—Preventing unauthorised calls from a telephone set by electronic means

Definitions

  • the present application relates to the technical field of terminals, and in particular to a terminal anti-theft method and terminal equipment.
  • terminal devices eg, mobile phones, tablets, etc.
  • terminal devices eg, mobile phones, tablets, etc.
  • the picker or thief can perform operations such as flashing the terminal device to unlock the terminal device, preventing the owner from retrieving the terminal device. What's more, the thief will steal the private information of the owner, resulting in the leakage of the owner's privacy.
  • terminal manufacturers can set a factory reset protection (FRP) lock or activation lock (activation lock) in the boot wizard stage of the terminal, and verify user identity through the FRP lock or activation lock. Once the identity verification fails, the terminal cannot be activated to prevent illegal flashing operations and achieve the purpose of anti-theft.
  • FRP factory reset protection
  • activation lock activation lock
  • flashing methods emerge in endlessly. Some flashing methods can bypass the boot wizard stage, thereby bypassing identity verification, and some flashing methods can erase or tamper with the anti-theft logo stored in the terminal, so that illegal flashing users can pass identity verification.
  • the present application provides a terminal anti-theft method and a terminal device, which are used to perform identity verification when the terminal device may be lost, and lock the terminal device when the identity verification fails, so that the user cannot use the terminal device normally, and improve the anti-theft coefficient of the terminal device.
  • the present application provides a terminal anti-theft method, which is applied to a terminal device.
  • the terminal device includes a security memory chip.
  • the method includes: if the terminal device is in the power-on state, the terminal device reads the anti-theft identification, and the anti-theft identification is stored in the security storage chip.
  • the terminal device When the anti-theft identification indicates that the terminal device is in a lost state, the terminal device reads the first account from the security memory chip, and the first account is the account associated with the terminal device; the terminal device obtains the second account, and the second account is the current login account of the terminal device; account number: the terminal device determines whether the first account number is consistent with the second account number; if the first account number is inconsistent with the second account number, the terminal device displays a first interface, and the first interface indicates that the terminal device is locked.
  • the terminal device can store the anti-theft identification in the security memory chip, even if the terminal device is flashed, the anti-theft identification will not be erased. Therefore, the terminal device can always read the anti-theft identification when it is turned on and running, and perform identity verification through the first account and the second account when the anti-theft identification indicates that the terminal device may be lost. In this way, even if some terminal devices do not need to enter the startup wizard stage due to some flashing methods, they can also perform identity verification after booting. In the locked state, the user cannot use the terminal device normally, which has a certain anti-theft effect.
  • the terminal device reading the anti-theft identification includes: in response to the user's operation of modifying the lock screen password, the terminal device reads the anti-theft identification. It is understandable, considering that most users set a lock screen password on a new device, and generally users seldom modify the lock screen password. Therefore, when it is detected that the user modifies the lock screen password, it can be considered that there may be a change in the user using the terminal device. At this time, verifying whether the terminal device is in a lost state can not only achieve the purpose of verification, but also reduce unnecessary verification.
  • the terminal device reading the anti-theft identification includes: the terminal device reading the anti-theft identification at a preset time interval. Considering that the terminal device cannot predict possible operations of the user (for example, whether the user will modify the lock screen password). Therefore, by making the terminal equipment regularly read the anti-theft identification, it is possible to verify in time whether the terminal equipment is in a lost state. Once the terminal equipment is confirmed to be in a lost state, it is necessary to verify the user's identity and lock it when the identity verification fails, further enhancing the anti-theft of the terminal equipment. coefficient.
  • the method further includes: in response to the terminal device entering the startup wizard, the terminal device reads the anti-theft identification. That is, the terminal device can read the anti-theft identification after entering the boot wizard, and perform identity verification in the boot wizard stage, so as to realize anti-theft in the boot wizard stage.
  • the obtaining the second account by the terminal device includes: obtaining a login ID by the terminal device; if the login ID indicates that the terminal device has not logged into the account, the terminal device displays the second interface; Operation, the terminal device obtains the second account. That is, when the terminal device has not logged in the second account, the terminal device may provide the user with a second interface for logging in to the second account.
  • the method further includes: if the login identifier indicates that the terminal device has logged into the account, the terminal device reads the second account. That is, when the terminal device has already logged in the second account, the second account can be read directly.
  • the method further includes: in response to receiving an operation of sliding the first interface by the user, the terminal device displays a third interface, where the third interface is used for the user to input a password matching the first account. That is to say, after the terminal device enters the locked state, the user can make the terminal device display the third interface by sliding the first interface, and perform an unlocking (activation) operation through the third interface.
  • the method further includes: if the first account is consistent with the second account, the terminal device resets the anti-theft identification. Understandably, if the first account is consistent with the second account, it can be considered that the user using the terminal device has not changed, and the terminal device has not been lost, so the terminal device can reset the anti-theft identification.
  • the anti-theft identification includes a first identification and a second identification
  • the first identification is used to indicate whether the terminal device has enabled the first function
  • the first function is a function for the terminal device to upload location information to the cloud server in real time
  • the second identifier is used to indicate whether the terminal device is lost; if the first identifier indicates that the terminal device has enabled the first function, the terminal device is in a lost state; or, if the first identifier indicates that the terminal device has enabled the first function and the second The flag indicates that the terminal device is lost, and the terminal device is in a lost state.
  • the embodiment of the present application provides a terminal device, including a secure storage chip and a processor, the processor is coupled to the memory, and the memory stores program instructions.
  • the terminal device realizes the first The method of any one aspect.
  • an embodiment of the present application provides a computer-readable storage medium, including computer instructions; when the computer instructions are run on a terminal device, the terminal device is made to execute any one of the methods in the first aspect.
  • the present application provides a chip system, which includes one or more interface circuits and one or more processors.
  • the interface circuit and the processor are interconnected by wires.
  • the chip system can be applied to a terminal device including a communication module and a memory.
  • the interface circuit can read the instruction stored in the memory in the terminal device, and send the instruction to the processor.
  • the terminal device may be made to execute the method according to any one of the first aspect.
  • the present application provides a computer program product, which, when the computer program product is run on a terminal device, causes the terminal device to execute the method described in any one of the first aspect.
  • the terminal device described in the second aspect, the computer storage medium described in the third aspect, the chip system described in the fourth aspect, and the computer program product described in the fifth aspect provided above are all used to execute the For the corresponding methods provided herein, the beneficial effects that can be achieved can refer to the beneficial effects of the corresponding methods provided above, and will not be repeated here.
  • Fig. 1 is a kind of user interface figure that the application provides
  • FIG. 2 is a system architecture diagram of a terminal device provided by the present application.
  • FIG. 3 is a schematic structural diagram of a terminal device provided by the present application.
  • FIG. 4 is an interactive scene diagram provided by the present application.
  • Figures 5A-5D are a set of user interface diagrams provided by this application.
  • 6A-6B are a set of user interface diagrams provided by this application.
  • FIG. 7 is a flow chart of a terminal anti-theft method provided by the present application.
  • FIG. 9 is a flow chart of a terminal anti-theft method provided by the present application.
  • FIG. 11 is a flow chart of a terminal anti-theft method provided by the present application.
  • first and second are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, a feature defined as “first” and “second” may explicitly or implicitly include one or more of these features. In the description of this embodiment, unless otherwise specified, “plurality” means two or more.
  • the rich execution environment can also be called a common execution environment.
  • REE generally refers to an operating environment that does not have specific security functions, such as Android (Android) and IOS operating systems. It should be noted that, in addition to being called “rich execution environment”, REE can also be called “untrusted execution environment”, “common execution environment”, “unsafe execution environment” and so on. This is not limited.
  • Trusted execution environment TEE
  • TEE Trusted execution environment
  • TEE is an operating environment that coexists with REE in smart terminals. It is isolated from REE through hardware support, has security capabilities and can resist software that is vulnerable to conventional REE attack. TEE has its own operating space and defines strict protection measures. Therefore, it has a higher security level than REE and can protect assets (assets) in TEE, such as data, software, etc., from software attacks and resist specific types of security. threaten.
  • a client application client application, CA
  • CA can run in the TEE.
  • a trusted application is an application running in the TEE, which can provide security services for the CA running outside the TEE, such as entering passwords, generating transaction signatures, face recognition, etc.
  • CA usually refers to the application running in REE, but in the case of some TA calling TA, the TA that initiates the call can also be used as CA.
  • the CA can call the TA through the client (Client) application programming interface (application programming interface, API) and instruct the TA to perform corresponding security operations.
  • Client client
  • API application programming interface
  • a secure memory chip is a hardware unit with an independent processor and anti-hardware attack capabilities, which can provide a secure operating environment for applications running in it, and can ensure the security and confidentiality of assets stored in it. Therefore, some important sensitive data, such as lock screen password, face template encryption key, fingerprint template encryption key and other data, are selected to be stored in the secure memory chip.
  • SoC System-on-chip
  • a SoC is an integrated circuit with a specific purpose, which contains the complete system and has all the content of the embedded software.
  • the SoC may be integrated with a central processing unit (central processing unit, CPU), a graphics processing unit (graphics processing unit, GPU), etc. of a terminal device.
  • CPU central processing unit
  • GPU graphics processing unit
  • the startup wizard can be understood as a process in which the terminal device guides the user to set system-related parameters (such as commonly used languages, input methods, network, etc.) according to their own usage habits.
  • system-related parameters such as commonly used languages, input methods, network, etc.
  • terminal manufacturers can set FRP lock or activation lock in the boot wizard of terminal equipment, and verify user identity through FRP lock or activation lock. If the identity verification fails, the terminal device cannot be turned on normally, so as to prevent the operation of illegally reinstalling the operating system (commonly known as "flashing").
  • the terminal device when the terminal device is restarted after being flashed or restored to factory settings, it can enter the boot wizard and read the anti-theft identification.
  • the anti-theft identification can be used to indicate the status of the terminal.
