Electronic device, trusted application calling method, device, equipment and medium

Abstract

The present application discloses an electronic device, a trusted application calling method, an apparatus, a device and a medium for reducing the development cycle and development cost of trusted applications. Since the trusted application development platform of the present application connects the native trusted applications corresponding to multiple trusted execution environment operating systems, based on the trusted application development platform, the bytecode trusted application can be applied to any TEE OS. For different TEE OS hardware platforms, it is only necessary to develop a corresponding bytecode trusted application for one application. Compared with the related art, for the same application, different versions of trusted applications need to be developed for different TEE OS hardware platforms. The present application can reduce the development cycle and development cost of trusted applications; at the same time, the trusted application development platform and bytecode trusted application developed by the present application can be applied to different TEE OS electronic devices (terminals), so as to achieve the purpose of "one-time development, multi-terminal deployment" and realize the rapid deployment and promotion of applications.

Description

Technical Field

[0001] The present application relates to the technical field of trusted application calling, and in particular to an electronic device, a trusted application calling method, an apparatus, a device and a medium. Background Art

[0002] The development of mobile communication technology has brought about the rapid development of mobile terminal technology. Modern mobile terminal devices provide a powerful and flexible Rich Execution Environment (REE), but this also makes the devices vulnerable to security threats. Trusted Execution Environment (TEE) is a technical solution proposed to address the security risks existing in current mobile terminal devices. TEE and REE run in parallel on the same device. TEE can ensure the storage, processing and protection of sensitive data in a trusted environment, and provide a secure execution environment for authorized security software (trusted software), achieving end-to-end security through execution protection, confidentiality, integrity and data access rights. Among them, the trusted application (TA) runs on the TEE, and the client application (CA) runs on the REE. CA uses the security functions provided by TEE and TA by calling TA.

[0003] Traditional TAs are typically machine code programs running on a Trusted Execution Environment (TEE) operating system (TEE OS). For the same application, different versions of trusted applications must be developed for different TEE OS hardware platforms, such as Huawei iTrustee and Qualcomm QSEE, to meet the needs of different TEE OS hardware platforms.

[0004] In the related art, for the same application, different versions of trusted applications need to be developed for different TEE OS hardware platforms, which results in a long trusted application development cycle and high development costs. Summary of the Invention

[0005] The present application provides an electronic device, a trusted application calling method, an apparatus, a device, and a medium for reducing the development cycle and development cost of trusted applications.

[0006] In a first aspect, the present application provides an electronic device, the electronic device comprising: a client application CA and a trusted application development platform;

[0007] The CA is configured to initiate a first access request to a native trusted application of a trusted execution environment operating system associated with the trusted application development platform and corresponding to the CA, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application;

[0008] The trusted application development platform is configured to receive the first access request, determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform, and send the first access request to the native trusted application corresponding to the first identification information;

[0009] The native trusted application corresponding to the first identification information is configured to receive the first access request and determine whether the bytecode trusted application corresponding to the second identification information is installed on the native trusted application, and if so, return confirmation information to the CA;

[0010] The CA is further configured to, after receiving the confirmation information, send a call command to the native trusted application corresponding to the first identification information;

[0011] The native trusted application corresponding to the first identification information is further used to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0012] In a possible implementation, the electronic device further includes:

[0013] A creation module is used to create the trusted application development platform based on bytecode technology that supports cross-platform functions, wherein the trusted application development platform connects native trusted applications corresponding to at least two trusted execution environment operating systems.

[0014] In a possible implementation, the native trusted application corresponding to the first identification information is further configured to return a prompt message indicating that the application has not been installed to the CA if it is determined that the bytecode trusted application corresponding to the second identification information has not been installed.

[0015] The CA is further configured to send an installation instruction for installing the bytecode trusted application corresponding to the second identification information to the native trusted application corresponding to the first identification information;

[0016] The native trusted application corresponding to the first identification information is further configured to install the bytecode trusted application corresponding to the second identification information at its own set location based on the open trust protocol (OTRP) according to the installation instruction; and after successful installation, send a return message of successful installation to the CA;

[0017] The CA is further configured to initiate a second access request after receiving the returned information.

[0018] In a possible implementation, the electronic device further includes: a trusted application management platform;

[0019] The CA is further configured to send an installation request for the bytecode trusted application containing the second identification information to the trusted application management platform;

[0020] The trusted application management platform is configured to receive the installation request, assemble an Open Trust Protocol (OTRP) message containing installation information of the bytecode trusted application including the second identification information according to the installation request, and send the OTRP message to the CA;

[0021] The CA is specifically configured to receive the OTRP message, and send the OTRP message and an installation instruction for installing the bytecode trusted application of the second identification information to the native trusted application corresponding to the first identification information.

[0022] In a second aspect, the present application further provides a trusted application calling method, which is applied to a client application CA, and includes:

[0023] Initiating a first access request to a native trusted application of a trusted execution environment operating system associated with the CA and linked to a trusted application development platform, wherein the first access request carries first identification information of the electronic device to which the CA belongs and second identification information of a bytecode trusted application of any application; causing the trusted application development platform to receive the first access request, causing the trusted application development platform to determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems associated with the trusted application development platform, and causing the trusted application development platform to send the first access request to the native trusted application corresponding to the first identification information;

[0024] receiving confirmation information returned by the native trusted application corresponding to the first identification information, wherein the confirmation information is sent by the native trusted application corresponding to the first identification information when the native trusted application receives the first access request and determines that the native trusted application corresponding to the first identification information has installed the bytecode trusted application corresponding to the second identification information;

[0025] Send a call command to the native trusted application corresponding to the first identification information; and enable the native trusted application corresponding to the first identification information to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0026] In one possible implementation, the method further includes:

[0027] If a prompt message indicating that the native trusted application corresponding to the first identification information has not been installed is returned, sending an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information; causing the native trusted application corresponding to the first identification information to install the bytecode trusted application with the second identification information at its set location based on the Open Trust Protocol (OTRP) according to the installation instruction;

[0028] Receive return information sent by the native trusted application corresponding to the first identification information, and initiate a second access request, wherein the return information is sent by the native trusted application corresponding to the first identification information when the bytecode trusted application of the second identification information is successfully installed.

