A method for deleting a security element application corresponding to a security service and an electronic device

Abstract

A method for deleting a security service and an electronic device, relating to the field of communication technology, can delete a security element application corresponding to a security service in an SE, avoid potential security risks caused by the security element application remaining in the SE, and improve the security of the electronic device. The method comprises: the electronic device receives an instruction to clear data or restore factory settings, and sets a first identifier according to the instruction; shuts down or restarts; if the electronic device is turned on or connected to the network, reads the first identifier; if the first identifier is set, sends a first request to a server, requesting the server to delete the security service in the SE; receives a first command sent by the server; the first command is for instructing the electronic device to delete a target security service in the SE, and the target security service is determined by the server according to the security services installed in the SE and a deletable list of security services stored by the server; the electronic device deletes the security element application corresponding to the target security service in the SE according to the first command.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and electronic device for deleting a security element application corresponding to a security service. Background Art

[0002] Electronic devices have three layers of application environments, namely Rich Execution Environment (REE), Trust Execution Environment (TEE) and Secure Element (SE). Among them, because the software system in SE is simple and the hardware components are relatively few, it is easy to establish physical protection and implement security assurance, thereby improving the security strength of SE, so that it can serve security systems with higher security requirements.

[0003] Specifically, the Secure Domain (SD) in SE is mainly used to manage applications (applets) in SE. During the process of applet downloading and deletion, it is responsible for providing security control functions such as secure communication and identity authentication. SD specifically includes the Issuer Secure Domain (ISD) (or primary security domain) and the Supplementary Security Domain (SSD). ISD is used by the SE issuer to manage all applets on SE, including creating SSD for the business party's applets. The created SSD is specifically used to manage the business party's applets.

[0004] For example: users can download the installation package from the application market and install a banking APP on the electronic device. Users can use the banking APP to handle related banking business. Among them, the banking APP also has the function of installing a mobile phone shield. Then, the user can install the mobile phone shield by operating the corresponding option. In order to ensure the data security of the mobile phone shield, the electronic device will install the data with high security requirements in the mobile phone shield into the SE in the form of an applet. During installation, the electronic device will first apply for SSD from the server of the issuer of SE (the manufacturer of the electronic device) through the server of the business party (bank), and install the applet of the mobile phone shield in the SSD to manage the data with high security requirements in the mobile phone shield.

[0005] When users no longer need to use a security service, they usually delete the APP of the security service directly. At this time, the electronic device only deletes the APP of the security service at the application layer, but does not delete the applet in the SE or the SSD in the SE. In this case, for some security services (such as smart keys, access cards, etc.), the applet remaining in the SE can still interact directly with the external card reader through near field communication (NFC), and can complete the corresponding functions without going through REE and TEE, which poses a security risk. Summary of the invention

[0006] The present application provides a method for deleting a security element application corresponding to a security service and an electronic device. The electronic device can delete the security element application (applet) corresponding to the security service in the SE, avoid the security risks that may be caused by the security element application remaining in the SE, and improve the security of the electronic device.

[0007] In a first aspect, a method for deleting a security service provided by the present application can be applied to an electronic device, wherein the electronic device has a security element SE, and the method comprises:

[0008] The electronic device receives an instruction to clear data or restore factory settings, and sets a first identifier according to the instruction; the electronic device is shut down or restarted; if it is detected that the electronic device is turned on or connected to the Internet, the electronic device reads the first identifier; if the first identifier is set, the electronic device sends a first request to the server; the first request is used to request the server to delete the security service in SE; the electronic device receives a first command sent by the server; the first command is the server instructing the electronic device to delete the target security service in SE according to the first request, and the target security service is determined by the server according to the security services installed in SE and the deletable list of security services stored on the server; the electronic device deletes the security element application corresponding to the target security service in SE according to the first command.

[0009] Exemplarily, after receiving an operation in which the user selects to restore factory settings (selecting the option to restore factory settings in the system settings, or pressing and holding the power button and the volume up button (or down button) at the same time, etc.), the electronic device can write an operation identifier, which is used to prompt the electronic device to restart into recovery mode and instruct the electronic device to restore factory settings or clear data.

[0010] Exemplarily, the deletable list is pre-negotiated by the issuer of the SE and the security service provider. When the electronic device clears data or restores factory settings, the TSM of the SE issuer can delete the applet and SSD corresponding to the security service in the SE.

[0011] It can be seen from this that when an electronic device clears data or restores factory settings, the electronic device can request the server to delete the applet corresponding to the security service in SE, which can avoid security risks caused by applets left in SE for security services (for example, smart keys, access cards, etc.) and improve the security of the electronic device.

[0012] In a possible implementation, the method further includes: the electronic device deleting the auxiliary security domain SSD corresponding to the target security service in the SE according to the first command.

[0013] Furthermore, when the electronic device clears data or restores factory settings, the electronic device can also delete the SSD corresponding to the security service according to the command of the server, which is conducive to reclaiming the space of the SE and improving the space utilization of the SE.

[0014] In a possible implementation, the first identifier is stored in the electronic device trusted execution environment TEE, or stored in the SE. In this way, the electronic device will not clear the first identifier when clearing data or restoring factory settings, so that after the electronic device clears data or restores factory settings, the security service can be deleted according to the first identifier.

[0015] In a possible implementation, the first identifier is stored in a first area in the TEE of the electronic device, and the first area is an area that is not deleted after the electronic device clears data or restores factory settings.

[0016] In a possible implementation, the method further includes: if the electronic device receives an instruction to clear data or restore factory settings, the electronic device disables a near field communication (NFC) function of a security element application in the electronic device.

[0017] Considering that the method provided in the embodiment of the present application is to delete the SSD and applet of the security service according to the to-be-deleted mark after the mobile phone is restarted or connected to the Internet. Therefore, before the electronic device deletes the security service SSD and applet, some applets of security services (for example: car keys, access cards, bus cards, etc.) can still interact directly with external card readers through NFC to complete corresponding functions, which poses a security risk. Therefore, after the electronic device receives an instruction to clear data or restore factory settings, disabling the near-field communication NFC function of the security element application in the electronic device is beneficial to improving the security of the electronic device.

[0018] In one possible implementation, the method also includes: if the electronic device receives an instruction to clear data or restore factory settings, the electronic device sets a second identifier, and when the second identifier is set, the trusted application TA that manages SE in the TEE in the electronic device denies the service TA's access to the SE.

[0019] Considering that before the electronic device deletes the security service SSD and applet, some security service applets (for example, the mobile phone shield applet) may still be called by TEE, which poses a security risk. Therefore, after the electronic device receives the instruction to clear data or restore factory settings, the trusted application TA that manages SE in the TEE of the electronic device denies the service TA's access to SE, which is conducive to improving the security of the electronic device.

[0020] In a possible implementation, the second identifier is stored in a second area in the TEE of the electronic device, and the second area is an area that is not deleted after the electronic device clears data or restores factory settings.

[0021] In a possible implementation, after the electronic device deletes the security element application or SSD corresponding to the target security service in the SE according to the first command, the method for deleting the security service further includes: the electronic device clearing the second identifier.

[0022] Among them, the second identification is an identification that prohibits TEE from accessing SE. After the electronic device deletes the security service, the authority of TEE to access SE can be restored to ensure the normal use of the electronic device.

[0023] In a possible implementation, the method further includes: the electronic device reporting to the server the SSD corresponding to the security service installed in the SE, and the security element application installed in the SSD corresponding to the installed security service.