  • the state of the terminal device may include two types, namely a lost state (for example, the anti-theft flag is 1) and a normal state (for example, the anti-theft flag is 0). If the anti-theft mark indicates that the terminal device is in a lost state, the terminal device may trigger an activation lock to guide the user to input account information to verify the user's identity. Exemplarily, the terminal device may display the activation interface 101 as shown in FIG. 1 .
  • the activation interface 101 includes a prompt message 102 , an input box 103 and an activation option 104 .
  • the prompt message 102 is used to prompt that the device has been associated with another account (for example, Honor account 123****1234) and is locked by an activation lock, and the user is asked to enter corresponding account information to activate the device.
  • the input box 103 is used for the user to input account information.
  • the account information may include an account number and a corresponding password.
  • the terminal device may receive an operation of clicking the activation option 104 by the user, and in response to the operation, the terminal device verifies whether the account information input by the user matches the preset account information.
  • the terminal device fails to be activated and cannot be turned on normally.
  • flashing methods emerge in endlessly, and some flashing methods can enable the terminal device to be booted directly without entering the boot wizard stage after being flashed, thereby bypassing identity verification.
  • flashing means that can erase or tamper with the anti-theft identification stored in the terminal device.
  • the parameters of the anti-theft flag can be changed to indicate that the terminal device is in a normal state. In this case, the terminal device does not need to activate the FRP lock or activation lock after entering the startup wizard, which will bypass the identity verification and fail to achieve the anti-theft effect.
  • the present application provides a terminal anti-theft method and terminal equipment, which store the first account number and the anti-theft identification in the secure storage chip, which can reduce the number of terminal devices not performing identity verification due to the first account number and the anti-theft identification being tampered with or erased. risk, and further enhance the anti-theft coefficient of terminal equipment.
  • the first account is an account once logged in by the terminal device (it can be understood as a login account of the original user of the terminal device).
  • the anti-theft identification includes a service identification (also referred to as the first identification) and a lost identification (also referred to as the second identification), the service identification is used to indicate whether the terminal device is enabled to find the device function (also referred to as the first function), The lost flag is used to indicate whether the terminal device is in the lost mode. After enabling the device search function, the terminal device can quickly locate the lost device to obtain location information, set the lost mode, and upload the location information to the cloud server in real time.
  • a service identification also referred to as the first identification
  • a lost identification also referred to as the second identification
  • the service identification is used to indicate whether the terminal device is enabled to find the device function (also referred to as the first function)
  • the lost flag is used to indicate whether the terminal device is in the lost mode. After enabling the device search function, the terminal device can quickly locate the lost device to obtain location information, set the lost mode, and upload the location information to the cloud server in real time.
  • the terminal device can also read the anti-theft identification from the security storage chip, and read the first account number from the security storage chip when it is determined that the anti-theft identification indicates that the terminal device may be lost.
  • the terminal device can verify whether the second account is consistent with the first account. Wherein, the second account is an account currently logged in by the terminal device (it can be understood as a login account of a current user of the terminal device). If the first account is inconsistent with the second account, the terminal device enters a locked state, restricting the current user from continuing to use the terminal device.
  • the terminal device can also read the anti-theft identification and perform identity verification when it is turned on and running, so that even if the terminal device is flashed, it can only be used normally after the identity verification is successful, further improving the anti-theft coefficient of the terminal device.
  • the terminal anti-theft method in the embodiment of the present application can be applied to the system architecture shown in FIG. 2 .
  • the system may include REE, TEE, secure memory chip and SoC.
  • the REE can communicate with the TEE and the SoC respectively, and the TEE and the secure memory chip can communicate with each other.
  • the security memory chip can be used to store sensitive data such as the first account number, anti-theft identification, and lock screen password.
  • a first CA may be deployed in the REE, and a first TA may be deployed in the TEE.
  • the first CA may send a request to the first TA for reading sensitive data such as the first account number, the anti-theft identification, and the lock screen password.
  • the first TA can receive the request, read the corresponding data from the secure storage chip, and feed it back to the first CA.
  • the system may also include more TEEs.
  • TEE in FIG. the TEE in FIG.
  • VM virtualized virtual machine
  • the terminal device involved in the embodiment of the present application may be any terminal device supporting the system architecture shown in FIG. 2 .
  • it can be a mobile phone, tablet computer, desktop computer (desktop computer), handheld computer, notebook computer (laptop computer), ultra-mobile personal computer (UMPC), netbook, personal digital assistant (personal digital assistant) digital assistant, PDA), augmented reality (augmented reality, AR) ⁇ virtual reality (virtual reality, VR) equipment and other equipment, the embodiment of the present application does not make special restrictions on the specific form of the terminal equipment.
  • mobile phone 200 can comprise: processor 210, external memory interface 220, internal memory 221, universal serial bus (universal serial bus, USB) interface 230, charging management module 240, power management module 241, battery 242, Antenna 1, antenna 2, mobile communication module 250, wireless communication module 260, audio module 270, speaker 270A, receiver 270B, microphone 270C, earphone jack 270D, sensor module 280, button 290, motor 291, indicator 292, camera 293, A display screen 294, and a subscriber identification module (subscriber identification module, SIM) card interface 295, etc.
  • SIM subscriber identification module
  • the above-mentioned sensor module 280 may include sensors such as pressure sensor, gyroscope sensor, air pressure sensor, magnetic sensor, acceleration sensor, distance sensor, proximity light sensor, fingerprint sensor, temperature sensor, touch sensor, ambient light sensor and bone conduction sensor.
  • sensors such as pressure sensor, gyroscope sensor, air pressure sensor, magnetic sensor, acceleration sensor, distance sensor, proximity light sensor, fingerprint sensor, temperature sensor, touch sensor, ambient light sensor and bone conduction sensor.
  • the structure shown in this embodiment does not constitute a specific limitation on the mobile phone 200 .
  • the mobile phone 200 may include more or fewer components than shown, or combine some components, or separate some components, or arrange different components.
  • the illustrated components can be realized in hardware, software or a combination of software and hardware.
  • the processor 210 may include one or more processing units, for example: the processor 210 may include an application processor (application processor, AP), a modem processor, a graphics processing unit (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), controller, memory, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural network processor (neural-network processing unit, NPU) wait. Wherein, different processing units may be independent devices, or may be integrated in one or more processors.
  • application processor application processor, AP
  • modem processor graphics processing unit
  • GPU graphics processing unit
  • image signal processor image signal processor
  • ISP image signal processor
  • controller memory
  • video codec digital signal processor
  • DSP digital signal processor
  • baseband processor baseband processor
  • neural network processor neural-network processing unit, NPU
  • the controller may be the nerve center and command center of the handset 200 .
  • the controller can generate an operation control signal according to the instruction opcode and timing signal, and complete the control of fetching and executing the instruction.
  • a memory may also be provided in the processor 210 for storing instructions and data.
  • the memory in processor 210 is a cache memory.
  • the memory may hold instructions or data that the processor 210 has just used or recycled. If the processor 210 needs to use the instruction or data again, it can be called directly from the memory. Repeated access is avoided, and the waiting time of the processor 210 is reduced, thereby improving the efficiency of the system.
  • processor 210 may include one or more interfaces.
  • the interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous transmitter (universal asynchronous receiver/transmitter, UART) interface, mobile industry processor interface (mobile industry processor interface, MIPI), general-purpose input and output (general-purpose input/output, GPIO) interface, subscriber identity module (subscriber identity module, SIM) interface, and /or universal serial bus (universal serial bus, USB) interface, etc.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • PCM pulse code modulation
  • UART universal asynchronous transmitter
  • MIPI mobile industry processor interface
  • GPIO general-purpose input and output
  • subscriber identity module subscriber identity module
  • SIM subscriber identity module
  • USB universal serial bus
  • the interface connection relationship between the modules shown in this embodiment is only a schematic illustration, and does not constitute a structural limitation of the mobile phone 200 .
  • the mobile phone 200 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.
  • the charging management module 240 is configured to receive charging input from the charger.
  • the charger may be a wireless charger or a wired charger. While the charging management module 240 is charging the battery 242 , it can also supply power to the terminal device through the power management module 241 .
  • the power management module 241 is used for connecting the battery 242 , the charging management module 240 and the processor 210 .
  • the power management module 241 receives the input from the battery 242 and/or the charging management module 240 to provide power for the processor 210 , internal memory 221 , external memory, display screen 294 , camera 293 , and wireless communication module 260 .
  • the power management module 241 and the charging management module 240 can also be set in the same device.
  • the wireless communication function of the mobile phone 200 can be realized by the antenna 1, the antenna 2, the mobile communication module 250, the wireless communication module 260, the modem processor and the baseband processor.
  • the antenna 1 of the mobile phone 200 is coupled to the mobile communication module 250, and the antenna 2 is coupled to the wireless communication module 260, so that the mobile phone 200 can communicate with the network and other devices through wireless communication technology.
  • Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in handset 200 can be used to cover single or multiple communication frequency bands. Different antennas can also be multiplexed to improve the utilization of the antennas.
  • Antenna 1 can be multiplexed as a diversity antenna of a wireless local area network.
  • the antenna may be used in conjunction with a tuning switch.
  • the mobile communication module 250 can provide wireless communication solutions including 2G/3G/4G/5G applied on the mobile phone 200 .
  • the mobile communication module 250 may include at least one filter, switch, power amplifier, low noise amplifier (low noise amplifier, LNA) and the like.
  • the mobile communication module 250 can receive electromagnetic waves through the antenna 1, filter and amplify the received electromagnetic waves, and send them to the modem processor for demodulation.
  • the mobile communication module 250 can also amplify the signal modulated by the modem processor, convert it into electromagnetic wave and radiate it through the antenna 1 .
  • at least part of the functional modules of the mobile communication module 250 may be set in the processor 210.
  • at least part of the functional modules of the mobile communication module 250 and at least part of the modules of the processor 210 may be set in the same device.
  • the wireless communication module 260 can provide applications on the mobile phone 200 including WLAN (such as (wireless fidelity, Wi-Fi) network), bluetooth (bluetooth, BT), global navigation satellite system (global navigation satellite system, GNSS), frequency modulation (frequency) modulation, FM), near field communication (near field communication, NFC), infrared technology (infrared, IR) and other wireless communication solutions.
  • WLAN such as (wireless fidelity, Wi-Fi) network
  • bluetooth blue, BT
  • global navigation satellite system global navigation satellite system, GNSS
  • NFC near field communication
  • infrared technology infrared, IR
  • the wireless communication module 260 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 260 receives electromagnetic waves via the antenna 2 , frequency-modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 210 .
  • the wireless communication module 260 can also receive the signal to be sent from the processor 210 , frequency-modulate it, amplify it, and convert it into electromagnetic waves through the antenna 2 to radiate out.