[0029] In a possible implementation, after receiving the prompt information returned by the native trusted application corresponding to the first identification information indicating that the application has not yet been installed, and before sending the installation instruction for installing the bytecode trusted application corresponding to the first identification information to the native trusted application corresponding to the first identification information, the method further includes:

[0030] Sending an installation request for the bytecode trusted application containing the second identification information to a trusted application management platform;

[0031] receiving an open trust protocol (OTRP) message containing installation information of a bytecode trusted application including the second identification information, sent by the trusted application management platform, wherein the OTRP message is sent when the trusted application management platform receives the installation request and successfully assembles the OTRP message according to the installation request;

[0032] The sending of an installation instruction for the bytecode trusted application corresponding to the first identification information to install the second identification information includes:

[0033] The OTRP message and the installation instruction for installing the bytecode trusted application of the second identification information are sent to the native trusted application corresponding to the first identification information.

[0034] In a third aspect, the present application provides a trusted application calling method, which is applied to native trusted applications and includes:

[0035] receiving a first access request, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application;

[0036] Determine whether the bytecode trusted application with the second identification information is installed on the device, and if so, return confirmation information to the CA;

[0037] receiving a call command sent by the CA, wherein the call command is a command sent by the CA to the native trusted application corresponding to the first identification information after receiving the confirmation information;

[0038] The call command received from the CA is forwarded to the bytecode trusted application of the second identification information.

[0039] In one possible implementation, the method further includes:

[0040] If it is determined that the bytecode trusted application with the second identification information is not installed, a prompt message indicating that the application has not been installed is returned to the CA; and the CA sends an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information;

[0041] Receive the installation instruction, and according to the installation instruction, install the bytecode trusted application of the second identification information at its own set location based on the open trust protocol OTRP; and after the installation is successful, send a return message of successful installation to the CA; after the CA receives the return message, initiate a second access request.

[0042] In a fourth aspect, the present application provides a trusted application calling device, which is applied to a client application CA, and includes:

[0043] an initiating module, configured to initiate a first access request to a native trusted application of a trusted execution environment operating system associated with a trusted application development platform and corresponding to the CA, wherein the first access request carries first identification information of the electronic device to which the CA belongs and second identification information of a bytecode trusted application of any application; causing the trusted application development platform to receive the first access request, causing the trusted application development platform to determine, based on the first identification information, the native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems associated with the trusted application development platform, and causing the trusted application development platform to send the first access request to the native trusted application corresponding to the first identification information;

[0044] a first receiving module, configured to receive confirmation information returned by the native trusted application corresponding to the first identification information, wherein the confirmation information is sent by the native trusted application corresponding to the first identification information when the native trusted application receives the first access request and determines that the native trusted application corresponding to the first identification information has installed therein the bytecode trusted application;

[0045] A sending command module is used to send a call command to the native trusted application corresponding to the first identification information; and enable the native trusted application corresponding to the first identification information to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0046] In a possible implementation, the device further includes:

[0047] an installation instruction sending module configured to, upon receiving a prompt message returned by the native trusted application corresponding to the first identification information indicating that the application has not yet been installed, send an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information; and cause the native trusted application corresponding to the first identification information to install the bytecode trusted application with the second identification information at a location set by the native trusted application based on the Open Trust Protocol (OTRP) according to the installation instruction;

[0048] The initiating module is also used to receive return information sent by the native trusted application corresponding to the first identification information and initiate a second access request, wherein the return information is sent by the native trusted application corresponding to the first identification information when the bytecode trusted application of the second identification information is successfully installed.

[0049] In one possible implementation, the module for sending installation instructions is also used to send an installation request for installing the bytecode trusted application with the second identification information to the trusted application management platform; receive an open trust protocol OTRP message containing the installation information of the bytecode trusted application with the second identification information sent by the trusted application management platform, wherein the OTRP message is sent when the trusted application management platform receives the installation request and successfully assembles the OTRP message according to the installation request; and send the OTRP message and the installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information.

[0050] In a fifth aspect, the present application further provides a trusted application calling device, which is applied to native trusted applications and includes:

[0051] A second receiving module is configured to receive a first access request, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application;

[0052] A determination module, configured to determine whether the bytecode trusted application with the second identification information is installed on the module, and if so, return confirmation information to the CA;

[0053] a third receiving module, configured to receive a call command sent by the CA, wherein the call command is a command sent by the CA to the native trusted application corresponding to the first identification information after receiving the confirmation information;

[0054] A transfer module is used to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0055] In a possible implementation, the device further includes:

[0056] a prompt module, configured to, if it is determined that the native trusted application corresponding to the first identification information has not installed the bytecode trusted application corresponding to the second identification information, return a prompt message to the CA indicating that the application has not been installed; and cause the CA to send an installation instruction to the native trusted application corresponding to the first identification information to install the bytecode trusted application corresponding to the second identification information;

[0057] The installation module is used to receive the installation instruction, and according to the installation instruction, based on the open trust protocol OTRP, install the bytecode trusted application of the second identification information at its own set location; and after the installation is successful, send a return message of successful installation to the CA; after the CA receives the return message, it initiates a second access request.

[0058] In a sixth aspect, the present application provides an electronic device, which includes at least a processor and a memory, and the processor is used to implement the steps of any of the above-mentioned trusted application calling methods when executing a computer program stored in the memory.

[0059] In a seventh aspect, the present application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned trusted application calling methods.