[0024] Since the SE's TSM is responsible for creating SSDs for security services in the SE, and the service's TSM specifically installs the security service's applet in the SSD, the SE's TSM is not aware of the installation status of the applets in the SSD. According to the basic international standard of SE (Global Platform, GP), when the SE's TSM deletes the SSD for security services, it must first delete the applet in the SSD. Therefore, the SE's TSM needs to synchronize data with the SE to obtain the information of the applet in each SSD in the SE in order to delete the applet and SSD.

[0025] In a possible implementation, after the electronic device deletes the security element application or SSD corresponding to the target security service according to the first command, the method for deleting the security service further includes: the electronic device clearing the first identifier.

[0026] After the electronic device deletes the security service, the first identification is cleared to prevent the electronic device from executing the process of deleting the security service again when it is turned on or connected to the Internet.

[0027] In a second aspect, an electronic device includes: a processor, a memory and a touch screen, wherein the memory and the touch screen are coupled to the processor, the memory is used to store computer program codes, and the computer program codes include computer instructions. When the processor reads the computer instructions from the memory, the electronic device performs the following operations:

[0028] Receive an instruction to clear data or restore factory settings, and set a first identifier according to the instruction; shut down or restart; if it is detected that the electronic device is turned on or connected to the Internet, read the first identifier; if the first identifier is set, send a first request to the server; the first request is used to request the server to delete the security service in SE; receive a first command sent by the server; the first command is the server instructing the electronic device to delete the target security service in SE according to the first request, and the target security service is determined by the server based on the security services installed in SE and the deletion list of the security services stored by the server; according to the first command, delete the security element application corresponding to the target security service in SE.

[0029] A possible implementation manner further includes: deleting the auxiliary security domain SSD corresponding to the target security service in the SE according to the first command.

[0030] In a possible implementation, the first identifier is stored in a trusted execution environment TEE of the electronic device, or in an SE.

[0031] In a possible implementation, the first identifier is stored in a first area in the TEE of the electronic device, and the first area is an area that is not deleted after the electronic device clears data or restores factory settings.

[0032] A possible implementation manner further includes: if the electronic device receives an instruction to clear data or restore factory settings, disabling a near field communication (NFC) function of a security element application in the electronic device.

[0033] A possible implementation method also includes: if the electronic device receives an instruction to clear data or restore factory settings, a second identifier is set. When the second identifier is set, the trusted application TA that manages SE in the TEE in the electronic device denies the service TA's access to the SE.

[0034] In a possible implementation, the second identifier is stored in a second area in the TEE of the electronic device, and the second area is an area that is not deleted after the electronic device clears data or restores factory settings.

[0035] In a possible implementation, after the electronic device deletes the secure element application or SSD corresponding to the target secure service in the SE according to the first command, the second identifier is cleared.

[0036] In a possible implementation, the SSD corresponding to the security service installed in the SE and the security element application installed in the SSD corresponding to the installed security service are reported to the server.

[0037] In a possible implementation, after the electronic device deletes the security element application or SSD corresponding to the target security service according to the first command, the first identifier is cleared.

[0038] In a third aspect, a computer storage medium includes computer instructions. When the computer instructions are executed on a terminal, the terminal executes the method described in the first aspect and any possible implementation thereof.

[0039] A fourth aspect is a computer program product. When the computer program product is run on a computer, it enables the computer to execute the method as described in the first aspect and any possible implementation thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of a method for deleting a security service in an SE provided in an embodiment of the present application;

[0041] Figure 2 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0042] Figure 3 A schematic diagram of the structure of another electronic device provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of a method for setting a to-be-deleted flag provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of another method for setting a to-be-deleted flag provided in an embodiment of the present application;

[0045] Figure 6 A schematic diagram of another method for deleting a security service in an SE provided in an embodiment of the present application;

[0046] Figure 7 A schematic diagram of another method for deleting a security service in a SE provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] Usually, when a business deploys a security service that is highly secure and closely related to personal funds or identity (for example: smart keys, mobile phone shields, bank cards, bus cards, access cards), it is necessary to deploy corresponding applications in three-layer application environments according to the security levels of different data in the security service. Among them, the application in REE is called client application (CA), which has lower security requirements. The application in TEE is a trusted application, called TA (TEE application), which has higher security requirements. The application in SE is called secure element application (applet), and the security requirements are the highest among these three types of applications.

[0048] Among these security services, some applets of security services (such as mobile phone shield, etc.) need to be called through REE and TEE to complete the corresponding functions. Some applets of security services (such as smart keys, access control cards, etc.) can directly interact with external card readers through near field communication technology (NFC), and can complete the corresponding functions without going through REE and TEE.

[0049] In the prior art, users usually delete these security services by operating the APP of the electronic device. One situation is that the electronic device directly deletes the APP of the security service at the application layer, but does not delete the applet in SE or the SSD in SE. This is because the applet of the security service is installed and deleted by the TSM of the business party, and the electronic device cannot delete the applet of the security service by itself. However, after the user deletes the APP of the security service, the TSM of the business party has no motivation to delete the applet of the security service in SE, that is, it will not actively delete the applet of the security service in SE. This is because if the applet of the security service in SE is not deleted, and the SSD in the applet is not deleted, then when the electronic device installs the APP of the security service again, it can no longer apply for SSD from the TSM of the issuer of SE. In this case, for some security services (such as smart keys, access control cards, etc.), the applet left in SE can still interact directly with the external card reader through NFC, and the corresponding functions can be completed without going through REE and TEE, which poses a security risk.

[0050] Another situation is that even if the business side's TSM is motivated or willing to actively delete the applet of the security service in SE after the user deletes the security service APP, there is still the problem that the business side's TSM cannot sense whether the user has deleted the security service APP, and thus cannot delete the applet of the security service in SE, and therefore cannot delete the SSD.

[0051] In another case, the business party's TSM can sense that the user has deleted the security service APP. For example: after the user operates the APP of the electronic device, the APP of the electronic device can interact with the business party's Trusted Service Management (TSM), and the business party's TSM can delete the applet of the security service in the SE through the Over the Air Technology (OTA) technology. However, since the SSD corresponding to the security service is created and deleted by the SE issuer (usually the SE issuer's TSM, hereinafter referred to as SE's TSM), the business party's TSM still cannot delete the SSD of the security service by itself.

[0052] In summary, even after the business side's TSM deletes the applet of the security service, there is no way to delete the SSD of the security service, resulting in unused SSDs remaining in the SE, causing waste of SE space.

[0053] At present, based on the above reasons, when an electronic device is restored to factory settings, the applications of the electronic device in REE and TEE will be deleted, but the applets and SSD in SE will not be deleted. Therefore, the method provided in the embodiment of the present application can delete the applets and SSD of the cleaned-up security services when the electronic device is restored to factory settings, which is conducive to reclaiming space in SE and improving the space utilization of SE.

[0054] In the embodiment of the present application, the TSM of the SE can pre-negotiate with the TSM of the business party whether the TSM of the SE can delete the applet and SSD in the SE when the electronic device is restored to factory settings. For the applet and SSD that the business party allows to be deleted, the applet and SSD in the electronic device SE are deleted together when the electronic device is restored to factory settings.