  • the mobile phone 200 realizes the display function through the GPU, the display screen 294, and the application processor.
  • the GPU is a microprocessor for image processing, and is connected to the display screen 294 and the application processor. GPUs are used to perform mathematical and geometric calculations for graphics rendering.
  • Processor 210 may include one or more GPUs that execute program instructions to generate or alter display information.
  • the display screen 294 is used to display images, videos and the like.
  • the display screen 294 includes a display panel.
  • the mobile phone 200 can realize the shooting function through ISP, camera 293 , video codec, GPU, display screen 294 and application processor.
  • the ISP is used for processing the data fed back by the camera 293 .
  • Camera 293 is used to capture still images or video.
  • the mobile phone 200 may include 1 or N cameras 293, where N is a positive integer greater than 1.
  • the external memory interface 220 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the mobile phone 200.
  • the external memory card communicates with the processor 210 through the external memory interface 220 to implement a data storage function. Such as saving music, video and other files in the external memory card.
  • the internal memory 221 may be used to store computer-executable program codes including instructions.
  • the processor 210 executes various functional applications and data processing of the mobile phone 200 by executing instructions stored in the internal memory 221 .
  • the processor 210 may execute instructions stored in the internal memory 221, and the internal memory 221 may include a program storage area and a data storage area.
  • the stored program area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.) and the like.
  • the storage data area can store data (such as audio data, phone book, etc.) created during the use of the mobile phone 200 .
  • the internal memory 221 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, flash memory device, universal flash storage (universal flash storage, UFS) and the like.
  • the mobile phone 200 can realize the audio function through the audio module 270, the speaker 270A, the receiver 270B, the microphone 270C, the earphone interface 270D, and the application processor. Such as music playback, recording, etc.
  • the keys 290 include a power key, a volume key and the like.
  • the key 290 may be a mechanical key. It can also be a touch button.
  • the motor 291 can generate a vibrating reminder.
  • the motor 291 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback.
  • the indicator 292 can be an indicator light, which can be used to indicate the charging status, the change of the battery capacity, and also can be used to indicate messages, missed calls, notifications and so on.
  • the SIM card interface 295 is used for connecting a SIM card.
  • the SIM card can be inserted into the SIM card interface 295 or pulled out from the SIM card interface 295 to realize contact and separation with the mobile phone 200 .
  • the mobile phone 200 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1.
  • SIM card interface 295 can support Nano SIM card, Micro SIM card, SIM card etc.
  • the terminal anti-theft method provided by this application will be introduced in detail by taking the scene where yoyo's mobile phone 1 (mobile phone 1 has turned on the device search function) is lost and the mobile phone 1 is searched through mobile phone 2 as an example.
  • the mobile phone 1 and the mobile phone 2 are respectively connected to the cloud server through communication.
  • yoyo can enable the search device function of mobile phone 1 in advance. After enabling the Find Device function, the mobile phone can quickly locate the lost device, play ringtones on the device, set the lost mode, and erase data to avoid leakage of user privacy. In addition, the mobile phone can also obtain its own status and location information to locate it. Exemplarily, yoyo can enable the device search function of the mobile phone 1 through the interfaces shown in FIGS. 5A-5D . As shown in (a) of FIG. 5A , the mobile phone 1 may display a main interface 501 (or a desktop), and the main interface 501 may include setting options 502 .
  • the mobile phone 1 may receive a user's click operation on the setting option 502, and in response to the operation, the mobile phone 1 may display a setting interface 503 as shown in (b) of FIG. 5A.
  • the setting interface 503 may include multiple setting options, such as WLAN, Bluetooth, battery and security 504 and so on.
  • the mobile phone 1 may receive the user's click operation on the security 504 option, and in response to the operation, the mobile phone 1 may display an interface 505 as shown in (a) in FIG. 5B .
  • Interface 505 may include multiple setting options related to device security, such as find device 506, SOS emergency assistance, password safe, and the like. If the user wants to enable the function of finding devices, he can click on the option of finding devices 506.
  • the mobile phone 1 can display an interface 507 .
  • Interface 507 may include pertinent instructions for finding device functionality, as well as an option to turn on 508 now.
  • the mobile phone 1 may receive the user's operation of clicking the option of opening immediately 508, and in response to the operation, the mobile phone 1 may display the login interface 601 as shown in (a) in FIG. 5C.
  • the login interface 601 includes an information input area 602 and a login option 603 .
  • the user can enter the login account (that is, the first account, such as the mobile phone number "135****1234") and the verification code (such as "6512") in the information input area 602 , click on the login option 603.
  • the mobile phone 1 After the mobile phone 1 receives the user's operation of clicking the login option 603, it can send the mobile phone number and verification code to the cloud server, and the cloud server will verify the mobile phone number and verification code.
  • the cloud server After the cloud server is successfully verified, it can send a message of successful verification to the mobile phone 1 .
  • the mobile phone 1 receives the message, and displays the search device interface 701 as shown in (a) of FIG. 5D .
  • the find device interface 701 may include a status prompt message 702 and a find my phone option 703 .
  • the status prompt information 702 is used to indicate whether the search device function is enabled. For example, the status prompt information 702 shown in (a) in FIG. 5D indicates that the mobile phone 1 has not enabled the device search function. If the user wishes to enable the device search function, he can click on the Find My Phone option 703 . After the mobile phone detects this operation, it can locate the mobile phone 1, and display a map 704 identifying the specific location of the mobile phone 1 on the search device interface 701 (as shown in (b) in FIG. 5D ).
  • the mobile phone 1 when the mobile phone 1 receives the user's operation of clicking open 508 immediately, it can skip the login process shown in Figure 5C and directly display the account shown in (a) in Figure 5D Find device interface 701 of .
  • the service mark can be set as a state indicating that the function of finding the device has been turned on.
  • the service identifier can be 0 or 1. If the service identifier is 0, it means that the device has not enabled the function of finding the device, and if the service identifier is 1, it means that the device has enabled the function of finding the device. In this way, after the mobile phone 1 starts the device search function, it can set the service identifier to 1, and send a request for storing the service identifier and the first account to the first TA.
  • the first TA may receive the request, write the service identifier and the first account into the secure storage chip, and store them in the secure storage chip.
  • the mobile phone 1 can also obtain its own positioning information, and upload the positioning information to the cloud server.
  • the cloud server can receive the positioning information, and establish a binding relationship between the mobile phone 1, the positioning information, and the first account.
  • establishing a binding relationship between the mobile phone 1, the positioning information and the first account may refer to that the cloud server can find the positioning information of the mobile phone 1 through the first account.
  • the mobile phone 2 may display a device search interface 801 .
  • the find devices interface 801 includes an option to view all devices 802 . If the user wishes to view all devices associated with the first account, he may click View All Devices 802 . After the mobile phone 2 detects that the user clicks to view all devices 802, the device list 803 can be displayed on the search device interface 801 (as shown in (b) in FIG. 6A ).
  • the device list 803 can display the device information of all devices bound to the first account (for example, mobile phone 1 and mobile phone 2 of yoyo), and the device information can include device name (for example, mobile phone 1 of yoyo), device model (for example, Honor magic3 Pro), location information (for example, Technology Building), etc.
  • the user can select the device to be controlled (for example, yoyo's mobile phone 1) from all the devices included in the device list 803.
  • the mobile phone 2 can be displayed on the search device interface 801 as shown in Figure 6B.
  • the control bar 804 can display the specific location of the mobile phone 1 (for example, Building 1, Science and Technology Building, Street A, High-tech Zone, Chengdu City, Sichuan province), power status, multiple control options available for controlling the mobile phone 1, and the like.
  • multiple control options may include lost mode 805, playing ringtones, navigating, erasing data and so on.
  • the user can click on the operation of the lost mode 805, and in response to this operation, the mobile phone 2 can display the interface 806 as shown in (b) in FIG. 6B.
  • Interface 806 includes instructions for lost mode.
  • interface 806 also includes a continue option 807 .
  • the mobile phone 2 may receive the user's operation of clicking the continue option 807, and in response to the operation, the mobile phone 2 may display an interface 808 for setting lock screen information (as shown in (c) in FIG. 6B ).
  • the lock screen information setting interface 808 is used to set the information displayed on the lock screen interface after the mobile phone 1 enters the lost mode, such as mobile phone number and message.
  • the lock screen information interface 808 may include a confirmation option 809, which can be clicked by the user after setting is completed.
  • the mobile phone 2 detects that the user clicks the confirmation option 809, it can send a request to the cloud server to set the mobile phone 1 to the lost mode.
  • the cloud server receives the request, and sends a state change message to the mobile phone 1 according to the first account.
  • the mobile phone 1 receives the state change message, and sets the lost flag to indicate that the lost mode has been turned on.
  • the lost flag can be 0 or 1. If the lost flag is 0, it means that the device has not entered the lost mode, and if the lost flag is 1, it means that the device has entered the lost mode. In this way, after receiving the state change message, the mobile phone 1 can set the lost flag to 1, and write the lost flag into the secure memory chip for storage by the secure memory chip.
  • the security memory chip is a hardware unit with an independent processor and the ability to prevent hardware attacks, and ordinary flashing or factory reset operations cannot tamper with or erase the data stored in the security memory chip. Therefore, by storing the first account number, the service identifier and the lost identifier through the secure memory chip, it is possible to prevent lawless persons from tampering with or erasing the first account number and the anti-theft identifier.
  • anti-theft in order to strengthen the anti-theft coefficient of the terminal equipment, after the mobile phone 1 enters the lost mode, anti-theft can be performed in two stages.
  • the two phases include: boot wizard phase and normal boot operation phase. How the mobile phone 1 performs anti-theft in the startup wizard stage and the normal startup operation stage will be described below.
  • the process includes: after the mobile phone 1 is restored to factory settings or flashed, the mobile phone 1 is restarted, and the mobile phone 1 enters a boot wizard. For example, after the mobile phone 1 receives the user's power-on operation, it can detect whether the firmware version changes. If the firmware version changes, it is considered that the mobile phone 1 is flashed and enters the boot wizard. After entering the startup wizard, the mobile phone 1 can read the anti-theft identification. If the anti-theft mark indicates that the mobile phone 1 is not in a lost state, then the mobile phone 1 can be directly turned on normally to complete the factory reset or reset.
  • the mobile phone 1 may display an activation lock interface (for example, it may be the interface 101 as shown in FIG. 1 ).
  • the mobile phone 1 can recognize the user's input operation on the activation lock interface, and obtain the second account.
  • the mobile phone 1 can read the first account, and compare whether the first account is consistent with the second account. If the first account is the same as the second account, the mobile phone 1 will boot normally; if the first account is inconsistent with the second account, the mobile phone 1 will fail to boot, and the factory reset or flashing cannot be completed.
  • the mobile phone 1 can display different setting interfaces to guide the user to set commonly used functions. Frequently used functions may include WIFI, contacts, login account, etc.
  • the process for the mobile phone 1 to read the anti-theft identification includes: the first CA sends a request for reading the anti-theft identification to the first TA.