[0060] After the CA of this application initiates the first access request, the trusted application development platform can determine the native trusted application corresponding to the first identification information carried in the first access request from the native trusted applications corresponding to at least two (or more) TEE OSs connected to the trusted application development platform; the native trusted application corresponding to the first identification information returns confirmation information to the CA after determining that it has installed the bytecode trusted application with the second identification information carried in the first access request. After receiving the confirmation information, the CA can send a call command to the native trusted application corresponding to the first identification information; the native trusted application corresponding to the first identification information can transfer the call command received from the CA to the bytecode trusted application with the second identification information, thereby realizing accurate calling of the bytecode trusted application with the second identification information. Since the trusted application development platform of this application connects the native trusted applications corresponding to multiple trusted execution environment operating systems, based on this trusted application development platform, bytecode trusted applications can be applied to any TEE OS. For different TEE OS hardware platforms, only one corresponding bytecode trusted application needs to be developed for one application. Compared with the related art, for the same application, different versions of trusted applications need to be developed for different TEE OS hardware platforms. This application can reduce the development cycle and development cost of trusted applications; at the same time, the trusted application development platform and bytecode trusted application developed by this application can be applied to different TEE OS electronic devices (terminals), thereby achieving the goal of "one-time development, multi-terminal deployment" and realizing rapid deployment and promotion of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the implementation methods in the embodiments of the present application or related technologies, the following is a brief introduction to the drawings required for use in the embodiments or related technology descriptions. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0062] Figure 1 A schematic structural diagram of a first electronic device provided by some embodiments is shown;

[0063] Figure 2 A schematic structural diagram of a second electronic device provided by some embodiments is shown;

[0064] Figure 3 A schematic diagram of a first trusted application calling process provided by some embodiments is shown;

[0065] Figure 4 A schematic diagram of a second trusted application calling process provided by some embodiments is shown;

[0066] Figure 5A schematic diagram of a third trusted application calling process provided by some embodiments is shown;

[0067] Figure 6 A schematic diagram of a first trusted application calling device provided by some embodiments is shown;

[0068] Figure 7 A schematic structural diagram of a first electronic device provided by some embodiments is shown;

[0069] Figure 8 A schematic diagram of a fourth trusted application calling process provided by some embodiments is shown;

[0070] Figure 9 A schematic diagram of a second trusted application calling device provided by some embodiments is shown;

[0071] Figure 10 A schematic structural diagram of a second electronic device provided by some embodiments is shown. DETAILED DESCRIPTION

[0072] In order to reduce the development cycle and development cost of trusted applications, the present application provides an electronic device, a trusted application calling method, an apparatus, a device and a medium.

[0073] In order to make the purpose and implementation of this application clearer, the exemplary implementation of this application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only part of the embodiments of this application, not all of the embodiments.

[0074] It should be noted that the brief descriptions of terms in this application are only for the purpose of facilitating the understanding of the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their ordinary and usual meanings.

[0075] In the specification and claims of this application and the accompanying drawings, the terms "first," "second," "third," etc. are used to distinguish similar or similar objects or entities, and are not necessarily intended to limit a particular order or sequence, unless otherwise noted. It should be understood that the terms used in this manner are interchangeable under appropriate circumstances.

[0076] The terms "comprise," "include," and "have," and any variations thereof, are intended to cover but not exclude inclusion; for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0077] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functionality associated with that element.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

[0079] Example 1:

[0080] Figure 1 A schematic structural diagram of a first electronic device provided by some embodiments is shown, the electronic device comprising: a client application (CA) 11 and a trusted application development platform 12;

[0081] The CA11 is configured to initiate a first access request to a native trusted application of a trusted execution environment operating system associated with the trusted application development platform 12 and corresponding to the CA11, wherein the first access request carries the first identification information of the electronic device and the second identification information of a bytecode trusted application of any application;

[0082] The trusted application development platform 12 is configured to receive the first access request, determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform 12, and send the first access request to the native trusted application corresponding to the first identification information;

[0083] The native trusted application 13 corresponding to the first identification information is used to receive the first access request and determine whether the BTA 14 with the second identification information is installed on itself. If so, it returns confirmation information to the CA 11;

[0084] The CA 11 is further configured to send a call command to the native trusted application 13 corresponding to the first identification information after receiving the confirmation information;

[0085] The native trusted application 13 corresponding to the first identification information is further configured to transfer the call command received from the CA 11 to the BTA 14 corresponding to the second identification information.

[0086] In a possible implementation, the electronic device of the present application may be a PC, a mobile terminal, or a server. For example, the trusted execution environment operating system (TEE OS) in the electronic device may be any TEE OS such as Huawei iTrustee or Qualcomm QSEE.

[0087] In one possible embodiment, for each TEE OS, a trusted application corresponding to the TEE OS can be created (for the convenience of description, referred to as a native trusted application). Among them, the creation of the native trusted application corresponding to the TEE OS can adopt existing technologies, which will not be repeated here. In one possible embodiment, in order to develop a trusted application that can be applied to multiple TEEOS and can be used across different TEE OS hardware platforms for any application, thereby reducing the development cycle and development cost of the trusted application, the electronic device may also include a creation module, which can be based on bytecode technology that supports cross-platform functions (such as WebAssembly bytecode technology, etc.) to create a trusted application development platform 12 (trusted application development framework) that connects multiple (at least two) TEE OSes corresponding to the native trusted applications (for the convenience of description, referred to as Native TA). Among them, WebAssembly is a new specification developed by the World Wide Web Consortium (W3C) community group composed of mainstream browser manufacturers. It defines a new format that is portable, small in size, fast to load and compatible with the World Wide Web (Web).