[0055] like Figure 1 As shown, it is a schematic diagram of a method for deleting a security service provided by an embodiment of the present application. Specifically, when the electronic device enters recovery mode and the electronic device indicates to restore factory settings or clear data, the deletion flag is set. Then, when it is detected that the electronic device is turned on or connected to the Internet, the deletion flag is read. If the deletion flag is set, the TSM of the SE is notified, and the TSM of the SE deletes the applet and SSD of the security service in the SE.

[0056] Among them, recovery is a backup function of an electronic device, which can modify the data inside the electronic device or the system of the electronic device. In this mode, the electronic device can clear data or restore factory settings (wipedata / factory reset). In this mode, the electronic device can also back up or upgrade the existing system, for example: backup and restore the system (backup and restore), install the update.zip upgrade package in the memory card (applySDcard: update.zip), install the zip upgrade package from the SDcard (install zip from SDcard), etc. The method for setting the deletion mark provided in the embodiment of the present application is performed in the process of clearing data or restoring factory settings of the electronic device. Since the process of clearing data or restoring factory settings of the electronic device is performed in the recovery mode, the operations that can be performed by the electronic device are limited, which is conducive to ensuring the safety of the electronic device.

[0057] In some embodiments of the present application, when the electronic device enters the recovery mode, the application of the security service can also be disabled. Then, when the electronic device is turned on or connected to the network, before the electronic device deletes the applet of the security service and the SSD, it can be ensured that the applet of the security service is not called, thereby ensuring the security of the electronic device.

[0058] After the electronic device deletes the SSD of the security service in the SE, the deletion flag is cleared to avoid the electronic device from repeating the deletion process when it is turned on or connected to the network again after deleting the SSD of the security service.

[0059] Exemplarily, the electronic device in the present application may be a mobile phone, a tablet computer, a personal computer (PC), a personal digital assistant (PDA), a smart watch, a netbook, a wearable electronic device, an augmented reality (AR) device, a virtual reality (VR) device, a vehicle-mounted device, a smart car, a smart speaker, a robot, etc. The present application does not impose any special restrictions on the specific form of the electronic device.

[0060] Figure 2 A schematic structural diagram of an electronic device 100 is shown.

[0061] The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0062] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or separate some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0063] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0064] The controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0065] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0066] In some examples of the present application, the processor 110 includes three hardware-independent units, specifically a baseband processing unit, an application processing unit, and a security unit. Among them, the baseband processing unit may be, for example, a baseband processor (Baseband Processor, BP), the application processing unit may be, for example, an application processor (Application Processor), and the security unit may be, for example, a secure element (Secure Element, SE). Among them, the SE may install an SSD for security services in the SE according to the instructions of the TSM (the server of the electronic equipment manufacturer) of the SE issuer. The SE may also install an applet for security services in the SSD according to the instructions of the TSM (the server of the service party) of the security service party.

[0067] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0068] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces. For example: the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 communicates with the touch sensor 180K through the I2C bus interface, thereby realizing the touch function of the electronic device 100.

[0069] The I2S interface can be used for audio communication. In some embodiments, the processor 110 can include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to achieve communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 via the I2S interface to achieve the function of answering a call through a Bluetooth headset.

[0070] The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via a PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface to realize the function of answering calls via a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0071] The UART interface is a universal serial data bus for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, the UART interface is generally used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 through the UART interface to implement the function of playing music through a Bluetooth headset.

[0072] The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to implement the shooting function of the electronic device 100. The processor 110 and the display screen 194 communicate via the DSI interface to implement the display function of the electronic device 100.

[0073] The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the camera 193, the display 194, the wireless communication module 160, the audio module 170, the sensor module 180, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc.

[0074] The USB interface 130 is an interface that complies with the USB standard specification, and specifically can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transfer data between the electronic device 100 and a peripheral device. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other electronic devices, such as AR devices, etc.

[0075] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present invention is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0076] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the electronic device 100. While the charging management module 140 is charging the battery 142, it may also power the electronic device through the power management module 141.

[0077] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0078] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0079] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0080] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0081] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 150 or other functional modules.

[0082] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0083] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0084] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0085] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0086] The electronic device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0087] ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193.

[0088] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0089] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the electronic device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0090] Video codecs are used to compress or decompress digital videos. The electronic device 100 may support one or more video codecs. Thus, the electronic device 100 may play or record videos in a variety of coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0091] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and can also continuously self-learn. Through NPU, applications such as intelligent cognition of electronic device 100 can be realized, such as image recognition, face recognition, voice recognition, text understanding, etc.

[0092] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0093] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0094] The electronic device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0095] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0096] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0097] The receiver 170B, also called a "earpiece", is used to convert audio electrical signals into sound signals. When the electronic device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the human ear.

[0098] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to microphone 170C to input the sound signal into microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In other embodiments, the electronic device 100 can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C to collect sound signals, reduce noise, identify the sound source, realize directional recording function, etc.

[0099] The earphone interface 170D is used to connect a wired earphone and can be a USB interface 130 or a 3.5 mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0100] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The electronic device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 194, the electronic device 100 detects the touch operation intensity according to the pressure sensor 180A. The electronic device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.

[0101] The gyro sensor 180B can be used to determine the motion posture of the electronic device 100. In some embodiments, the angular velocity of the electronic device 100 around three axes (i.e., x, y, and z axes) can be determined by the gyro sensor 180B. The gyro sensor 180B can be used for anti-shake shooting. For example, when the shutter is pressed, the gyro sensor 180B detects the angle of the electronic device 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the electronic device 100 through reverse movement to achieve anti-shake. The gyro sensor 180B can also be used for navigation and somatosensory game scenes.

[0102] The air pressure sensor 180C is used to measure air pressure. In some embodiments, the electronic device 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.

[0103] The magnetic sensor 180D includes a Hall sensor. The electronic device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the electronic device 100 is a flip phone, the electronic device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. Then, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, the flip cover can be automatically unlocked.

[0104] The acceleration sensor 180E can detect the magnitude of the acceleration of the electronic device 100 in all directions (generally three axes). When the electronic device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the electronic device and is applied to applications such as horizontal and vertical screen switching and pedometers.

[0105] The distance sensor 180F is used to measure the distance. The electronic device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the electronic device 100 can use the distance sensor 180F to measure the distance to achieve fast focusing.

[0106] The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The electronic device 100 emits infrared light outward through the light emitting diode. The electronic device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device 100. When insufficient reflected light is detected, the electronic device 100 can determine that there is no object near the electronic device 100. The electronic device 100 can use the proximity light sensor 180G to detect that the user holds the electronic device 100 close to the ear to talk, so as to automatically turn off the screen to save power. The proximity light sensor 180G can also be used in leather case mode and pocket mode to automatically unlock and lock the screen.

[0107] The ambient light sensor 180L is used to sense the ambient light brightness. The electronic device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the electronic device 100 is in a pocket to prevent accidental touches.

[0108] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0109] The temperature sensor 180J is used to detect temperature. In some embodiments, the electronic device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold, the electronic device 100 reduces the performance of a processor located near the temperature sensor 180J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the electronic device 100 heats the battery 142 to avoid abnormal shutdown of the electronic device 100 due to low temperature. In other embodiments, when the temperature is lower than another threshold, the electronic device 100 performs a boost on the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature.

[0110] The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the electronic device 100, which is different from the position of the display screen 194.