  • the first TA receives the request, reads the anti-theft identification from the security memory chip and feeds it back to the first CA.
  • the first CA can be an anti-theft CA pre-deployed in the REE, and the first TA is an anti-theft TA pre-deployed in the TEE.
  • the anti-theft service of the mobile phone 1 can be realized. It should be noted that the principle and process of reading the first account number by the mobile phone 1 are the same or similar to the principle and process of reading the anti-theft identification by the mobile phone 1, and will not be repeated hereafter.
  • the anti-theft identification includes a service identification and a lost identification.
  • the service ID is 1 and the lost ID is 1, it can be considered that mobile phone 1 is in a lost state; if the lost ID is 0 (regardless of whether the service ID is 1 or 0), it can be considered that mobile phone 1 is not lost.
  • the mobile phone 1 can be considered lost only after the user turns on the device search function of the mobile phone 1 and successfully sets the mobile phone 1 to the lost mode. In this way, when the original owner normally performs operations such as flashing the mobile phone 1, no identity verification is required, which not only has an anti-theft effect but also avoids complicated operations from bringing bad experience to the user.
  • the lost mode can only be set after the device has turned on the function of finding devices. Therefore, when the anti-theft flag has not been modified and the service flag is 0, the lost flag cannot be 1.
  • the first CA may first send a request to read the service identifier to the first TA. In the case of confirming that the service identifier is 1, send a request to read the lost identifier to the first TA, and further confirm whether the mobile phone 1 is in a lost state according to whether the lost identifier is 1 or 0.
  • the mobile phone 1 After the mobile phone 1 confirms that it is in the lost state, it can display an activation interface.
  • the mobile phone 1 may display an activation interface 801 as shown in FIG. 8A .
  • the activation interface 801 may include an input box 802 for the user to input an account number and a password.
  • the touch sensor of the mobile phone 1 detects the user's touch operation on the display screen 294, and reports the user's touch position information on the display screen 294 to the processor 210, and the processor 210 reports the information within a preset time period according to the touch sensor.
  • the touch position information is determined to determine that the touch operation is input of the second account number and corresponding password.
  • the mobile phone 1 may verify whether the second account matches the password. If the second account number does not match the password, the mobile phone 1 may display a prompt message (not shown) for prompting that the password is incorrect. If the second account and the password match, the mobile phone 1 can further compare whether the first account is consistent with the second account. If the first account is the same as the second account, the mobile phone 1 will boot normally; if the first account is inconsistent with the second account, the mobile phone 1 will fail to boot, and the factory reset or flashing cannot be completed.
  • the mobile phone 1 may display an activation interface 803 as shown in FIG. 8B .
  • the activation interface 803 may include prompt information 804 and an input box 805 .
  • the prompt message 804 is used to prompt the user that the device has been associated with another account (ie, the first account) and is locked by an activation lock, and the current user is asked to input corresponding account information to activate the device.
  • the input box 805 is used for the user to input the password of the associated account (the first account).
  • the mobile phone 1 may verify whether the password matches the first account. If the password matches the first account, the mobile phone 1 will be turned on normally; if the password does not match the first account, the mobile phone 1 will fail to boot, unable to complete factory reset or reset.
  • the picker flashes the picked-up device or restores the factory settings, after the device is restarted, it will enter the boot wizard stage and verify the user's identity through the activation lock. If the verification cannot be passed, the booting operation cannot be completed, preventing the picker from using the mobile phone 1 normally, which has a certain anti-theft effect.
  • the mobile phone 1 can actively and/or passively start the anti-theft process.
  • actively starting the anti-theft process can mean that the mobile phone 1 can periodically read the anti-theft identification to detect whether it is in a lost state, if it is in a lost state, it can verify the user's identity, and lock the mobile phone when the identity verification fails.
  • the passive anti-theft process can refer to that when the mobile phone 1 detects the operation of setting a password by the user, it can read the anti-theft identification to detect whether it is in a lost state, if it is in a lost state, it can verify the user's identity, and lock the mobile phone when the identity verification fails.
  • FIG. 9 is a flow chart of passively enabling the anti-theft process for the mobile phone 1 .
  • the mobile phone 1 may receive an operation of setting a lock screen password by the user, and in response to the operation, the mobile phone 1 may first read the anti-theft identification. If the anti-theft mark indicates that the mobile phone 1 is not in a lost state, the mobile phone 1 can operate normally. If the anti-theft mark indicates that the mobile phone 1 is lost, the mobile phone 1 can read the first account number and the second account number, and verify whether the second account number is consistent with the first account number.
  • the anti-theft identification may include a service identification and a lost identification. When the service identification and the lost identification are both 1, it can be considered that the mobile phone is in a lost state, and the mobile phone 1 reads the first account number and the second account number. account number.
  • the mobile phone 1 can directly read the second account. If the mobile phone 1 has not logged in the second account, the mobile phone 1 may display a login interface for the user to log in, so as to obtain the second account. Wherein, the login interface is similar to the interface 601 shown in FIG. 5C , and will not be described here.
  • the mobile phone 1 can acquire a login ID.
  • the login identifier can be used to indicate whether the mobile phone 1 is logged into the account. For example, the login identifier can be 0 or 1, the login identifier being 1 indicates that the mobile phone 1 has logged in the account, and the login identifier being 0 indicates that the mobile phone 1 has not logged in the account.
  • the mobile phone 1 may display an interface 1001 for locking the password.
  • the interface 1001 includes an option 1002 to set a lock screen password.
  • the mobile phone 1 can receive the user's operation of clicking the option 1002, and in response to the operation, the mobile phone 1 can read the anti-theft identification. If the anti-theft mark indicates that the mobile phone 1 is in a non-lost state, or the anti-theft mark indicates that the mobile phone 1 is in a lost state and the second account number is consistent with the first account number, then the mobile phone 1 can display an interface 1003 as shown in FIG. The user sets a lock screen password.
  • the mobile phone 1 may display an activation lock interface 1004 as shown in (a) in FIG. 10C, which is used to prompt the mobile phone 1
  • the current user returns the mobile phone 1 to the original owner as soon as possible.
  • the mobile phone 1 may receive the user's operation of sliding the activation lock interface 1004, and in response to the operation, the mobile phone 1 may display an interface 1005 as shown in (b) in FIG. 10C.
  • the interface 1005 is used for the user to input a password.
  • the above-mentioned lock screen password is only described by using a digital password as an example.
  • the screen lock password may also include biometric information (such as fingerprints, faces, irises, etc.) and the like.
  • FIG. 11 is a flow chart of the mobile phone 1 actively enabling the anti-theft process.
  • the mobile phone 1 can periodically read the anti-theft identification. If the anti-theft mark indicates that the mobile phone 1 is not in a lost state, the mobile phone 1 can operate normally. If the anti-theft mark indicates that the mobile phone 1 is lost, the mobile phone 1 can read the first account number and verify whether the second account number is consistent with the first account number. If the first account is consistent with the second account, the mobile phone 1 operates normally; if the first account is inconsistent with the second account, the mobile phone 1 enters a locked state and cannot provide services to the user before unlocking.
  • the anti-theft identification may include a service identification and a lost identification.
  • the service identification and the lost identification are both 1, it can be considered that the mobile phone is in a lost state, and the mobile phone 1 reads the first account number and the second account number. account number. If the first account is consistent with the second account, the mobile phone 1 operates normally; if the first account is inconsistent with the second account, the mobile phone 1 enters a locked state and cannot provide services to users before unlocking.
  • the anti-theft process triggered by setting the lock screen password cannot achieve the anti-theft effect, so the mobile phone 1 can also take the initiative to regularly read the anti-theft identification. Once it is confirmed that the mobile phone 1 is in a lost state, it needs to verify the user's identity and lock it when the identity verification fails. This further enhances the anti-theft factor of the terminal equipment.
  • the terminal device will also read the anti-theft identification after it is turned on normally, and verify the identity of the user when the anti-theft identification indicates that the terminal device may be lost. If the verification result is a verification failure, the terminal device enters into a locked state, so that the user cannot use the terminal device normally, which has a certain anti-theft effect.
  • mobile phone 1 can obtain the first account and the second account when confirming that the service ID is 1 and the lost ID is 1, and further verify the second account Whether it is consistent with the first account number.
  • the first CA may first send a request to read the service identifier to the first TA.
  • send a request to read the lost identifier to the first TA and further confirm whether the mobile phone 1 is in a lost state according to whether the lost identifier is 1 or 0.
  • the mobile phone 1 perform identity verification.
  • the device can be used normally without identity verification. It can be seen that this method not only has an anti-theft effect but also can avoid complicated operations from bringing bad experience to the user.
  • the foregoing content illustrates that after the mobile phone 1 enters the lost mode (that is, the service flag is 1 and the lost flag is 1), the user can be authenticated during the startup wizard stage or the normal startup operation stage.
  • the original owner of the mobile phone 1 often fails to set the mobile phone 1 to the lost mode in time (for example, the original owner sets it to the lost mode after the picker turns off the mobile phone 1), which causes the mobile phone 1 to fail to update the settings in time.
  • Lost identification so as not to achieve the problem of anti-theft effect. Therefore, in an optional design, when the service identifier is 1 (whether the lost identifier is 1 or not), the mobile phone 1 is considered to be in a lost state.
  • the mobile phone 1 may display an activation lock interface when confirming that the service identifier is 1, and verify the user's identity. If in the normal operation stage, the mobile phone 1 can read the first account number and the second account number when confirming that the service identifier is 1, and further compare whether the first account number is consistent with the second account number. It can be seen that the mobile phone 1 can start the hand anti-theft process after the device search function is turned on, so as to avoid the problem that the mobile phone 1 does not have anti-theft effect due to the failure of the original owner to lose it in time.
  • the mobile phone 1 may also display an activation lock interface to verify the user's identity during the startup wizard stage. In other words, even if the mobile phone 1 does not enable the device search function, the mobile phone 1 can also start the anti-theft process in the boot wizard stage, so as to maximize the effect of anti-theft.
  • the terminal anti-theft method can verify whether the second account is consistent with the first account when the terminal device is lost. If the first account is inconsistent with the second account, the terminal device enters a locked state, restricting the current user from continuing to use the terminal device. It can be seen that the terminal device can also read the anti-theft identification and perform identity verification when it is turned on and running, so that even if the terminal device is flashed, it can only be used normally after the identity verification is successful, further improving the anti-theft coefficient of the terminal device.
  • Each functional unit in each embodiment of the embodiment of the present application may be integrated into one processing unit, or each unit may physically exist separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage
  • the medium includes several instructions to enable a computer device (which may be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, and other various media capable of storing program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Human Computer Interaction (AREA)
  • Mathematical Physics (AREA)
  • Telephone Function (AREA)