[0088] Figure 2 A schematic diagram of the structure of a second electronic device provided by some embodiments is shown. Figure 2This application can build the Native TAs corresponding to multiple TEE OSes into a trusted application development platform 12 based on bytecode technology that supports cross-platform functions (such as WebAssembly bytecode technology, etc.). The trusted application development platform 12 can provide a unified development interface to the upper level. Trusted application developers no longer need to pay attention to the specific version of the TEE OS hardware platform. They only need to develop a trusted application corresponding to any application such as China Construction Bank or Agricultural Bank of China based on the trusted application development platform 12 (for the convenience of description, it is called a bytecode trusted application). The bytecode trusted application (for the convenience of description, it is called a Bytecode Trusted Application, BTA) is a trusted application developed based on the trusted application development platform 12 that can be applied to different TEE OSes and can be used across different TEE OS hardware platforms. This application can develop only one corresponding trusted application for each application. Compared with the related technology, which requires developing a trusted application for each application for different TEE OS hardware platforms and developing multiple different versions of trusted applications for the same application, this application can shorten the development cycle of trusted applications and reduce development costs. At the same time, it can also achieve the goal of "one-time development, multi-terminal deployment" and realize the rapid deployment and promotion of applications.

[0089] In one possible implementation, when it is necessary to use the security function provided by the Trusted Execution Environment (TEE), the client application (CA) 11 in the electronic device can initiate an access request to the native trusted application of the TEE OS corresponding to the CA11 contained in the trusted application development platform 12 (for the convenience of description, referred to as the first access request). For example, assuming that the TEE OS of the electronic device is Huawei iTrustee, the CA11 in the electronic device can initiate a first access request to the native trusted application corresponding to the Huawei iTrustee TEE OS contained in the trusted application development platform 12. In one possible implementation, the first access request can carry the identification information of the electronic device (for the convenience of description, referred to as the first identification information) and the identification information of the bytecode trusted application of any application to be called (for the convenience of description, referred to as the second identification information). Among them, the first identification information and the second identification information can be flexibly set according to needs, and this application does not make specific limitations on this. For example, the first identification information of the electronic device can be identification information such as the model of the electronic device and the brand of the electronic device. In one possible implementation, the first identification information may include, in addition to identification information such as the model and brand of the electronic device, identification information of the native trusted application applicable to the electronic device, such as the name and version number of the native trusted application. The second identification information of the bytecode trusted application may include identification information such as the name and vendor name of the bytecode trusted application.

[0090] CA11 initiates a first access request. After the trusted application development platform 12 receives the first access request, the trusted application development platform 12 can determine the Native TA corresponding to the first identification information of the electronic device from the Native TAs corresponding to at least two (or more) TEE OSs connected to the trusted application development platform 12 itself based on the first identification information of the electronic device carried in the first access request, and send the first access request to the Native TA corresponding to the first identification information. For example, if the brand of the electronic device is Huawei, the first identification information of the electronic device may include the name of the native trusted application applicable to Huawei and Huawei-branded electronic devices (terminals) and the version number of the native trusted application, etc., then the trusted application development platform 12 can determine the native trusted application corresponding to Huawei iTrustee TEE OS as the native trusted application corresponding to the first identification information.

[0091] In one possible embodiment, the native trusted applications corresponding to multiple (at least two) TEE OSs can be directly integrated into the trusted application development platform 12, and the trusted application development platform 12 includes (is connected to) the native trusted applications corresponding to the multiple TEE OSs. In one possible embodiment, considering that if the native trusted applications corresponding to the multiple TEE OSs are all integrated into the trusted application development platform 12, the space occupied by the trusted application development platform 12 may be relatively large. In order to save space, the trusted application development platform 12 can first only include (is connected to) the identification information of the native trusted applications corresponding to the multiple TEE OSs. After the trusted application development platform 12 determines the identification information of the native trusted application corresponding to the first identification information of the electronic device based on the correspondence between the identification information of the electronic device and the identification information of the native trusted application, it can download and install the native trusted application corresponding to the first identification information into the trusted application development platform 12 from the backend application platform connected to the trusted application development platform 12 through over-the-air (OTA) technology. In one possible embodiment, after the trusted application development platform 12 includes the native trusted application corresponding to the first identification information, it can send a first access request to the native trusted application (Native TA) corresponding to the first identification information.

[0092] In one possible implementation, since a bytecode trusted application (BTA) can be installed in a predetermined location, such as the data area of the Native TA, Native TA13 with the first identification information can, upon receiving the first access request, determine whether Native TA13 with the first identification information itself has the BTA with the second identification information installed. If Native TA13 with the first identification information itself has the BTA with the second identification information installed, it can be assumed that a call command, etc., can be sent to the BTA with the second identification information to invoke the BTA. In one possible implementation, in order to inform CA11 that the call command, etc., can be sent, Native TA13 with the first identification information can return confirmation information to CA11.

[0093] In one possible implementation, after receiving the confirmation information returned by the Native TA13 of the first identification information, CA11 may send a call command to the Native TA13 of the first identification information. After receiving the call command sent by CA11, the Native TA13 of the first identification information may forward (such as transparently transmit) the call command to the BTA of the second identification information. After receiving the call command, the BTA of the second identification information may perform corresponding operations according to the call command. The call command can be flexibly set according to needs, and this application does not make specific restrictions on this.

[0094] Since the trusted application development platform 12 of the present application connects the native trusted applications corresponding to multiple trusted execution environment operating systems, based on the trusted application development platform 12, the bytecode trusted application can be applicable to any TEE OS. For different TEE OS hardware platforms, only one corresponding bytecode trusted application needs to be developed for one application. Compared with the related art, for the same application, different versions of trusted applications need to be developed for different TEE OS hardware platforms. The present application can reduce the development cycle and development cost of the trusted application; at the same time, the trusted application development platform 12 and bytecode trusted application developed by the present application can be applicable to different TEE OS electronic devices (terminals), thereby achieving the goal of "one-time development, multi-terminal deployment" and realizing rapid deployment and promotion of applications.

[0095] Example 2:

[0096] In order to accurately install the bytecode trusted application corresponding to the second identification information, based on the above embodiment, in the embodiment of the present application, the native trusted application 13 corresponding to the first identification information is further configured to return a prompt message indicating that the application has not been installed to the CA 11 if it determines that the native trusted application 13 has not installed the BTA 14 corresponding to the second identification information.