[0111] The bone conduction sensor 180M can obtain a vibration signal. In some embodiments, the bone conduction sensor 180M can obtain a vibration signal of a vibrating bone block of the vocal part of the human body. The bone conduction sensor 180M can also contact the human pulse to receive a blood pressure beat signal. In some embodiments, the bone conduction sensor 180M can also be set in an earphone and combined into a bone conduction earphone. The audio module 170 can parse out a voice signal based on the vibration signal of the vibrating bone block of the vocal part obtained by the bone conduction sensor 180M to realize a voice function. The application processor can parse the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 180M to realize a heart rate detection function.

[0112] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The electronic device 100 may receive key input and generate key signal input related to user settings and function control of the electronic device 100.

[0113] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 194, motor 191 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0114] Indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, messages, missed calls, notifications, etc.

[0115] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the electronic device 100 by inserting it into the SIM card interface 195 or pulling it out from the SIM card interface 195. The electronic device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, and the like. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The electronic device 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the electronic device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.

[0116] The software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. In the embodiment of the present invention, the Android system of the layered architecture is taken as an example to exemplify the software structure of the electronic device 100.

[0117] Figure 3 1 is a software structure block diagram of the electronic device 100 according to an embodiment of the present invention.

[0118] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.

[0119] The application layer can include a series of application packages.

[0120] like Figure 3 As shown, the application layer may include application packages such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc.

[0121] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0122] like Figure 3 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.

[0123] In some embodiments of the present application, the application framework may include a service for managing SE, and the service for managing SE may communicate with a server in the cloud, such as the TSM of the SE issuer (hereinafter referred to as the TSM of SE). For example, receiving a command sent by the TSM of SE to send an application protocol data unit (APDU) to the SE, etc., so that the SE executes the corresponding command. The service for managing SE may also request the TA for signing through the CA of the SE. For the specific functions of the service for managing SE, please refer to the description below.

[0124] In other embodiments of the present application, the application framework layer may further include a third module, which may be used to detect whether the electronic device 100 is turned on or connected to the network, etc. In some examples, the third module may also communicate with the TSM of the SE to read the flag to be deleted, request the TSM of the SE to synchronize data with the SE, send a command to restore the SE factory settings, etc. In other examples, the third module may also communicate with the service that manages the SE to notify the service that manages the SE that the flag to be deleted is set, etc.

[0125] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0126] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0127] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0128] The phone manager is used to provide communication functions of the electronic device 100, such as management of call status (including connecting, hanging up, etc.).

[0129] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0130] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, an electronic device vibrates, an indicator light flashes, etc.

[0131] Android Runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0132] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0133] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0134] The system library may include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0135] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0136] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0137] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0138] A 2D graphics engine is a drawing engine for 2D drawings.

[0139] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0140] The following is an illustrative description of the workflow of the software and hardware of the electronic device 100 in conjunction with capturing a photo scene.

[0141] When the touch sensor 180K receives a touch operation, the corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into a raw input event (including touch coordinates, timestamp of the touch operation, and other information). The raw input event is stored in the kernel layer. The application framework layer obtains the raw input event from the kernel layer and identifies the control corresponding to the input event. For example, if the touch operation is a touch single-click operation and the control corresponding to the single-click operation is the control of the camera application icon, the camera application calls the interface of the application framework layer to start the camera application, and then starts the camera driver by calling the kernel layer to capture static images or videos through the camera 193.

[0142] The technical solutions involved in the following embodiments can all be implemented in the electronic device 100 having the above-mentioned hardware architecture and software architecture.

[0143] like Figure 4 FIG. 1 is a flow chart of a method for setting a to-be-deleted flag for a security service provided in an embodiment of the present application, and the method specifically includes:

[0144] S101: An electronic device receives an instruction to clear data or restore factory settings.

[0145] Typically, an electronic device will enter recovery mode when it receives an instruction to clear data or restore factory settings. For example: when the electronic device is in the power-on state, the user can operate the option of restoring factory settings in the system settings of the electronic device to make the electronic device perform factory settings restoration, and the electronic device enters recovery mode after restarting. For another example: when the electronic device is in the power-off state, the user can press and hold the power button and the volume up button (or down button) at the same time to make the electronic device enter recovery mode. Specifically, after the electronic device receives the user's operation of selecting to restore factory settings (the operation of selecting the option of restoring factory settings in the system settings, or the operation of pressing and holding the power button and the volume up button (or down button) at the same time, etc.), the operation identifier can be written, and the operation identifier is used to prompt the electronic device to restart into recovery mode, and instruct the electronic device to restore factory settings or clear data.

[0146] It should be noted that the electronic device can also enter the recovery mode in some other situations, for example: the mobile phone fails and the system automatically starts to restore the factory settings; or some applications of the mobile phone clean up the data in the electronic device, etc., which will also instruct the electronic device to enter the recovery mode. The process of writing the operation identifier of the electronic setting is similar to the above and will not be repeated. The embodiments of the present application do not limit the specific method and specific scenario for the electronic device to enter the recovery mode.

[0147] For example, Figure 5 As shown, a first module can be set in the REE of the electronic device to detect whether the electronic device has entered the recovery mode and whether to instruct the electronic device to restore the factory settings or clear the data. A second module can also be set in the TEE to set the to-be-deleted flag, etc. Among them, the first module and the second module can be newly added modules in the electronic device to implement the function of deleting security services provided by this application, or they can be newly added corresponding functions using existing modules. For example, the first module can be the CA that manages SE, and the second module can be the TA that manages SE. This application does not limit this.

[0148] For example, when the electronic device enters the recovery mode, the first module is notified, and after the first module learns that the electronic device has entered the recovery mode, the second module is notified to start setting the to-be-deleted flag. Alternatively, when the first module detects that the electronic device has entered the recovery mode, the second module is notified to start setting the to-be-deleted flag, and step S102 is executed.

[0149] It should be noted that when the electronic device is restored to factory settings and enters recovery mode, the user data on the electronic device will be deleted according to a certain process, including accounts, system settings, application settings, and installed applications. Among them, the deleted applications include CA in the electronic device REE and TA in the TEE. In some examples, the first module and the second module in this application will also be cleared. Therefore, the method for setting the to-be-deleted flag provided in this application needs to be executed after the electronic device enters recovery mode and before the first module and the second module are cleared.

[0150] S102: If the electronic device includes a security element SE, then execute step S103. Otherwise, this process ends.

[0151] In some examples of the present application, the electronic device (e.g., the second module) can first obtain the SE list of the electronic device (e.g., cplcData data, which is the chip identification of the SE) from the operating system (OS) of the TEE through, for example, the TEE SE API (a standard interface of Android). Determine whether the electronic device contains SE and how many SEs there are based on the obtained SE list. If it is determined that the electronic device contains SE, it is determined that the deletion flag needs to be set, otherwise, it is not necessary to set the deletion flag.

[0152] In some other examples of the present application, the electronic device may also set the first module and the second module in the electronic device including the SE, and not set the first module and the second module in the electronic device not including the SE. Then, after the first module detects that the electronic device enters the recovery mode, it is not necessary to determine whether the electronic device includes the SE, but directly execute step S103.

[0153] S103, the electronic device sets a mark to be deleted.

[0154] Some examples include Figure 5 As shown, the electronic device (for example, the second module) can set a to-be-deleted flag in an indelible area in the TEE of the electronic device. Among them, the indelible area in the TEE of the electronic device means that when the electronic device is restored to factory settings, the data in this area will not be cleared, such as: Replay Protected Memory Block (RPMB), so that the electronic device can still access the to-be-deleted flag after restarting or connecting to the network, so as to perform subsequent operations. In other examples, the to-be-deleted flag can also be set in the SE of the electronic device. Because the data in the SE will not be cleared when the electronic device is restored to factory settings. In this way, the electronic device can also access the to-be-deleted flag after restarting or connecting to the network, so as to perform subsequent operations.