Abstract

本申请提供一种终端防盗方法及终端设备，可以在终端设备处于开机运行状态时进行身份验证，若验证结果为验证失败便进入锁定状态，使用户无法正常使用终端设备，具备一定的防盗效果。该方法包括：若所述终端设备处于开机运行状态，终端设备读取防盗标识，防盗标识存储于安全存储芯片；当防盗标识指示终端设备处于丢失状态时，终端设备从安全存储芯片读取第一账号，第一帐号为终端设备关联的账号；终端设备获取第二帐号，第二帐号为终端设备当前登录的帐号；终端设备确定第一账号与第二账号是否一致；若第一帐号与第二帐号不一致，终端设备显示第一界面，第一界面指示终端设备已锁定。

Description

终端防盗方法及终端设备
本申请要求于2022年01月10日提交国家知识产权局、申请号为202210022827.7、发明名称为“终端防盗方法及终端设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及终端技术领域，尤其涉及一种终端防盗方法及终端设备。
背景技术
随着科技的不断发展，终端设备(例如，手机、平板等)在人们生活中扮演的角色越来越重要。但在日常生活中，终端设备丢失或被盗的事件时有发生。当终端设备丢失或被盗后，拾取者或者偷盗者可对终端设备进行刷机等操作解锁该终端设备，阻止失主找回终端设备。更有甚者，偷盗者会盗取失主的隐私信息，导致失主的隐私泄露。
目前，终端厂商可在终端的开机向导阶段设置恢复出厂保护(factory reset protection，FRP)锁或者激活锁(activation lock)，并通过FRP锁或者激活锁来验证用户身份。一旦身份验证失败，终端则无法激活，以阻止非法刷机操作，达到防盗的目的。然而，刷机手段层出不穷，有些刷机手段可以绕过开机向导阶段，从而绕过身份验证，还有一些刷机手段可以擦除或篡改终端中存储的防盗标识，从而使非法刷机者通过身份验证。
可见，目前的防盗方法存在防盗效果不佳的问题。
发明内容
本申请提供一种终端防盗方法及终端设备，用于在终端设备可能被丢失时进行身份验证，在身份验证不通过时锁定终端设备，使用户无法正常使用终端设备，提升终端设备的防盗系数。
为达到上述目的，本申请采用如下技术方案：
第一方面，本申请提供一种终端防盗方法，应用于终端设备，终端设备包括安全存储芯片，方法包括：若终端设备处于开机运行状态，终端设备读取防盗标识，防盗标识存储于安全存储芯片；当防盗标识指示终端设备处于丢失状态时，终端设备从安全存储芯片读取第一账号，第一帐号为终端设备关联的账号；终端设备获取第二帐号，第二帐号为终端设备当前登录的帐号；终端设备确定第一账号与第二账号是否一致；若第一帐号与第二帐号不一致，终端设备显示第一界面，第一界面指示终端设备已锁定。
可见，终端设备可以将防盗标识存储于安全存储芯片中，即使终端设备被刷机，防盗标识也不会被擦除。因此终端设备总是可以在开机运行状态读取防盗标识，并在防盗标识指示终端设备可能被丢失时通过第一帐号和第二帐号进行身份验证。这样一来，即使有些终端设备由于一些刷机手段而无需进入开机向导阶段，也可在开机后进行身份验证，若验证结果为验证失败(即第一帐号与第二帐号不一致)，则终端设备进入锁定状态，使用户无法正常使用终端设备，具备一定的防盗效果。
在一种可选的实施例中，终端设备读取防盗标识，包括：响应于用户修改锁屏密码的 操作，终端设备读取防盗标识。可以理解地，考虑到大多用户在新设备上设置锁屏密码，而一般情况下用户很少修改锁屏密码。因此在检测到用户修改锁屏密码时可以认为使用终端设备的用户可能存在变化，此时验证终端设备是否处于丢失状态，既能达到验证目的，又可以减少不必要的验证。
在一种可选的实施例中，终端设备读取防盗标识，包括：终端设备按照预设的时间间隔读取防盗标识。考虑到终端设备无法预知用户可能进行的操作(例如，用户是否会修改锁屏密码)。因此，使终端设备定时读取防盗标识，便可及时验证终端设备是否处于丢失状态，一旦确认终端设备处于丢失状态则需要验证用户身份，并在身份验证失败时锁定，进一步增强了终端设备的防盗系数。
在一种可选的实施例中，方法还包括：响应于终端设备进入开机向导，终端设备读取防盗标识。也即，终端设备可以在进入开机向导后读取防盗标识，在开机向导阶段进行身份验证，实现在开机向导阶段的防盗。
在一种可选的实施例中，终端设备获取第二帐号包括：终端设备获取登录标识；若登录标识指示终端设备未登录帐号，终端设备显示第二界面；响应于用户在第二界面的输入操作，终端设备获取第二帐号。也即，在终端设备未登录第二帐号时，终端设备可以为用户提供登录第二帐号的第二界面。
在一种可选的实施例中，方法还包括：若登录标识指示终端设备已登录帐号，终端设备读取第二帐号。也即，在终端设备已经登录了第二帐号的情况下，可以直接读取第二帐号。
在一种可选的实施例中，方法还包括：响应于接收到用户滑动第一界面的操作，终端设备显示第三界面，第三界面用于供用户输入第一帐号匹配的密码。也就是说，在终端设备进入锁定状态后，用户可以通过滑动第一界面的方式使终端设备显示第三界面，并通过第三界面进行解锁(激活)操作。
在一种可选的实施例中，方法还包括：若第一帐号与第二帐号一致，终端设备重置防盗标识。可以理解地，若第一帐号与第二帐号一致，则可以认为使用该终端设备的用户未发生变化，该终端设备未被丢失，因此终端设备可以重置防盗标识。
在一种可选的实施例中，防盗标识包括第一标识及第二标识，第一标识用于指示终端设备是否开启第一功能，第一功能为终端设备实时向云服务器上传定位信息的功能，第二标识用于指示终端设备是否被置丢；若第一标识指示终端设备已开启第一功能，终端设备处于丢失状态；或者，若第一标识指示终端设备已开启第一功能且第二标识指示终端设备被置丢，终端设备处于丢失状态。
第二方面，本申请实施例提供一种终端设备，包括安全存储芯片和处理器，处理器和存储器耦合，存储器存储有程序指令，当存储器存储的程序指令被处理器执行时使得终端设备实现第一方面中任一项的方法。
第三方面，本申请实施例提供一种计算机可读存储介质，包括计算机指令；当计算机指令在终端设备上运行时，使得终端设备执行第一方面中任一项的方法。
第四方面，本申请提供一种芯片系统，该芯片系统包括一个或多个接口电路和一个或多个处理器。该接口电路和处理器通过线路互联。该芯片系统可以应用于包括通信模块和存储器的终端设备。该接口电路可以读取终端设备中存储器中存储的指令，并将该指令发 送给处理器。当所述指令被处理器执行时，可使得终端设备执行如第一方面中任一项的方法。
第五方面，本申请提供一种计算机程序产品，当计算机程序产品在终端设备上运行时，使得终端设备执行如第一方面中任一项所述的方法。
可以理解地，上述提供的第二方面所述的终端设备、第三方面所述的计算机存储介质、第四方面所述的芯片系统，以及第五方面所述的计算机程序产品均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
附图说明
图1为本申请提供的一种用户界面图；
图2为本申请提供的一种终端设备的系统架构图；
图3为本申请提供的一种终端设备的结构示意图；
图4为本申请提供的交互场景图；
图5A-图5D为本申请提供的一组用户界面图；
图6A-图6B为本申请提供的一组用户界面图；
图7为本申请提供的一种终端防盗方法的流程图；
图8A-图8B为本申请提供的一组用户界面图；
图9为本申请提供的一种终端防盗方法的流程图；
图10A-图10C为本申请提供的一组用户界面图；
图11为本申请提供的一种终端防盗方法的流程图。
具体实施方式
以下，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征。在本实施例的描述中，除非另有说明，“多个”的含义是两个或两个以上。
为了下述各实施例的描述清楚简洁及便于本领域技术人员容易理解，首先给出相关概念或技术的简要介绍。
富执行环境(rich execution environment，REE)，也可以称为普通执行环境。REE泛指不具备特定安全功能的运行环境，比如安卓(Android)、IOS操作系统。需要说明的是，REE除了被称为“富执行环境”之外，还可以被称为“不可信执行环境”、“普通执行环境”、“不安全执行环境”等等，本申请实施例对此不作限定。
可信执行环境(trusted execution environment，TEE)，TEE是与REE共存于智能终端中的运行环境，其通过硬件的支撑，实现与REE的隔离，具有安全能力并且能够抵御常规REE侧易遭受的软件攻击。TEE有自身的运行空间，定义了严格的保护措施，因此，比REE的安全级别更高，能够保护TEE中的资产(assets)，如数据，软件等，免受软件攻击，抵抗特定类型的安全威胁。TEE中可运行有客户端应用(client application，CA)。
可信应用(trusted application，TA)，是运行在TEE中的应用，能够为运行在TEE之外的CA提供安全服务，如输入密码，生成交易签名，人脸识别等。
CA，通常指运行在REE中的应用，但在某些TA调用TA的情况下，主动发起调用的 TA也可作为CA。CA可以通过客户端(Client)应用程序编程接口(application programming interface，API)对TA进行调用并指示TA执行相应的安全操作。
安全存储芯片是具有独立的处理器和防硬件攻击能力的硬件单元，能够为在其中运行的应用程序提供安全的运行环境，并且能够保证存储在其中的资产的安全性和机密性。因此一些比较重要的敏感数据，比如锁屏密码、人脸模板加密密钥、指纹模板加密密钥等数据都选择存储在安全存储芯片中。
系统级芯片(system on chip，SoC)。SoC是一个有专用目标的集成电路，其中包含完整系统并有嵌入软件的全部内容。SoC可集成有终端设备的中央处理器(central processing unit，CPU)、图形处理器(graphics processing unit，GPU)等。
终端设备被刷机或者恢复出厂设置后，重新开机时会直接进入开机向导。开机向导可以理解为终端设备引导用户按照自身使用习惯设置系统相关参数(例如常用语言、输入法、网络等)的过程。目前，终端厂商为提升终端设备的防盗系数，可在终端设备的开机向导中设置FRP锁或者激活锁，并通过FRP锁或者激活锁来验证用户身份。若身份验证失败，终端设备则无法正常开机，以阻止非法重装操作系统(俗称“刷机”)的操作。
具体的，终端设备在被刷机或者恢复出厂设置的情况下重新开机，可进入开机向导，并可读取防盗标识。该防盗标识可用于指示终端所处的状态。终端设备所处的状态可包括两种类型，分别为丢失状态(例如，防盗标识为1)和正常状态(例如，防盗标识为0)。若防盗标识指示终端设备处于丢失状态，则终端设备可触发激活锁，引导用户输入帐号信息以验证用户身份。示例性的，终端设备可显示如图1所示的激活界面101。激活界面101包括提示信息102、输入框103及激活选项104。该提示信息102用于提示该设备已与其他帐号(例如，荣耀帐号123****1234)关联且被激活锁锁定，请用户输入相应帐号信息激活设备。该输入框103用于供用户输入帐号信息。帐号信息可包括帐号及相应的密码。用户通过输入框103输入帐号信息后，可点击激活选项104。终端设备可接收用户点击该激活选项104的操作，响应于该操作，终端设备验证用户输入的帐号信息与预设的帐号信息是否匹配。若用户输入的帐号信息与预设的帐号信息匹配，则可得到验证成功的结果，终端设备成功被激活，可正常开机。若用户输入的密帐号信息与预设的帐号信息不匹配，得到验证失败的结果，则终端设备激活失败，无法正常开机。
然而，刷机手段层出不穷，有些刷机手段可使终端设备被刷机后无需进入开机向导阶段，直接开机，从而绕过身份验证。还有一些刷机手段可擦除或篡改终端设备中存储的防盗标识。例如，可以将防盗标识的参数更改为指示终端设备处于正常状态。这种情况下，终端设备进入开机向导后无需激活FRP锁或者激活锁，会绕过身份验证，达不到防盗的效果。
可见，现有技术中存在防盗效果不佳的问题。
由此，本申请提供一种终端防盗方法及终端设备，将第一帐号及防盗标识存储在安全存储芯片中，可降低由于第一帐号及防盗标识被篡改或者擦除导致终端设备不进行身份验证的风险，进一步提升终端设备的防盗系数。其中，第一帐号为终端设备曾经登录过的帐号(可以理解为终端设备的原使用者的登录帐号)。防盗标识包括服务标识(也可以称为第一标识)以及置丢标识(也可以称为第二标识)，服务标识用于指示终端设备是否开启查找设备功能(也可以称为第一功能)，置丢标识用于指示终端设备是否处于丢失模式。 开启查找设备功能后，终端设备可对丢失的设备快速定位获得定位信息、设置丢失模式，并实时向云服务器上传定位信息等。
此外，终端设备还可从安全存储芯片中读取防盗标识，并在确定防盗标识指示终端设备可能丢失时从安全存储芯片中读取第一帐号。终端设备可验证第二帐号与第一帐号是否一致。其中，第二帐号为终端设备当前登录的帐号(可以理解为终端设备的当前使用者的登录帐号)。若第一帐号与第二帐号不一致，则终端设备进入锁定状态，限制当前使用者继续使用该终端设备。可见，终端设备在开机运行时也可读取防盗标识并进行身份验证，可使终端设备即使被刷机后也需要在身份验证成功后才能被正常使用，进一步提升终端设备的防盗系数。
本申请实施例中的终端防盗方法可应用于如图2所示的系统架构中。如图2所示，该系统可包括REE、TEE、安全存储芯片及SoC。REE可分别与TEE及SoC相互通信，TEE与安全存储芯片之间可以相互通信。其中，安全存储芯片可用于存储第一帐号、防盗标识、锁屏密码等敏感数据。REE中可部署有第一CA，TEE中可部署有第一TA。第一CA可向第一TA发送读取第一帐号、防盗标识、锁屏密码等敏感数据的请求。第一TA可接收该请求，从安全存储芯片中读取相应数据，并反馈给第一CA。