[0097] The CA 11 is further configured to send an installation instruction for installing the BTA 14 of the second identification information to the native trusted application 13 corresponding to the first identification information;

[0098] The native trusted application 13 corresponding to the first identification information is further configured to install the BTA 14 corresponding to the second identification information at its own set location according to the installation instruction and based on the open trust protocol OTRP; and after successful installation, send a return message of successful installation to the CA 11;

[0099] The CA11 is further configured to initiate a second access request after receiving the returned information.

[0100] In one possible implementation, if the Native TA13 of the first identification information determines that it does not have the BTA of the second identification information installed, it may return a prompt message to CA11 indicating that it has not yet been installed. The prompt message can be flexibly configured based on needs and is not specifically limited in this application. For example, the prompt message returned by the Native TA13 of the first identification information to CA11 may be a pre-set status value (STATUS_WAIT_TASM_TA).

[0101] See Figure 2In a possible implementation, the electronic device may further include a Trusted Application Management (TAM) platform. The TAM (application mall) may manage multiple BTAs, and the TAM may contain installation information such as installation packages, application signatures, and service provider public key certificates of multiple BTAs. After receiving the prompt message, CA11 may send an installation request to the TAM to install the BTA with the second identification information. After receiving the installation request to install the BTA with the second identification information, the TAM may assemble an Open Trust Protocol (OTRP) message containing the installation package, application signature, and service provider public key certificate of the BTA with the second identification information according to the installation request, and may send the OTRP message to CA11.

[0102] After CA11 receives the OTRP message sent by TAM, it can send the OTRP message and the installation instruction for installing the bytecode trusted application of the second identification information to the Native TA13 of the first identification information. In a possible implementation, the Native TA may include an OTRP message processing module. After the Native TA13 of the first identification information receives the OTRP message and the installation instruction, the OTRP message processing module in the Native TA13 of the first identification information can parse the OTRP message based on the open trust protocol OTRP, and install the BTA14 of the second identification information at its own set location based on OTRP. Among them, the set location can be flexibly set according to needs, and this application does not make specific restrictions on this. For example, the BTA can be installed at a set location such as the data area within the Native TA, and the BTA can run within the Native TA based on the WebAssembly virtual machine.

[0103] After successfully installing the BTA14 of the second identification information, the Native TA13 of the first identification information can send a return message of successful installation to CA11. After receiving the return message sent by the Native TA13 of the first identification information, CA11 can initiate an access request again (for the convenience of description, referred to as a second access request). In one possible implementation, CA11 can initiate a second access request by resending the command (CMD_OPEN_WASM_TA_SESSION). The processing process of the second access request by the trusted application development platform 12, the native trusted application 13 corresponding to the first identification information, etc. is similar to the processing process of the first access request, and will not be repeated here.

[0104] In the related art, application developers usually need to develop different versions of trusted applications for different TEE OS hardware platforms, and usually only the device manufacturers of the TEE OS hardware platform have the management authority over the trusted applications (TEE ownership), which means that application developers need to communicate technically with different device manufacturers in order to sign and distribute trusted applications corresponding to different TEE OS so that the trusted applications can run on the corresponding TEE OS. This application only needs to communicate technically with the device manufacturer when creating the Native TA corresponding to the device manufacturer's TEE OS, while the BTA developed based on the trusted application development platform 12 does not need to communicate technically with the device manufacturer. This application can sign, distribute and manage the BTA that undertakes actual business in the native trusted application based on TAM when the application developer does not have TEE ownership, so that the BTA can run on the TEE OS.

[0105] For ease of understanding, the trusted application calling process provided by this application is illustrated below through a specific embodiment. Figure 3 A schematic diagram of a first trusted application calling process provided by some embodiments is shown. Figure 4 A second trusted application calling process diagram provided by some embodiments is shown. Figure 3 and Figure 4 , the process includes the following steps:

[0106] S301: CA11 initiates a first access request to the native trusted application of the trusted execution environment operating system corresponding to CA11 connected to the trusted application development platform 12, wherein the first access request carries the first identification information of the electronic device and the second identification information of the bytecode trusted application of any application.

[0107] Among them, see Figure 2 and Figure 4 In one possible implementation, CA11 may initiate the first access request by calling the open session function (TEEC_OpenSession). CA11 may initiate the first access request based on the TEEC application programming interface (API). The TEE OS in the electronic device may receive the first access information initiated by CA11 and send the first access information to the trusted application development platform 12.

[0108] S302: The trusted application development platform 12 receives a first access request, and based on the first identification information, determines the native trusted application corresponding to the first identification information from the native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform 12, and sends the first access request to the native trusted application corresponding to the first identification information.

[0109] S303: The native trusted application 13 corresponding to the first identification information receives the first access request and determines whether the BTA 14 of the second identification information is installed on itself. If so, proceed to S304; if not, proceed to S307.

[0110] See Figure 2 For example, the native trusted application 13 corresponding to the first identification information may have multiple different BTAs installed, such as BTA1, BTA2, and BTA3.

[0111] S304: The native trusted application 13 corresponding to the first identification information returns confirmation information to CA11.

[0112] S305: After receiving the confirmation information, CA11 sends a call command to the native trusted application 13 corresponding to the first identification information.

[0113] S306: The native trusted application 13 corresponding to the first identification information transfers the call command received from the CA11 to the BTA 14 of the second identification information.

[0114] S307: The native trusted application 13 corresponding to the first identification information returns a prompt message to the CA 11 indicating that the application has not yet been installed.

[0115] Among them, see Figure 4 The prompt information returned by Native TA13 to CA11 corresponding to the first identification information may be a preset status value (STATUS_WAIT_TASM_TA).

[0116] S308: CA11 sends an installation request for BTA14 with the second identification information to TAM.

[0117] S309: The trusted application management platform receives the installation request, and assembles an open trust protocol message containing the installation information of BTA14 including the second identification information according to the installation request; and sends the open trust protocol message to CA11.