[0155] For example, the to-be-deleted flag may be set to 0 by default, or, when the to-be-deleted flag is set to zero, it indicates that the SE of the electronic device has not been restored to factory settings, or that the SE does not need to be restored to factory settings, etc. When the to-be-deleted flag is set, for example, the to-be-deleted flag may be set to 1, indicating that the SE in the electronic device needs to be restored to factory settings, or that there is an SSD in the electronic device that can be deleted, etc.

[0156] In some examples, a to-be-deleted flag can be set for the electronic device, that is, when the to-be-deleted flag of the electronic device is set, it indicates that subsequent operations can be performed on applets and SSDs in all SEs in the electronic device. In other examples, the to-be-deleted flag can also be set for SE units, that is, a to-be-deleted flag is set for each SE that needs to be restored to factory settings. When the to-be-deleted flag of a certain SE is set, it indicates that the electronic device can perform subsequent operations on all applets and SSDs in the SE. In some other examples, the to-be-deleted flag can also be set for applet (or SSD) units, that is, the second module sets a to-be-deleted flag for each applet (or SSD) that needs to be deleted. When the to-be-deleted flag of each applet (or SSD) is set, it indicates that the electronic device can perform subsequent operations on the applet and SSD. The embodiments of the present application are not specifically limited.

[0157] Considering that the method provided in the embodiment of the present application is to delete the SSD and applet of the security service according to the to-be-deleted mark after the mobile phone is restarted or connected to the Internet. Therefore, before the electronic device deletes the security service SSD and applet, some applets of security services (for example: car keys, access cards, bus cards, etc.) can still interact directly with external card readers through NFC to complete corresponding functions, which poses a security risk. Therefore, in order to further ensure the security of the electronic device, after step S102, the NFC function of the security service can also be disabled, that is, step S104 is executed as follows:

[0158] S104: The electronic device obtains a list of applets whose NFC functions are activated, and deactivates the NFC functions of the applets in the list.

[0159] For example, Figure 5 As shown, the second module can send a GET STATUS command to the CRS applet in the SE to obtain a list of applets in which the NFC function is activated in the SE. Among them, the CRS applet is an application that manages the NFC function of each applet in the SE, and is responsible for activating (activating) and deactivating (deactivating) the NFC function of each applet. Then, the second module sends a SET STATUS command to the CRS applet, and the CRS applet disables the NFC function of the applet in the list, that is, the NFC function of these applets is deactivated. In this way, these applets cannot respond to the NFC command sent by the external card reader, and then they will not complete the corresponding function, which is conducive to ensuring the data security of the applet.

[0160] It should be noted that step S104 can be executed before, after, or simultaneously with step S103, and this embodiment of the present application does not limit this.

[0161] Furthermore, before the electronic device deletes the security service SSD and applet, some security service applets (for example, the mobile phone shield applet) may still be called by TEE, which poses a security risk. Therefore, in order to further ensure the security of the electronic device, after step S102, TEE can also be prohibited from accessing SE, that is, step S105 is executed as follows:

[0162] S105. The electronic device sets an identification prohibiting TEE from accessing SE, so that the TA in the TEE cannot send commands to the SE.

[0163] Among them, the identification of prohibiting TEE from accessing SE can be stored in an undeletable area in the TEE of the electronic device, such as RPMB.

[0164] In some examples, all TAs in the electronic device TEE will first access the TA that manages SE before accessing SE, and access SE through the TA that manages SE. In this way, the second module can notify the TA that manages SE, and the TA that manages SE sets the TEE's flag that prohibits access to SE. In other examples, the second module itself can also be the TA that manages SE, so the second module can set the TEE's flag that prohibits access to SE. In this way, before accessing SE, the TA in the TEE first queries the flag that prohibits access to SE. If the flag that prohibits access to SE is set, access to SE is not allowed. If the flag that prohibits access to SE is not set, access to SE is not allowed.

[0165] It should be noted that step S105 can be executed before, after, or simultaneously with step S103, and this embodiment of the present application does not limit this.

[0166] Subsequently, after detecting that the electronic device is turned on or connected to the Internet, the electronic device reads the to-be-deleted flag. If the to-be-deleted flag is set, the electronic device triggers the factory reset of the SE, that is, clearing the applets and SSD in the SE. The specific implementation process will be described in detail below.

[0167] like Figure 6 FIG. 1 is a flow chart of a method for deleting a security service provided in an embodiment of the present application, and the method specifically includes:

[0168] S301: Detect that the electronic device is turned on or connected to the network.

[0169] In some examples, a third module may be provided in the framework layer of the electronic device to detect that the electronic device is powered on, or to detect a broadcast message sent when the electronic device is connected to the network. The third module may be a newly added module, or a corresponding function may be added to an existing module. For example, the third module may also be a newly added corresponding function on an existing module (also referred to as a service of the management SE) of the framework layer of the electronic device. This embodiment of the present application is not specifically limited.

[0170] In other examples, before step S301, the electronic device will clear the CA in the REE and the CA in the TEE, including the first module and the second module, in recovery mode. The electronic device is shut down or restarted after executing the entire recovery process. When the electronic device is restarted, the electronic device reads the corresponding data and programs from the read-only memory (ROM) image (a copy of the ROM chip data) to complete the services and programs that must be installed when the electronic device is turned on. Among them, it includes the third module of the framework layer, the first module in the REE, and the second module in the TEE. In other words, step S301 and subsequent steps are performed after the electronic device completes recovery, restarts, and installs the third module, the first module, and the second module.

[0171] In some other examples, considering that the method provided by the present application can delete the applet and SSD in the SE only after the electronic device is connected to the server in the cloud, that is, the TSM of the SE issuer (hereinafter referred to as the TSM of the SE). Therefore, the third module can also first determine whether the electronic device can be connected to the TSM of the SE. After determining that it can be connected to the TSM of the SE, step S302 is executed, which is not limited in the embodiments of the present application.

[0172] S302: The electronic device reads the mark to be deleted.

[0173] In some examples, the to-be-deleted flag is stored in the second module, and the third module can read the to-be-deleted flag from the second module via the first module.

[0174] In some other examples, the to-be-deleted flag is stored in the SE of the electronic device, and the third module can read the to-be-deleted flag from the SE via the first module and the second module.

[0175] S303: Determine whether the to-be-deleted flag is set. If the to-be-deleted flag is set, execute step S304, otherwise, this process ends.

[0176] S304: The electronic device obtains a SE list.

[0177] In some examples, the third module can obtain the SE list from the SE through the relevant technology specified by the open mobile alliance (OMA) protocol, and determine whether the electronic device includes SE and how many SEs there are according to the obtained SE list. In this application, if there are multiple SEs in the electronic device, it is necessary to clear the SSD on each SE for each SE, that is, to complete the factory settings of each SE.

[0178] S305: If the electronic device can connect to the TSM of the SE issuer, the electronic device sends a request to the TSM of the SE according to the SE list, requesting the TSM of the SE to synchronize data with each SE. If the electronic device cannot connect to the TSM of the SE, this process ends.