需要说明的是，在本申请实施例中，该系统还可包括更多的TEE，例如将图2中的TEE作为第一TEE，将通过hypervisor(又称虚拟机监视器(virtual machine monitor，VMM))虚拟出的虚拟机(virtual machine，VM))作为第二TEE。
本申请实施例中涉及到的终端设备，可以是支持图2所示的系统架构的任何终端设备。例如，可以是手机、平板电脑、台式机(桌面型电脑)、手持计算机、笔记本电脑(膝上型电脑)、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本、个人数字助理(personal digital assistant，PDA)、增强现实(augmented reality，AR)\虚拟现实(virtual reality，VR)设备等设备，本申请实施例对终端设备的具体形态不作特殊限制。
下面以终端设备为手机为例，说明本申请实施所应用的一种终端设备的结构示意图。请参阅图3，手机200可以包括：处理器210，外部存储器接口220，内部存储器221，通用串行总线(universal serial bus，USB)接口230，充电管理模块240，电源管理模块241，电池242，天线1，天线2，移动通信模块250，无线通信模块260，音频模块270，扬声器270A，受话器270B，麦克风270C，耳机接口270D，传感器模块280，按键290，马达291，指示器292，摄像头293，显示屏294，以及用户标识模块(subscriber identification module，SIM)卡接口295等。
其中，上述传感器模块280可以包括压力传感器，陀螺仪传感器，气压传感器，磁传感器，加速度传感器，距离传感器，接近光传感器，指纹传感器，温度传感器，触摸传感器，环境光传感器和骨传导传感器等传感器。
可以理解的是，本实施例示意的结构并不构成对手机200的具体限定。在另一些实施例中，手机200可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
处理器210可以包括一个或多个处理单元，例如：处理器210可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，存储器，视频编解码 器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
控制器可以是手机200的神经中枢和指挥中心。控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。
处理器210中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器210中的存储器为高速缓冲存储器。该存储器可以保存处理器210刚用过或循环使用的指令或数据。如果处理器210需要再次使用该指令或数据，可从所述存储器中直接调用。避免了重复存取，减少了处理器210的等待时间，因而提高了系统的效率。
在一些实施例中，处理器210可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，移动产业处理器接口(mobile industry processor interface，MIPI)，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module，SIM)接口，和/或通用串行总线(universal serial bus，USB)接口等。
可以理解的是，本实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对手机200的结构限定。在另一些实施例中，手机200也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
充电管理模块240用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。充电管理模块240为电池242充电的同时，还可以通过电源管理模块241为终端设备供电。
电源管理模块241用于连接电池242，充电管理模块240与处理器210。电源管理模块241接收电池242和/或充电管理模块240的输入，为处理器210，内部存储器221，外部存储器，显示屏294，摄像头293，和无线通信模块260等供电。在一些实施例中，电源管理模块241和充电管理模块240也可以设置于同一个器件中。
手机200的无线通信功能可以通过天线1，天线2，移动通信模块250，无线通信模块260，调制解调处理器以及基带处理器等实现。在一些实施例中，手机200的天线1和移动通信模块250耦合，天线2和无线通信模块260耦合，使得手机200可以通过无线通信技术与网络以及其他设备通信。
天线1和天线2用于发射和接收电磁波信号。手机200中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。例如：可以将天线1复用为无线局域网的分集天线。在另外一些实施例中，天线可以和调谐开关结合使用。
移动通信模块250可以提供应用在手机200上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块250可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(low noise amplifier，LNA)等。移动通信模块250可以由天线1接收电磁波，并对接收的电磁波进行滤波，放大等处理，传送至调制解调处理器进行解调。
移动通信模块250还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。在一些实施例中，移动通信模块250的至少部分功能模块可以被设置于处理 器210中。在一些实施例中，移动通信模块250的至少部分功能模块可以与处理器210的至少部分模块被设置在同一个器件中。
无线通信模块260可以提供应用在手机200上的包括WLAN(如(wireless fidelity，Wi-Fi)网络)，蓝牙(bluetooth，BT)，全球导航卫星系统(global navigation satellite system，GNSS)，调频(frequency modulation，FM)，近距离无线通信技术(near field communication，NFC)，红外技术(infrared，IR)等无线通信的解决方案。
无线通信模块260可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块260经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到处理器210。无线通信模块260还可以从处理器210接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
手机200通过GPU，显示屏294，以及应用处理器等实现显示功能。GPU为图像处理的微处理器，连接显示屏294和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。处理器210可包括一个或多个GPU，其执行程序指令以生成或改变显示信息。
显示屏294用于显示图像，视频等。该显示屏294包括显示面板。
手机200可以通过ISP，摄像头293，视频编解码器，GPU，显示屏294以及应用处理器等实现拍摄功能。ISP用于处理摄像头293反馈的数据。摄像头293用于捕获静态图像或视频。在一些实施例中，手机200可以包括1个或N个摄像头293，N为大于1的正整数。
外部存储器接口220可以用于连接外部存储卡，例如Micro SD卡，实现扩展手机200的存储能力。外部存储卡通过外部存储器接口220与处理器210通信，实现数据存储功能。例如将音乐，视频等文件保存在外部存储卡中。
内部存储器221可以用于存储计算机可执行程序代码，所述可执行程序代码包括指令。处理器210通过运行存储在内部存储器221的指令，从而执行手机200的各种功能应用以及数据处理。例如，在本申请实施例中，处理器210可以通过执行存储在内部存储器221中的指令，内部存储器221可以包括存储程序区和存储数据区。
其中，存储程序区可存储操作系统，至少一个功能所需的应用程序(比如声音播放功能，图像播放功能等)等。存储数据区可存储手机200使用过程中所创建的数据(比如音频数据，电话本等)等。此外，内部存储器221可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。
手机200可以通过音频模块270，扬声器270A，受话器270B，麦克风270C，耳机接口270D，以及应用处理器等实现音频功能。例如音乐播放，录音等。
按键290包括开机键，音量键等。按键290可以是机械按键。也可以是触摸式按键。马达291可以产生振动提示。马达291可以用于来电振动提示，也可以用于触摸振动反馈。指示器292可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。SIM卡接口295用于连接SIM卡。SIM卡可以通过插入SIM卡接口295，或从SIM卡接口295拔出，实现和手机200的接触和分离。手机200可以支持1个或N个SIM卡接口，N为大于1的正整数。SIM卡接口295可以支持Nano SIM卡，Micro SIM卡，SIM卡等。
接下来，将以yoyo的手机1(手机1已开启查找设备功能)丢失后，通过手机2查找手机1的场景为例，对本申请提供的终端防盗方法进行详细介绍。其中，如图4所示，手机1与手机2分别与云服务器通信连接。
yoyo可预先开启手机1的查找设备功能。开启查找设备功能后，手机可对丢失的设备快速定位，在设备上播放铃声，并可设置丢失模式、擦除数据，以避免用户的隐私泄露。此外，手机还可以获取自身的状态和位置信息，以对其进行定位。示例性的，yoyo可通过图5A-图5D所示的界面开启手机1的查找设备功能。如图5A中的(a)所示，手机1可显示主界面501(或者桌面)，主界面501可包括设置选项502。手机1可接收用户对设置选项502的点击操作，响应于该操作，手机1可显示如图5A中的(b)所示的设置界面503。设置界面503可包括多个设置选项，例如WLAN、蓝牙、电池和安全504等。手机1可接收用户对安全504选项的点击操作，响应于该操作，手机1可显示如图5B中的(a)所示的界面505。界面505可包括多个关于设备安全的设置选项，例如查找设备506、SOS紧急求助、密码保险箱等。若用户希望开启查找设备功能，则可点击查找设备506的选项，响应于该操作，如图5B中的(b)所示，手机1可显示界面507。界面507可包括关于查找设备功能的相关说明，以及立即开启508的选项。手机1可接收用户点击立即开启508的选项的操作，响应于该操作，手机1可显示如图5C中的(a)所示的登录界面601。登录界面601包括信息输入区602及登录选项603。如图5C中的(b)所示，用户可在信息输入区602输入登录帐号(即第一帐号，例如为手机号“135****1234”)及验证码(例如“6512”)后，点击登录选项603。手机1接收到用户点击登录选项603的操作后，可向云服务器发送该手机号及验证码，由云服务器对手机号及验证码进行验证。云服务器验证成功后，可向手机1发送验证成功的消息。手机1接收该消息，显示如图5D中的(a)所示的查找设备界面701。查找设备界面701可包括状态提示信息702及查找我的手机选项703。状态提示信息702用于指示查找设备功能是否被开启。例如，如图5D中的(a)所示的状态提示信息702指示手机1未开启查找设备功能。若用户希望开启查找设备功能，则可点击查找我的手机选项703。手机检测到该操作后，可对手机1进行定位，并在查找设备界面701中显示标识有手机1具体位置的地图704(如图5D中的(b)所示)。需要说明的是，若手机1已经登录第一帐号，手机1接收到用户点击立即开启508的操作时，可跳过图5C所示的登录过程，直接显示如图5D中的(a)所示的查找设备界面701。
手机1开启查找设备功能后，可将服务标识设置为标识已开启查找设备功能的状态。在一种可能的设计中，服务标识可以为0或者1，若服务标识为0则表示设备未开启查找设备功能，若服务标识为1则表示设备已开启查找设备功能。如此，手机1开启查找设备功能后，可以将服务标识设置为1，并向第一TA发送存储服务标识以及第一帐号的请求。第一TA可接收该请求，并将服务标识以及第一帐号写入安全存储芯片，由安全存储芯片进行存储。
开启查找设备功能后，手机1还可获取自身的定位信息，向云服务器上传该定位信息。云服务器可接收该定位信息，并建立手机1、定位信息及第一帐号的绑定关系。其中，建立手机1、定位信息及第一帐号的绑定关系可指，云服务器可通过第一帐号查找到手机1的定位信息。