[0118] S310: CA11 receives the development trust protocol message, and sends the development trust protocol message and the installation instruction for installing the bytecode trusted application of the second identification information to the native trusted application 13 corresponding to the first identification information.

[0119] S311: The native trusted application 13 corresponding to the first identification information receives the installation instruction and the development trust protocol message, and according to the installation instruction and based on the open trust protocol, installs the BTA 14 of the second identification information at its own set location; and after the installation is successful, sends a return message of successful installation to CA11.

[0120] S312: After receiving the return information, CA11 initiates a second access request, wherein the second access request carries the first identification information of the electronic device and the second identification information of any bytecode trusted application of the application.

[0121] S313: The trusted application development platform 12 receives the second access request, and based on the first identification information, determines the native trusted application corresponding to the first identification information from the native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform 12, and sends the second access request to the native trusted application corresponding to the first identification information.

[0122] S314: The native trusted application 13 corresponding to the first identification information determines whether it has installed the BTA 14 with the second identification information. If so, proceed to S304.

[0123] Example 3:

[0124] Based on the same technical concept, this application provides a trusted application calling method, which is applied to a client application (CA). Figure 5 A third trusted application calling process diagram provided by some embodiments is shown, such as Figure 5 As shown, the process includes the following steps:

[0125] S501: Initiate a first access request to a native trusted application of a trusted execution environment operating system connected to a trusted application development platform and corresponding to the CA, wherein the first access request carries first identification information of the electronic device to which the CA belongs and second identification information of a bytecode trusted application of any application; enable the trusted application development platform to receive the first access request, enable the trusted application development platform to determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform, and enable the trusted application development platform to send the first access request to the native trusted application corresponding to the first identification information.

[0126] S502: Receive confirmation information returned by the native trusted application corresponding to the first identification information, wherein the confirmation information is sent by the native trusted application corresponding to the first identification information when it receives the first access request and determines that it has installed the bytecode trusted application of the second identification information.

[0127] S503: Send a call command to the native trusted application corresponding to the first identification information; and enable the native trusted application corresponding to the first identification information to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0128] In one possible implementation, the method further includes:

[0129] If a prompt message indicating that the native trusted application corresponding to the first identification information has not been installed is returned, sending an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information; causing the native trusted application corresponding to the first identification information to install the bytecode trusted application with the second identification information at its set location based on the Open Trust Protocol (OTRP) according to the installation instruction;

[0130] Receive return information sent by the native trusted application corresponding to the first identification information, and initiate a second access request, wherein the return information is sent by the native trusted application corresponding to the first identification information when the bytecode trusted application of the second identification information is successfully installed.

[0131] In a possible implementation, after receiving the prompt information returned by the native trusted application corresponding to the first identification information indicating that the application has not yet been installed, and before sending the installation instruction for installing the bytecode trusted application corresponding to the first identification information to the native trusted application corresponding to the first identification information, the method further includes:

[0132] Sending an installation request for the bytecode trusted application containing the second identification information to a trusted application management platform;

[0133] receiving an open trust protocol (OTRP) message containing installation information of a bytecode trusted application including the second identification information, sent by the trusted application management platform, wherein the OTRP message is sent when the trusted application management platform receives the installation request and successfully assembles the OTRP message according to the installation request;

[0134] The sending of an installation instruction for the bytecode trusted application corresponding to the first identification information to install the second identification information includes:

[0135] The OTRP message and the installation instruction for installing the bytecode trusted application of the second identification information are sent to the native trusted application corresponding to the first identification information.

[0136] After the CA of this application initiates the first access request, the trusted application development platform can determine the native trusted application corresponding to the first identification information of the electronic device carried in the first access request from the native trusted applications corresponding to at least two (or more) TEE OSs connected to the trusted application development platform; the native trusted application corresponding to the first identification information returns confirmation information to the CA after determining that it has installed the bytecode trusted application with the second identification information carried in the first access request. After receiving the confirmation information, the CA can send a call command to the native trusted application corresponding to the first identification information; the native trusted application corresponding to the first identification information can transfer the call command received from the CA to the bytecode trusted application of the second identification information, thereby realizing accurate calling of the bytecode trusted application of the second identification information. Since the trusted application development platform of this application connects the native trusted applications corresponding to multiple trusted execution environment operating systems, based on this trusted application development platform, bytecode trusted applications can be applied to any TEE OS. For different TEE OS hardware platforms, only one corresponding bytecode trusted application needs to be developed for one application. Compared with the related art, for the same application, different versions of trusted applications need to be developed for different TEE OS hardware platforms. This application can reduce the development cycle and development cost of trusted applications; at the same time, the trusted application development platform and bytecode trusted application developed by this application can be applied to different TEEOS electronic devices (terminals), thereby achieving the goal of "one-time development, multi-terminal deployment" and realizing rapid deployment and promotion of applications.

[0137] Example 4:

[0138] Based on the same technical concept, the present application provides a trusted application calling device, which is applied to a client application (CA). Figure 6 A schematic diagram of a first trusted application calling device provided by some embodiments is shown, such as Figure 6 As shown, the device includes:

[0139] An initiating module 61 is configured to initiate a first access request to a native trusted application of a trusted execution environment operating system associated with the CA and connected to a trusted application development platform, wherein the first access request carries first identification information of the electronic device to which the CA belongs and second identification information of a bytecode trusted application of any application; cause the trusted application development platform to receive the first access request, cause the trusted application development platform to determine, based on the first identification information, the native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems associated with the trusted application development platform, and cause the trusted application development platform to send the first access request to the native trusted application corresponding to the first identification information;

[0140] a first receiving module 62, configured to receive confirmation information returned by the native trusted application corresponding to the first identification information, wherein the confirmation information is sent by the native trusted application corresponding to the first identification information upon receiving the first access request and determining that the native trusted application corresponding to the first identification information has installed therein the bytecode trusted application;

[0141] The sending command module 63 is used to send a call command to the native trusted application corresponding to the first identification information; so that the native trusted application corresponding to the first identification information transfers the call command received from the CA to the bytecode trusted application of the second identification information.