[0179] In some examples, when an electronic device is able to connect to the SE's TSM, the electronic device can also request the SE's TSM to generate an operand (or random number) so that in subsequent data communication between the electronic device and the SE's TSM, the operand can be used to prevent replay attacks and ensure data security.

[0180] S306 , the TSM of the SE synchronizes data with each SE, and obtains the SSD installed in each SE and the applet information of each SSD.

[0181] Since the SE's TSM is responsible for creating SSDs for security services in the SE, and the service's TSM specifically installs the security service's applet in the SSD, the SE's TSM is not aware of the installation status of the applets in the SSD. According to the basic international standard of SE (Global Platform, GP), when the SE's TSM deletes the SSD for security services, it must first delete the applet in the SSD. Therefore, the SE's TSM needs to synchronize data with the SE to obtain the information of the applet in each SSD in the SE in order to delete the applet and SSD.

[0182] S307. The electronic device sends a command for restoring the factory settings of the SE to the TSM of the SE. The command for restoring the factory settings of the SE includes a signature.

[0183] Exemplarily, the third module may notify the second module to sign through the first module. The third module sends a command to restore the factory settings of the SE to the TSM of the SE, and the command carries the signed data. Figure 6 In the figure, they are respectively shown as S307a, S307b and S307c.

[0184] In some examples of the present application, when the second module signs, the private key can be used to sign the data to be signed. In some examples, the second module can sign operand, which can be used to prevent replay attacks and ensure data security. cplcData can also be signed. When the electronic device contains two or more SEs, the second module can sign each SE separately, that is, each SE chip identifier corresponds to a signature. Considering that the present application can also include other methods for restoring SE factory settings, the second module can also sign resetVersion. Among them, resetVersion is the version number for restoring SE factory settings, which can be used to identify different methods of restoring SE factory settings. In the present application, resetVersion can be set to a fixed value, such as "01".

[0185] After the second module signs, the signed data, the public key certificate of the second module, and the device public key certificate are returned to the third module. Optionally, the second module can return the signed data, the public key certificate of the second module, and the device public key certificate to the third module in one message, or can return the signed data, the public key certificate of the second module, and the device public key certificate to the service managing the SE in multiple messages, which is not limited in this application.

[0186] In some other examples of the present application, when the second module is started, the public key certificate of the second module may be checked first. If there is no public key certificate of the second module, the following method may be used to generate the public key certificate of the second module and obtain the device public key certificate, as follows:

[0187] 1. The second module creates a public and private key pair.

[0188] 2. The second module creates a public key certificate for the second module through the interface of the device certificate TA and saves it.

[0189] 3. The second module obtains the public key certificate of the device certificate TA (ie, the device public key certificate) through the interface of the device certificate TA.

[0190] In some other examples of the present application, the electronic device can send a corresponding command to restore the factory settings of each SE. For example, there are two SEs in the electronic device, namely SE1 and SE2. After executing the above process, the electronic device sends command 1 to request to restore the factory settings of SE1; sends command 2 to request to restore the factory settings of SE2, etc.

[0191] S308, the TSM of the SE verifies whether the command to restore the factory settings of the SE is legal. If it is legal, execute step S309, otherwise, this process ends.

[0192] The SE's TSM verifies whether the data in the signature is correct and whether the signature is correct. Specifically, the steps for verifying the signature are:

[0193] 1. SE's TSM uses the public key of the authorization center to decrypt the device public key certificate and obtain the device public key.

[0194] 2. SE's TSM uses the device public key to decrypt the public key certificate of the second module and obtain the public key of the second module.

[0195] 3. The SE's TSM uses the public key of the second module to verify whether the signature data in the command to restore the factory settings of the SE is correct. If it is correct, it means that the access to the current electronic device is legal, and the data in the signature has not been tampered with, and the command to restore the factory settings of the SE can be executed. Otherwise, the access is illegal, and the command to restore the factory settings of the SE cannot be executed.

[0196] S309. The TSM of the SE deletes the SSD in the SE according to the business SSD configuration list stored locally.

[0197] Among them, the business SSD configuration list is determined by the SE manufacturer or management party after consultation with the business party. The list includes a list of SSDs of certain security services of the business party that can be deleted by the SE manufacturer or management party at its own discretion when the electronic device is restored to factory settings.

[0198] In step S306, the TSM of the SE has obtained the SSDs installed in the electronic device and the applets installed in each SSD. In this step, the electronic device can determine the SSDs installed in the electronic device that can be deleted when restoring factory settings, that is, determine the target SSD, based on the business SSD configuration list.

[0199] Then, the TSM of the SE can send an application protocol data unit (APDU) command (SE processing command) to the SE through the third module and the OMA API, and delete the applet and the target SSD in each target SSD in the SE one by one to restore the factory settings of the SE. Taking the factory settings of one SE as an example, the process of restoring the factory settings of the SE module is described as follows:

[0200] 1. The TSM of the SE establishes a secure channel with the ISD in the SE.

[0201] 2. The SE's TSM sends commands to delete the target SSDs one by one through the secure channel, first deleting the applets in each target SSD and then deleting the target SSD.

[0202] When the TSM of SE deletes the target SSDs one by one, if the deletion of a certain target SSD fails, the remaining target SSDs will continue to be deleted. After the TSM of SE has executed the deletion operation on all target SSDs, if there is a target SSD that fails to be deleted, the TSM of SE returns an error code to the third module of the electronic device. After receiving the error code, the third module initiates the operation of restoring the factory settings of the SE, that is, executes steps S307 to S309. It should be noted that in order to avoid the TSM of SE from falling into an infinite loop of restoring the factory settings of the SE due to the continuous failure of deletion of one or some target SSDs, the number of times the third module re-initiates the operation of restoring the factory settings of the SE can be set. In other words, when the number of times the third module re-initiates the operation of restoring the factory settings of the SE reaches the preset number of times, step S310 is directly executed.

[0203] In some examples, the TSM of the SE may re-initiate deletion for all target SSDs, or may re-initiate deletion for the target SSDs for which deletion failed, which is not limited in this application.

[0204] In other examples of the present application, the third module may also perform other special processing of security services before step S310. For example, for a bus card, the third module may interact with the TSM of the bus card service and report the balance of the bus card to the TSM of the bus card service so as to migrate it to other bus cards.

[0205] S310, the electronic device clears the mark to be deleted.

[0206] For example, in some examples, the to-be-deleted flag is stored in the second module, and the third module can instruct the second module to clear the to-be-deleted flag via the first module. In other examples, the to-be-deleted flag is stored in the SE of the electronic device, and the third module can instruct the SE to clear the to-be-deleted flag via the first module and the second module.

[0207] In other examples of the present application, the second module sets a flag prohibiting TEE from accessing SE in recovery mode, or the second module notifies the TA managing SE to set a flag prohibiting TEE from accessing SE. After step S310, the second module may clear the flag prohibiting TEE from accessing SE, or notify the TA managing SE to clear the flag prohibiting TEE from accessing SE, so that the TA in the TEE can access the SE.

[0208] Considering that some electronic devices have SE management mechanisms, including SE management services at the framework layer, CA for SE management in REE, and TA for SE management in TEE. Then, the existing SE management mechanism can be used to collaborate with the first module added in REE, the second module added in TEE, and the third module added in the framework layer of this application to jointly complete the operation of deleting the SSD in SE. The following is an exemplary description of the specific implementation in this scenario.