yoyo确认手机1丢失后，可在手机2上登录第一帐号，并将手机1的状态设置为丢失 模式。示例性的，如图6A中的(a)所示，yoyo的手机2登录第一帐号后，手机2可显示查找设备界面801。该查找设备界面801包括查看所有设备802这一选项。若用户希望查看第一帐号所关联的所有设备，可点击查看所有设备802。手机2检测到用户点击查看所有设备802的操作后，可在查找设备界面801中显示设备列表803(如图6A中的(b)所示)。设备列表803中可显示第一帐号绑定的所有设备(例如yoyo的手机1、手机2)的设备信息，设备信息可包括设备名称(例如，yoyo的手机1)、设备型号(例如，Honor magic3 Pro)、位置信息(例如，科技大厦)等。用户可从设备列表803包括的所有设备中选择需要进行控制的设备(例如，yoyo的手机1)，响应于用户选择yoyo的手机1的操作，手机2可在查找设备界面801显示如图6B中的(a)所示的控制栏804。控制栏804可显示手机1的具体位置(例如，四川省成都市高新区A街道科技大厦1栋)、电量情况、多个可用于控制手机1的控制选项等。其中，多个控制选项可包括丢失模式805、播放铃声、导航、擦除数据等。用户可点击丢失模式805的操作，响应于该操作，如图6B中的(b)所示，手机2可显示界面806。界面806包括关于对丢失模式的说明。示例性的，开启丢失模式后，用户可远程锁定并追踪丢失的设备(例如手机1)，以及在丢失设备的锁屏界面上留言，以便拾到者与失主联系。此外，界面806还包括继续选项807。手机2可以接收用户点击该继续选项807的操作，响应于该操作，手机2可显示设置锁屏信息界面808(如图6B中的(c)所示)。设置锁屏信息界面808用于设置手机1进入丢失模式后，显示在其锁屏界面上的信息，例如手机号、留言等。锁屏信息界面808可包括确认选项809，用户设置完毕后，可点击该确认选项809。手机2检测到用户点击该确认选项809后，可向云服务器发送将手机1设置为丢失模式的请求。云服务器接收该请求，根据第一帐号向手机1发送状态变更消息。手机1接收状态变更消息，将置丢标识设置为标识已开启丢失模式的状态。在一种可能的设计中，置丢标识可以为0或者1，若置丢标识为0则表示设备未进入置丢模式，若置丢标识为1则表示设备已进入置丢模式。如此，手机1接收状态变更消息后，可以将置丢标识设置为1，并将置丢标识写入安全存储芯片，由安全存储芯片进行存储。
可以理解地，安全存储芯片作为具有独立的处理器和防硬件攻击能力的硬件单元，普通的刷机或是恢复出厂设置的操作无法篡改或擦除安全存储芯片中存储的数据。因而通过安全存储芯片存储第一帐号、服务标识及置丢标识，可避免不法者篡改或擦除第一帐号及防盗标识。
在本申请实施例中，为加强终端设备的防盗系数，手机1进入丢失模式后，可从两个阶段进行防盗。两个阶段包括：开机向导阶段、正常开机运行阶段。下文将分别说明手机1在开机向导阶段以及正常开机运行阶段如何进行防盗。
(1)在开机向导阶段。
如图7所示，为手机1在开机向导阶段的防盗流程。该流程包括：在手机1被恢复出厂设置或者被刷机后重新开机，手机1进入开机向导。例如，手机1在接收到用户的开机操作后，可以检测固件版本是否发生变化。若固件版本发生变化，则认为手机1被刷机，进入开机向导。进入开机向导后，手机1可读取防盗标识。若防盗标识指示手机1未处于丢失状态，则手机1可直接正常开机，以完成恢复出厂设置或者刷机。若防盗标识指示手机1处于丢失状态，则手机1可显示激活锁界面(例如，可以为如图1所示的界面101)。 手机1可识别用户在激活锁界面的输入操作，并获取第二帐号。手机1可读取第一帐号，比对第一帐号与第二帐号是否一致。若第一帐号与第二帐号一致，手机1正常开机；若第一帐号与第二帐号不一致，手机1开机失败，无法完成恢复出厂设置或者刷机。
在开机向导阶段，手机1可显示不同的设置界面，引导用户对常用功能进行设置。常用功能可包括WIFI、联系人、登录帐号等。在手机1进入开机向导后，可通过读取防盗标识确认该手机1是否处于丢失模式。其中，手机1读取防盗标识的流程包括：第一CA向第一TA发送读取防盗标识的请求。第一TA接收该请求，从安全存储芯片中读取防盗标识并反馈给第一CA。第一CA可为预先部署于REE中的防盗CA，第一TA为预先部署于TEE中的防盗TA，通过第一CA与第一TA配合，可实现手机1的防盗业务。需要说明的是，手机1读取第一帐号的原理及流程与手机1读取防盗标识的原理及流程相同或相似，后文不再赘述。
进一步的，防盗标识包括服务标识及置丢标识。在一种可选的设计中，若服务标识为1且置丢标识为1，则可认为手机1处于丢失状态；若置丢标识为0(无论服务标识为1或者0)，可认为手机1并未处于丢失状态。换句话说，只有用户开启手机1的查找设备功能且成功将手机1设置为丢失模式后，才可认为手机1处于丢失状态。这种方式使得原主人自己正常对手机1进行刷机等操作时，可无需进行身份验证，既具备防盗效果又避免繁杂操作给用户带来不好的体验。
在实际操作中，只有在设备开启查找设备功能后，才能设置丢失模式。因此，在防盗标识未被修改的情况下，服务标识为0的情况下，置丢标识无法为1。在这种情况下，第一CA可先向第一TA发送读取服务标识的请求。在确认服务标识为1的情况下，再向第一TA发送读取置丢标识的请求，并进一步根据置丢标识为1或者0确认手机1是否处于丢失状态。
手机1确认自身处于丢失状态后，可显示激活界面。在一种可选的设计中，手机1可显示如图8A所示的激活界面801。该激活界面801可包括输入框802，输入框802用于供用户输入帐号及密码。示例性的，手机1的触摸传感器检测到用户在显示屏294上的触摸操作，向处理器210上报用户在显示屏294上的触摸位置信息，处理器210根据触摸传感器在预设时间段内上报的触摸位置信息，确定触摸操作为输入第二帐号及相应的密码。手机1获取用户输入的第二帐号及相应的密码后，可验证第二帐号与密码是否匹配。若第二帐号与密码不匹配，手机1可显示用于提示密码不正确的提示信息(图未示)。若第二帐号与密码匹配，手机1可进一步比对第一帐号与第二帐号是否一致。若第一帐号与第二帐号一致，手机1正常开机；若第一帐号与第二帐号不一致，手机1开机失败，无法完成恢复出厂设置或者刷机。
在另一种可选的设计中，手机1可显示如图8B所示的激活界面803。该激活界面803可包括提示信息804及输入框805。提示信息804用于提示用户该设备已与其他帐号(即第一帐号)关联且被激活锁锁定，请当前用户输入相应帐号信息以激活设备。该输入框805用于供用户输入所关联帐号(第一帐号)的密码。示例性的，手机1检测到用户输入的密码后，可验证该密码与第一帐号是否匹配。若该密码与第一帐号匹配，则手机1正常开机；若该密码与第一帐号不匹配，手机1开机失败，无法完成恢复出厂设置或者刷机。
这样一来，即使拾取者对拾取到的设备进行刷机或者恢复出厂设置的操作，在设备重 新开机后便会进入开机向导阶段，并通过激活锁验证用户的身份。若无法通过验证，则无法完成开机操作，阻止拾取者正常使用手机1，具备一定的防盗效果。
(2)在正常开机运行阶段。
在手机1正常开机运行后，手机1可以主动和/或被动启动防盗流程。其中，主动启动防盗流程可指，手机1可以定期读取防盗标识以检测自身是否处于丢失状态，若处于丢失状态则可验证用户身份，并在身份验证失败时锁定手机。被动防盗流程可指，手机1在检测到用户设置密码的操作时，可读取防盗标识以检测自己是否处于丢失状态，若处于丢失状态则可验证用户身份，并在身份验证失败时锁定手机。
请参阅图9，为手机1被动开启防盗流程的流程图。如图9所示，手机1可接收用户设置锁屏密码的操作，响应于该操作，手机1可先读取防盗标识。若防盗标识指示手机1未处于丢失状态，手机1可正常运行。若防盗标识指示手机1处于丢失状态，则手机1可读取第一帐号及第二帐号，并验证第二帐号与第一帐号是否一致。若第一帐号与第二帐号一致，则手机1正常运行；若第一帐号与第二帐号不一致，则手机1进入锁定状态，在解锁前无法为用户提供服务。在一种可选的实施方式中，防盗标识可包括服务标识及置丢标识，当服务标识及置丢标识均为1时，可认为手机处于丢失状态，手机1读取第一帐号及第二帐号。
需要说明的是，若手机1已经登录了帐号，则手机1可直接读取第二帐号。若手机1未登录第二帐号，手机1可显示登录界面供用户进行登录，以便获取第二帐号。其中，该登录界面与图5C所示的界面601类似，在此暂不赘述。在一种可选的设计中，手机1可以获取登录标识。该登录标识可用于指示手机1是否登录账号。例如，登录标识可以为0或者1，登录标识为1可指示手机1已登录帐号，登录标识为0可指示手机1未登录帐号。
示例性的，如图10A所示，手机1可显示锁屏密码的界面1001。该界面1001包括设置锁屏密码的选项1002。手机1可接收用户点击该选项1002的操作，响应于该操作，手机1可读取防盗标识。若防盗标识指示手机1处于非丢失状态，或者防盗标识指示手机1处于丢失状态且第二帐号与第一帐号一致，则手机1可显示如图10B所示的界面1003，该界面1003用于供用户设置锁屏密码。若防盗标识指示手机1处于丢失状态且第二帐号与第一帐号不一致，则手机1可显示如图10C中的(a)所示的激活锁界面1004，该激活锁界面1004用于提示手机1当前的使用者尽快将手机1归还给原主人。手机1可接收用户滑动该激活锁界面1004的操作，响应于该操作，手机1可显示如图10C中的(b)所示的界面1005。该界面1005用于供用户输入密码。
可以理解地，由于用户越来越注重隐私，无论是手机1的原主人，还是手机1的拾取者，都很可能给手机1设置锁屏密码。因此，通过设置锁屏密码来触发手机1验证防盗标识及用户身份，并在身份验证失败时锁定手机，可一定程度避免手机1的拾取者正常使用手机1，存在良好的防盗效果。
需要说明的是，上述的锁屏密码仅以数字密码为例进行说明。实际上，锁屏密码还可包括生物识别信息(例如指纹、人脸、虹膜等)等。
请参阅图11，为手机1主动开启防盗流程的流程图。如图11所示，手机1可定期读取防盗标识。若防盗标识指示手机1未处于丢失状态，手机1可正常运行。若防盗标识指示手机1处于丢失状态，则手机1可读取第一帐号并验证第二帐号与第一帐号是否一致。 若第一帐号与第二帐号一致，手机1正常运行；若第一帐号与第二帐号不一致，手机1进入锁定状态，在解锁前无法为用户提供服务。在一种可选的实施方式中，防盗标识可包括服务标识及置丢标识，当服务标识及置丢标识均为1时，可认为手机处于丢失状态，手机1读取第一帐号及第二帐号。若第一帐号与第二帐号一致，则手机1正常运行；若第一帐号与第二帐号不一致，则手机1进入锁定状态，在解锁前无法为用户提供服务。
可以理解地，考虑到一些用户(包括手机1的原主人、手机1的拾取者)可能并不会设置锁屏密码，则通过设置锁屏密码触发的防盗流程则达不到防盗效果，因此手机1还可以主动定期读取防盗标识，一旦确认手机1处于丢失状态则需要验证用户身份，并在身份验证失败时锁定。这又进一步增强了终端设备的防盗系数。
这样一来，即使拾取者通过一些刷机手段使终端设备被刷机后无需进入开机向导阶段，直接开机。终端设备也会在正常开机后读取防盗标识，并在防盗标识指示终端设备可能被丢失时验证用户身份。若验证结果为验证失败，则终端设备进入锁定状态，使用户无法正常使用终端设备，具备一定的防盗效果。
需要说明的是，在图9及图11所示的防盗流程中，手机1可在确认服务标识为1且置丢标识为1时，获取第一帐号及第二帐号，并进一步验证第二帐号与第一帐号是否一致。在这种情况下，第一CA可先向第一TA发送读取服务标识的请求。在确认服务标识为1的情况下，再向第一TA发送读取置丢标识的请求，并进一步根据置丢标识为1或者0确认手机1是否处于丢失状态。此外，由于这种方式只有原主人开启手机1的查找设备功能且将手机1置丢后，手机1才可会进行身份验证。换句话说，原主人未将手机1置丢时，可按正常使用设备，无需进行身份验证。可见，这种方式既具备防盗效果又能够避免繁杂操作给用户带来不好的体验。
前述内容说明了手机1在进入丢失模式(即服务标识为1且置丢标识为1)后，可在开机向导阶段或者正常开机运行阶段对用户进行身份验证。在实际应用时，常常存在手机1的原主人未及时将手机1设置为丢失模式(例如，原主人在拾取者将手机1关机后再将其设置为丢失模式)，导致手机1无法及时更新置丢标识，从而达不到防盗效果的问题。因此，在一种可选的设计中，可以在服务标识为1(无论置丢标识是否为1)时，认为手机1处于丢失状态。示例性的，若在开机向导阶段，手机1可在确认服务标识为1时显示激活锁界面，并验证用户身份。若在正常运行阶段，手机1可在确认服务标识为1时读取第一帐号及第二帐号，并进一步比对第一帐号与第二帐号是否一致。可见，手机1可在开启查找设备功能后，便开启手防盗流程，避免由于原主人未及时置丢导致手机1不具备防盗效果的问题。
在另一种可能的设计中，手机1还可在服务标识为0时在开机向导阶段，显示激活锁界面以验证用户身份。换句话说，即使手机1未用开启查找设备功能，手机1也可在开机向导阶段启动防盗流程，这样可以最大限度地达到防盗的效果。
综上所述，本申请提供的终端防盗方法，可在终端设备被丢失时，验证第二帐号与第一帐号是否一致。若第一帐号与第二帐号不一致，则终端设备进入锁定状态，限制当前使用者继续使用该终端设备。可见，终端设备在开机运行时也可读取防盗标识并进行身份验证，可使终端设备即使被刷机后也需要在身份验证成功后才能被正常使用，进一步提升终端设备的防盗系数。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：快闪存储器、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请实施例的具体实施方式，但本申请实施例的保护范围并不局限于此，任何在本申请实施例揭露的技术范围内的变化或替换，都应涵盖在本申请实施例的保护范围之内。因此，本申请实施例的保护范围应以所述权利要求的保护范围为准。