[0142] In a possible implementation, the device further includes:

[0143] an installation instruction sending module configured to, upon receiving a prompt message returned by the native trusted application corresponding to the first identification information indicating that the application has not yet been installed, send an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information; and cause the native trusted application corresponding to the first identification information to install the bytecode trusted application with the second identification information at a location set by the native trusted application based on the Open Trust Protocol (OTRP) according to the installation instruction;

[0144] The initiating module 61 is also used to receive return information sent by the native trusted application corresponding to the first identification information and initiate a second access request, wherein the return information is sent by the native trusted application corresponding to the first identification information when the bytecode trusted application of the second identification information is successfully installed.

[0145] In one possible implementation, the module for sending installation instructions is also used to send an installation request for installing the bytecode trusted application with the second identification information to the trusted application management platform; receive an open trust protocol OTRP message containing the installation information of the bytecode trusted application with the second identification information sent by the trusted application management platform, wherein the OTRP message is sent when the trusted application management platform receives the installation request and successfully assembles the OTRP message according to the installation request; and send the OTRP message and the installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information.

[0146] Example 5:

[0147] Based on the same technical concept, the present application also provides an electronic device, Figure 7 A schematic diagram of the structure of a first electronic device provided by some embodiments is shown. Figure 7As shown, it includes: a processor 71, a communication interface 72, a memory 73 and a communication bus 74, wherein the processor 71, the communication interface 72, and the memory 73 communicate with each other through the communication bus 74;

[0148] The memory 73 stores a computer program. When the program is executed by the processor 71, the processor 71 performs the following steps:

[0149] Initiating a first access request to a native trusted application of a trusted execution environment operating system associated with the CA and linked to a trusted application development platform, wherein the first access request carries first identification information of the electronic device to which the CA belongs and second identification information of a bytecode trusted application of any application; causing the trusted application development platform to receive the first access request, causing the trusted application development platform to determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems associated with the trusted application development platform, and causing the trusted application development platform to send the first access request to the native trusted application corresponding to the first identification information;

[0150] receiving confirmation information returned by the native trusted application corresponding to the first identification information, wherein the confirmation information is sent by the native trusted application corresponding to the first identification information when the native trusted application receives the first access request and determines that the native trusted application corresponding to the first identification information has installed the bytecode trusted application corresponding to the second identification information;

[0151] Send a call command to the native trusted application corresponding to the first identification information; and enable the native trusted application corresponding to the first identification information to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0152] In one possible implementation, the processor 71 is further configured to, upon receiving a prompt message returned by the native trusted application corresponding to the first identification information indicating that the application has not yet been installed, send an installation instruction for installing the bytecode trusted application of the second identification information to the native trusted application corresponding to the first identification information; and cause the native trusted application corresponding to the first identification information to install the bytecode trusted application of the second identification information at its set location based on the open trust protocol (OTRP) according to the installation instruction.

[0153] Receive return information sent by the native trusted application corresponding to the first identification information, and initiate a second access request, wherein the return information is sent by the native trusted application corresponding to the first identification information when the bytecode trusted application of the second identification information is successfully installed.

[0154] In one possible embodiment, the processor 71 is also used to send an installation request for the bytecode trusted application with the second identification information to the trusted application management platform; receive an open trust protocol OTRP message containing the installation information of the bytecode trusted application with the second identification information sent by the trusted application management platform, wherein the OTRP message is sent when the trusted application management platform receives the installation request and successfully assembles the OTRP message according to the installation request; and send the OTRP message and the installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information.

[0155] Since the principle of solving the problem by the above electronic device is similar to the trusted application calling method, the implementation of the above electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0156] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0157] The communication interface 72 is used for communication between the electronic device and other devices.

[0158] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk memory. Alternatively, the memory may be at least one storage device located away from the processor.

[0159] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processing processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0160] Example 6:

[0161] Based on the same technical concept, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program executable by an electronic device. When the program is executed on the electronic device, the electronic device implements the following steps:

[0162] Initiating a first access request to a native trusted application of a trusted execution environment operating system associated with the CA and linked to a trusted application development platform, wherein the first access request carries first identification information of the electronic device to which the CA belongs and second identification information of a bytecode trusted application of any application; causing the trusted application development platform to receive the first access request, causing the trusted application development platform to determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems associated with the trusted application development platform, and causing the trusted application development platform to send the first access request to the native trusted application corresponding to the first identification information;

[0163] receiving confirmation information returned by the native trusted application corresponding to the first identification information, wherein the confirmation information is sent by the native trusted application corresponding to the first identification information when the native trusted application receives the first access request and determines that the native trusted application corresponding to the first identification information has installed the bytecode trusted application corresponding to the second identification information;

[0164] Send a call command to the native trusted application corresponding to the first identification information; and enable the native trusted application corresponding to the first identification information to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0165] In one possible implementation, the method further includes:

[0166] If a prompt message indicating that the native trusted application corresponding to the first identification information has not been installed is returned, sending an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information; causing the native trusted application corresponding to the first identification information to install the bytecode trusted application with the second identification information at its set location based on the Open Trust Protocol (OTRP) according to the installation instruction;

[0167] Receive return information sent by the native trusted application corresponding to the first identification information, and initiate a second access request, wherein the return information is sent by the native trusted application corresponding to the first identification information when the bytecode trusted application of the second identification information is successfully installed.