[0209] For example, after the third module detects that the electronic device is turned on or connected to the Internet, the third module can read the to-be-deleted flag from the second module in the TEE through the first module in the REE. If the to-be-deleted flag is set, the third module notifies the service that manages the SE to trigger the restoration of the factory settings of the SE, that is, clearing the SSD in the SE. The specific implementation is as follows:

[0210] like Figure 7 FIG. 1 is a flow chart of a method for deleting a security service provided in an embodiment of the present application, and the method specifically includes:

[0211] S201: The third module detects that the electronic device is turned on or connected to the network.

[0212] S202: The third module reads and caches the to-be-deleted flag.

[0213] In steps S201 and S202, the third module of the framework layer reads the to-be-deleted flag when detecting that the electronic device is turned on or receiving a broadcast message sent when the electronic device is connected to the network.

[0214] In some examples, if the flag to be deleted is stored in the second module, the third module can read the flag to be deleted from the second module via the first module and cache the flag to be deleted. In other examples, if the flag to be deleted is stored in the TA that manages the SE, the third module can read the flag to be deleted from the TA that manages the SE via the first module and the second module and cache the flag to be deleted. In some other examples, if the flag to be deleted is stored in the SE module, the third module can read the flag to be deleted from the SE via the first module and the second module and cache the flag to be deleted. The embodiments of the present application are not limited to this.

[0215] In other examples, considering that the method provided by the present application requires that the electronic device needs to be connected to a server in the cloud, that is, the TSM of the SE issuer (hereinafter referred to as the TSM of the SE), the applet and SSD in the SE can be deleted. Therefore, it is also possible to first determine whether the electronic device can be connected to the TSM of the SE. After determining that it can be connected to the TSM of the SE, the third module is triggered to read the deletion flag and perform subsequent operations, which is not limited in the embodiments of the present application.

[0216] S203: The third module determines whether the to-be-deleted flag is set. If the to-be-deleted flag is set, step S204 is executed, otherwise, this process ends.

[0217] S204. The third module notifies the service managing the SE that the factory settings of the SE need to be restored.

[0218] Exemplarily, after the third module determines that the to-be-deleted flag is set, it notifies the service that manages the SE that the electronic device needs to restore the factory settings of the SE, that is, delete the SSD in the SE.

[0219] In some examples, in order to prevent the electronic device from creating a new SSD according to the command of the TSM of the SE while deleting the SSD in the SE, causing confusion, it is possible to prohibit the creation of a new SSD in the SE during the period when the deletion flag is set. That is, when the service managing the SE receives the TSM of the SE to establish a new security domain, it first reads the deletion flag from the third module. If the deletion flag is set, the service managing the SE does not create a new SSD.

[0220] S205. The service managing the SE obtains a SE list.

[0221] In some examples, the service managing the SE can obtain the SE list from the SE through the relevant technology specified by the open mobile alliance (OMA) protocol, and determine whether the electronic device includes the SE and how many SEs there are according to the obtained SE list. In this application, if there are multiple SEs, it is necessary to clear the SSD on each SE for each SE, that is, to complete the factory settings of each SE.

[0222] In other examples, when the electronic device can connect to the SE's TSM, the service managing the SE can also request the SE's TSM to generate an operand (or a random number) so that the operand can be used in subsequent data communication between the electronic device and the SE's TSM to prevent replay attacks and ensure data security. If the SE's TSM cannot be connected, this process ends.

[0223] S206: If the electronic device can connect to the TSM of the SE issuer, the service managing the SE sends a request to the TSM of the SE according to the SE list, requesting the TSM of the SE to synchronize data with each SE. If the electronic device cannot connect to the TSM of the SE, this process ends.

[0224] S207 , the TSM of the SE synchronizes data with the SE, obtains the SSD in the SE, and obtains the SSD installed in each SE and the applet information of each SSD.

[0225] Since the SE's TSM is responsible for creating SSDs for security services in the SE, and the service's TSM specifically installs the security service's applets in the SSD, the SE's TSM is not aware of the installation status of the applets in the SSD. According to the basic international standard of SE (Global Platform, GP), when the SE's TSM deletes the SSD for security services, it must first delete the applet in the SSD. Therefore, the SE's TSM needs to synchronize data with the SE to obtain the information of the applet installed in each SSD in the SE in order to delete the applet and SSD.

[0226] Specifically, the TSM of the SE can communicate with the SE through the management service of the SE and the OMA API to obtain the information of the applet installed in each SSD in the SE.

[0227] S208. The service of the management SE notifies the TA of the management SE to sign through the CA of the management SE.

[0228] In this application, it is equivalent to the electronic device initiating a request to restore the factory settings of the SE to the TSM of the SE. In order to ensure security, the TSM of the SE requires the electronic device to sign the initiated request and determine the identity of the electronic device based on the signature data.

[0229] In some examples, the TA who manages the SE signs the data to be signed with a private key. The TA who manages the SE can sign the operand, which can be used to prevent replay attacks and ensure the security of the data. The TA who manages the SE can also sign cplcData. When the electronic device contains two or more SEs, the TA who manages the SE can sign each SE separately, that is, each SE chip identifier corresponds to a signature. In other examples, considering that the present application may also include other methods for restoring the SE factory settings, the TA who manages the SE can also sign the resetVersion. Among them, resetVersion is the version number for restoring the SE factory settings, which can be used to identify different methods of restoring the SE factory settings. In the present application, resetVersion can be set to a fixed value, such as "01".

[0230] After the TA who manages the SE signs, the signed data, the public key certificate of the TA who manages the SE, and the device public key certificate are returned to the service that manages the SE. Optionally, the TA who manages the SE can also return the signature, the public key certificate of the TA who manages the SE, and the device public key certificate to the service that manages the SE in one message, or can return the signature, the public key certificate of the TA who manages the SE, and the device public key certificate to the service that manages the SE in multiple messages, which is not limited in this application.

[0231] In other examples, the TA managing the SE may check the public key certificate of the TA managing the SE when starting up. If there is no public key certificate of the TA managing the SE, the public key certificate of the TA managing the SE may be generated and the device public key certificate may be obtained. For specific implementation, please refer to the relevant description in step S307 above, which will not be repeated here.

[0232] S209. The service managing the SE sends a command for restoring the factory settings of the SE to the TSM of the SE. The command for restoring the factory settings of the SE includes signature data.

[0233] Exemplarily, the service managing SE can send a corresponding command to restore the factory settings of SE to each SE. For example, the service managing SE manages two SEs in the electronic device, namely SE1 and SE2. After executing the above process, the service managing SE sends command 1 to request to restore the factory settings of SE1; the service managing SE sends command 2 to request to restore the factory settings of SE2, etc.

[0234] S210, the TSM of the SE verifies whether the command to restore the factory settings of the SE is legal. If it is legal, step S211 is executed, otherwise, this process ends.

[0235] The TSM of the SE verifies whether the data in the signature is correct and whether the signature is correct. The specific method of verifying the signature can refer to the relevant content in step 308 above, which will not be repeated here.

[0236] S211. The TSM of the SE deletes the SSD in the SE according to the business SSD configuration list stored locally.

[0237] Exemplarily, the TSM of the SE determines the SSD installed in the electronic device that can be deleted when restoring factory settings, that is, determines the target SSD, based on the locally stored business SSD configuration list and the SSD and applet information installed in the electronic device obtained in step S207.