Claims (11)

  1. 一种终端防盗方法，其特征在于，应用于终端设备，所述终端设备包括安全存储芯片，所述方法包括：
    若所述终端设备处于开机运行状态，所述终端设备读取防盗标识，所述防盗标识存储于所述安全存储芯片；
    当所述防盗标识指示所述终端设备处于丢失状态时，所述终端设备从所述安全存储芯片读取第一账号，所述第一帐号为所述终端设备关联的账号；
    所述终端设备获取第二帐号，所述第二帐号为所述终端设备当前登录的帐号；
    所述终端设备确定所述第一账号与所述第二账号是否一致；
    若所述第一帐号与所述第二帐号不一致，所述终端设备显示第一界面，所述第一界面指示所述终端设备已锁定。
  2. 根据权利要求1所述的终端防盗方法，其特征在于，所述终端设备读取防盗标识，包括：
    响应于用户修改锁屏密码的操作，所述终端设备读取所述防盗标识。
  3. 根据权利要求1所述的终端防盗方法，其特征在于，所述终端设备读取防盗标识，包括：
    所述终端设备按照预设的时间间隔读取所述防盗标识。
  4. 根据权利要求1-3中任意一项所述的终端防盗方法，其特征在于，所述方法还包括：
    响应于所述终端设备进入开机向导，所述终端设备读取所述防盗标识。
  5. 根据权利要求1-4中任意一项所述的终端防盗方法，其特征在于，所述终端设备获取第二帐号包括：
    所述终端设备获取登录标识；
    若所述登录标识指示所述终端设备未登录帐号，所述终端设备显示第二界面；
    响应于用户在所述第二界面的输入操作，所述终端设备获取所述第二帐号。
  6. 根据权利要求5所述的终端防盗方法，其特征在于，所述方法还包括：
    若所述登录标识指示所述终端设备已登录帐号，所述终端设备读取所述第二帐号。
  7. 根据权利要求1-6中任意一项所述的终端防盗方法，其特征在于，所述方法还包括：
    响应于接收到用户滑动所述第一界面的操作，所述终端设备显示第三界面，所述第三界面用于供用户输入所述第一帐号匹配的密码。
  8. 根据权利要求1-6中任意一项所述的终端防盗方法，其特征在于，所述方法还包括：
    若所述第一帐号与所述第二帐号一致，所述终端设备重置所述防盗标识。
  9. 根据权利要求1-6中任意一项所述的终端防盗方法，其特征在于，所述防盗标识包括第一标识及第二标识，所述第一标识用于指示终端设备是否开启第一功能，所述第一功能为所述终端设备实时向云服务器上传定位信息的功能，所述第二标识用于指示所述终端设备是否被置丢；
    若所述第一标识指示所述终端设备已开启第一功能，所述终端设备处于丢失状态；
    或者，若所述第一标识指示所述终端设备已开启第一功能且所述第二标识指示所述终端设备被置丢，所述终端设备处于丢失状态。
  10. 一种终端设备，其特征在于，包括安全存储芯片和处理器，所述处理器和存储器耦 合，所述存储器存储有程序指令，当所述存储器存储的程序指令被所述处理器执行时使得所述终端设备实现权利要求1-9中任一项所述的方法。
  11. 一种计算机可读存储介质，其特征在于，包括计算机指令；
    当所述计算机指令在终端设备上运行时，使得所述终端设备执行如权利要求1-9中任一项所述的方法。
PCT/CN2023/070550 2022-01-10 2023-01-04 终端防盗方法及终端设备 WO2023131209A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP23737072.1A EP4290844A4 (en) 2022-01-10 2023-01-04 ANTI-THEFT METHOD FOR TERMINAL AND TERMINAL DEVICE
US18/282,150 US20240054208A1 (en) 2022-01-10 2023-01-04 Terminal anti-theft method and terminal device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210022827.7 2022-01-10
CN202210022827.7A CN116456023A (zh) 2022-01-10 2022-01-10 终端防盗方法及终端设备

Publications (2)

Publication Number Publication Date
WO2023131209A1 true WO2023131209A1 (zh) 2023-07-13
WO2023131209A9 WO2023131209A9 (zh) 2023-12-14

Family

ID=87073176

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/070550 WO2023131209A1 (zh) 2022-01-10 2023-01-04 终端防盗方法及终端设备

Country Status (4)

Country Link
US (1) US20240054208A1 (zh)
EP (1) EP4290844A4 (zh)
CN (1) CN116456023A (zh)
WO (1) WO2023131209A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117177246B (zh) * 2023-10-25 2024-04-12 荣耀终端有限公司 一种用于锁死电子设备的方法、电子设备及服务器

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102857913A (zh) * 2011-06-28 2013-01-02 中国移动通信集团公司 在建立安全信道时进行鉴权的方法、装置、智能卡及终端
US20150242644A1 (en) * 2014-02-25 2015-08-27 Samsung Electronics Co., Ltd. Apparatus and method for an antitheft secure operating system module
CN107613493A (zh) * 2017-08-02 2018-01-19 捷开通讯(深圳)有限公司 智能终端及其防盗的方法、具有存储功能的装置
CN107734176A (zh) * 2017-10-25 2018-02-23 深圳市金立通信设备有限公司 移动终端的丢失保护方法、终端及计算机可读存储介质
WO2019061525A1 (zh) * 2017-09-30 2019-04-04 深圳传音通讯有限公司 移动终端的防盗处理方法、移动终端及可读存储介质
CN110851881A (zh) * 2019-10-31 2020-02-28 成都欧珀通信科技有限公司 终端设备的安全检测方法及装置、电子设备及存储介质

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018099485A1 (zh) * 2016-12-02 2018-06-07 华为技术有限公司 一种保障终端安全的方法和设备
CN110598384B (zh) * 2019-09-16 2022-02-22 Oppo（重庆）智能科技有限公司 信息保护方法、信息保护装置及移动终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102857913A (zh) * 2011-06-28 2013-01-02 中国移动通信集团公司 在建立安全信道时进行鉴权的方法、装置、智能卡及终端
US20150242644A1 (en) * 2014-02-25 2015-08-27 Samsung Electronics Co., Ltd. Apparatus and method for an antitheft secure operating system module
CN107613493A (zh) * 2017-08-02 2018-01-19 捷开通讯(深圳)有限公司 智能终端及其防盗的方法、具有存储功能的装置
WO2019061525A1 (zh) * 2017-09-30 2019-04-04 深圳传音通讯有限公司 移动终端的防盗处理方法、移动终端及可读存储介质
CN107734176A (zh) * 2017-10-25 2018-02-23 深圳市金立通信设备有限公司 移动终端的丢失保护方法、终端及计算机可读存储介质
CN110851881A (zh) * 2019-10-31 2020-02-28 成都欧珀通信科技有限公司 终端设备的安全检测方法及装置、电子设备及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4290844A4

Also Published As

Publication number Publication date
EP4290844A4 (en) 2024-01-17
US20240054208A1 (en) 2024-02-15
CN116456023A (zh) 2023-07-18
WO2023131209A9 (zh) 2023-12-14
EP4290844A1 (en) 2023-12-13

Similar Documents

Publication Publication Date Title
CN111444528B (zh) 数据安全保护方法、装置及存储介质
KR102503341B1 (ko) 보안 서비스 삭제 방법 및 전자 장치
US10810811B2 (en) Electronic device and method for managing electronic key thereof
US11485320B2 (en) Method and apparatus for vehicle function control, and storage medium
CN113259301B (zh) 一种账号数据共享方法及电子设备
WO2021121273A1 (zh) 认证方法及其介质和电子设备
US20230094172A1 (en) Cross-Device Application Invoking Method and Electronic Device
KR20210035883A (ko) 서비스 처리 방법 및 디바이스
CN111373379A (zh) 一种数据备份方法及终端
CN114840842A (zh) 智能终端的登录方法及电子设备
WO2023131209A1 (zh) 终端防盗方法及终端设备
CN113641967B (zh) 一种可穿戴设备解锁终端设备的方法及通信系统
EP4280646A1 (en) In-vehicle infotainment product connection method and apparatus
CN113196236A (zh) 一种跨设备认证方法及电子设备
CN110752929B (zh) 应用程序的处理方法及相关产品
WO2022135215A1 (zh) 一种开机异常的修复方法及装置
CN116484431B (zh) 一种数据保护方法、电子设备及存储介质
US20140373185A1 (en) Anti-theft Method and Computer System thereof
CN112966297B (zh) 数据保护方法、系统、介质及电子设备
CN114756849B (zh) 一种验证个人身份识别码pin码的方法和装置
WO2022165939A1 (zh) 一种跨设备认证方法及电子设备
CN116485403A (zh) 一种支付方法及电子设备
WO2019024006A1 (zh) 一种用于智能设备的应用程序的启动方法及启动装置
CN113691671B (zh) 安全信息的开放方法、系统及电子设备
WO2022143136A1 (zh) 一种密码重置的方法、装置和电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23737072

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023737072

Country of ref document: EP

Effective date: 20230905

WWE Wipo information: entry into national phase

Ref document number: 18282150

Country of ref document: US