[0238] Then, the TSM of the SE can send an application protocol data unit (APDU) command (SE processing command) to the SE by managing the services of the SE and the OMA API, and delete the target applet and the target SSD in each SE one by one to restore the factory settings of the SE.

[0239] In other examples of the present application, the service managing SE can also perform other special processing of security services before step S212. For example, for bus cards, the service managing SE can interact with the TSM of the bus card service and report the balance of the bus card to the TSM of the bus card service so as to migrate it to other bus cards.

[0240] For other contents of this step, please refer to the relevant description in step S309 above, which will not be repeated here.

[0241] S212: The service managing the SE returns the result of restoring the factory settings of the SE to the third module.

[0242] S213: The third module sends a command to clear the to-be-deleted mark to the second module via the first module.

[0243] S214: The second module clears the to-be-deleted mark.

[0244] In some examples, the to-be-deleted flag is stored in the second module, and the second module clears the to-be-deleted flag. In other examples, the to-be-deleted flag is stored in the TA that manages the SE, and the second module can notify the TA that manages the SE to clear the to-be-deleted flag. In some other examples, the to-be-deleted flag is stored in the SE module, and the second module can instruct the SE to clear the to-be-deleted flag. This embodiment of the present application is not limited to this.

[0245] In some examples of the present application, the TA managing the SE sets a flag prohibiting TEE from accessing the SE in the recovery mode. After step S213, the second module may notify the TA managing the SE to clear the flag prohibiting TEE from accessing the SE, so that the TA in the TEE can access the SE.

[0246] It is understandable that, in order to realize the above functions, the above-mentioned terminals etc. include hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of the present invention.

[0247] The embodiment of the present application can divide the functional modules of the above-mentioned terminal etc. according to the above-mentioned method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0248] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0249] Each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0250] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk.

[0251] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for deleting a security element application corresponding to a security service, characterized in that: Applied to an electronic device, the electronic device has a security element SE, and the method for deleting a security service includes: The electronic device receives an instruction to clear data or restore factory settings, and sets a first identifier according to the instruction; the first identifier is stored in a first area in the TEE of the electronic device, the first area is an area of ​​the electronic device that is not deleted after clearing data or restoring factory settings, or the first identifier is stored in the SE; The electronic device is shut down or restarted; If it is detected that the electronic device is turned on or connected to the Internet, the electronic device reads the first identification; If the first identifier is set, the electronic device sends a first request to the server, and if the first identifier is set and the electronic device can connect to the TSM of the SE issuer, sends a second request to the server; the first request is used to request the server to delete the security element application corresponding to the security service in the SE; the second request is used to request the server to synchronize data with the SE; The electronic device receives a first command sent by the server; the first command is the server instructing the electronic device to delete a target security service in the SE according to the first request, and the target security service is determined by the server according to the security services installed in the SE and a deletable list of security services stored by the server; The electronic device deletes the security element application corresponding to the target security service in the SE according to the first command.

2. The method for deleting a security element application corresponding to a security service according to claim 1, characterized in that: Also includes: The electronic device deletes the auxiliary security domain SSD corresponding to the target security service in the SE according to the first command.

3. The method for deleting a security element application corresponding to a security service according to claim 1 or 2, characterized in that: Also includes: If the electronic device receives an instruction to clear data or restore factory settings, the electronic device disables a near field communication (NFC) function of a security element applied in the electronic device.

4. The method for deleting a security element application corresponding to a security service according to claim 1 or 2, characterized in that: Also includes: If the electronic device receives an instruction to clear data or restore factory settings, the electronic device sets a second identifier. When the second identifier is set, the trusted application TA that manages SE in the TEE in the electronic device denies the service TA access to the SE.

5. The method for deleting a security element application corresponding to a security service according to claim 4, characterized in that: The second identifier is stored in a second area in the TEE of the electronic device, and the second area is an area that is not deleted after the electronic device clears data or restores factory settings.

6. The method for deleting a security element application corresponding to a security service according to claim 4, characterized in that: After the electronic device deletes the secure element application or SSD corresponding to the target secure service in the SE according to the first command, the method for deleting the secure service further includes: The electronic device clears the second identifier.

7. The method for deleting a security element application corresponding to a security service according to claim 1 or 2, characterized in that: Also includes: The electronic device reports to the server the SSD corresponding to the security service installed in the SE and the security element application installed in the SSD corresponding to the installed security service.

8. The method for deleting a security element application corresponding to a security service according to claim 1 or 2, characterized in that: After the electronic device deletes the security element application or SSD corresponding to the target security service according to the first command, the method for deleting the security service further includes: The electronic device clears the first identifier.

9. An electronic device, characterized in that: include: A processor, a memory and a touch screen, wherein the memory and the touch screen are coupled to the processor, the memory is used to store computer program codes, and the computer program codes include computer instructions. When the processor reads the computer instructions from the memory, the electronic device performs the following operations: Receive an instruction to clear data or restore factory settings, and set a first identifier according to the instruction; the first identifier is stored in a first area in the TEE of the electronic device, the first area is an area of ​​the electronic device that is not deleted after clearing data or restoring factory settings, or the first identifier is stored in the SE; Shut down or restart; If it is detected that the electronic device is turned on or connected to the Internet, reading the first identification; If the first identifier is set, sending a first request to the server, and if the first identifier is set and the electronic device can connect to the TSM of the SE issuer, sending a second request to the server; The first request is used to request the server to delete the secure element application corresponding to the secure service in the SE; The second request is used to request the server to synchronize data with the SE; receiving a first command sent by the server; The first command is the server instructing the electronic device to delete a target security service in the SE according to the first request, where the target security service is determined by the server according to the security services installed in the SE and a deletion list of security services stored by the server; According to the first command, the security element application corresponding to the target security service in the SE is deleted.

10. The electronic device according to claim 9, characterized in that: Also includes: According to the first command, the auxiliary security domain SSD corresponding to the target security service in the SE is deleted.

11. The electronic device according to claim 9 or 10, characterized in that: Also includes: If the electronic device receives an instruction to clear data or restore factory settings, a near field communication (NFC) function of a security element applied in the electronic device is disabled.

12. The electronic device according to claim 9 or 10, characterized in that: Also includes: If the electronic device receives an instruction to clear data or restore factory settings, a second identifier is set. When the second identifier is set, the trusted application TA that manages SE in the TEE in the electronic device denies the service TA access to the SE.

13. The electronic device according to claim 12, characterized in that: The second identifier is stored in a second area in the TEE of the electronic device, and the second area is an area that is not deleted after the electronic device clears data or restores factory settings.

14. The electronic device according to claim 12, characterized in that: After the electronic device deletes the security element application or SSD corresponding to the target security service in the SE according to the first command, the second identifier is cleared.

15. The electronic device according to claim 9 or 10, characterized in that: Reporting to the server the SSD corresponding to the security service installed in the SE and the secure element application installed in the SSD corresponding to the installed security service.

16. The electronic device according to claim 9 or 10, characterized in that: After the electronic device deletes the security element application or SSD corresponding to the target security service according to the first command, the first identifier is cleared.

17. A computer storage medium, characterized in that: The method comprises computer instructions, and when the computer instructions are executed on a terminal, the terminal executes the method for deleting a security element application corresponding to a security service according to any one of claims 1 to 8.

18. A computer program product, characterized in that When the computer program product runs on a computer, the computer is enabled to execute the method for deleting a security element application corresponding to a security service according to any one of claims 1 to 8.

Images