[0168] In a possible implementation, after receiving the prompt information returned by the native trusted application corresponding to the first identification information indicating that the application has not yet been installed, and before sending the installation instruction for installing the bytecode trusted application corresponding to the first identification information to the native trusted application corresponding to the first identification information, the method further includes:

[0169] Sending an installation request for the bytecode trusted application containing the second identification information to a trusted application management platform;

[0170] receiving an open trust protocol (OTRP) message containing installation information of a bytecode trusted application including the second identification information, sent by the trusted application management platform, wherein the OTRP message is sent when the trusted application management platform receives the installation request and successfully assembles the OTRP message according to the installation request;

[0171] The sending of an installation instruction for the bytecode trusted application corresponding to the first identification information to install the second identification information includes:

[0172] The OTRP message and the installation instruction for installing the bytecode trusted application of the second identification information are sent to the native trusted application corresponding to the first identification information.

[0173] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the trusted application calling method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0174] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memories (NANDFLASH), solid-state drives (SSDs), etc.

[0175] Example 7:

[0176] Based on the same technical concept, this application provides a trusted application calling method, which is applied to native trusted applications. Figure 8 A fourth trusted application calling process diagram provided by some embodiments is shown, such as Figure 8 As shown, the process includes the following steps:

[0177] S801: Receive a first access request, wherein the first access request carries first identification information of an electronic device and second identification information of a bytecode trusted application of any application.

[0178] S802: Determine whether the bytecode trusted application with the second identification information is installed in the device, and if so, return confirmation information to the CA.

[0179] S803: Receive a call command sent by the CA, where the call command is a command sent by the CA to the native trusted application corresponding to the first identification information after receiving the confirmation information.

[0180] S804: Forward the call command received from the CA to the bytecode trusted application of the second identification information.

[0181] In one possible implementation, the method further includes:

[0182] If it is determined that the bytecode trusted application with the second identification information is not installed, a prompt message indicating that the application has not been installed is returned to the CA; and the CA sends an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information;

[0183] Receive the installation instruction, and according to the installation instruction, install the bytecode trusted application of the second identification information at its own set location based on the open trust protocol OTRP; and after the installation is successful, send a return message of successful installation to the CA; after the CA receives the return message, initiate a second access request.

[0184] After the CA of this application initiates the first access request, the trusted application development platform can determine the native trusted application corresponding to the first identification information carried in the first access request from the native trusted applications corresponding to at least two (or more) TEE OSs connected to the trusted application development platform; the native trusted application corresponding to the first identification information returns confirmation information to the CA after determining that it has installed the bytecode trusted application with the second identification information carried in the first access request. After receiving the confirmation information, the CA can send a call command to the native trusted application corresponding to the first identification information; the native trusted application corresponding to the first identification information can transfer the call command received from the CA to the bytecode trusted application with the second identification information, thereby realizing accurate calling of the bytecode trusted application with the second identification information. Since the trusted application development platform of this application connects the native trusted applications corresponding to multiple trusted execution environment operating systems, based on this trusted application development platform, bytecode trusted applications can be applied to any TEE OS. For different TEE OS hardware platforms, only one corresponding bytecode trusted application needs to be developed for one application. Compared with the related art, for the same application, different versions of trusted applications need to be developed for different TEE OS hardware platforms. This application can reduce the development cycle and development cost of trusted applications; at the same time, the trusted application development platform and bytecode trusted application developed by this application can be applied to different TEE OS electronic devices (terminals), thereby achieving the goal of "one-time development, multi-terminal deployment" and realizing rapid deployment and promotion of applications.

[0185] Example 8:

[0186] Based on the same technical concept, the present application provides a trusted application calling device, which is applied to a native trusted application (a native trusted application corresponding to the first identification information of the electronic device). Figure 9 A schematic diagram of a second trusted application calling device provided by some embodiments is shown, such as Figure 9 As shown, the device includes:

[0187] A second receiving module 91 is configured to receive a first access request, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application;

[0188] A determination module 92 is configured to determine whether the bytecode trusted application with the second identification information is installed on the module, and if so, return confirmation information to the CA;

[0189] A third receiving module 93 is configured to receive a call command sent by the CA, wherein the call command is a command sent by the CA to the native trusted application corresponding to the first identification information after receiving the confirmation information;

[0190] The transfer module 94 is configured to transfer the call command received from the CA to the bytecode trusted application of the second identification information.

[0191] In a possible implementation, the device further includes:

[0192] a prompt module, configured to, if it is determined that the native trusted application corresponding to the first identification information has not installed the bytecode trusted application corresponding to the second identification information, return a prompt message to the CA indicating that the application has not been installed; and cause the CA to send an installation instruction to the native trusted application corresponding to the first identification information to install the bytecode trusted application corresponding to the second identification information;

[0193] The installation module is used to receive the installation instruction, and according to the installation instruction, based on the open trust protocol OTRP, install the bytecode trusted application of the second identification information at its own set location; and after the installation is successful, send a return message of successful installation to the CA; after the CA receives the return message, it initiates a second access request.

[0194] Example 9:

[0195] Based on the same technical concept, the present application also provides an electronic device, Figure 10 A schematic diagram of the structure of a second electronic device provided by some embodiments is shown. Figure 10 As shown, it includes: a processor 101, a communication interface 102, a memory 103 and a communication bus 104, wherein the processor 101, the communication interface 102, and the memory 103 communicate with each other through the communication bus 104;

[0196] The memory 103 stores a computer program. When the program is executed by the processor 101, the processor 101 performs the following steps:

[0197] receiving a first access request, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application;

[0198] Determine whether the bytecode trusted application with the second identification information is installed on the device, and if so, return confirmation information to the CA;

[0199] receiving a call command sent by the CA, wherein the call command is a command sent by the CA to the native trusted application corresponding to the first identification information after receiving the confirmation information;

[0200] The calling command received from the CA is forwarded to the bytecode trusted application of the second identification information.

[0201] In one possible implementation, the processor 101 is further configured to, if it is determined that the bytecode trusted application corresponding to the second identification information is not installed, return a prompt message to the CA indicating that the application has not been installed; and cause the CA to send an installation instruction for installing the bytecode trusted application corresponding to the second identification information to the native trusted application corresponding to the first identification information;

[0202] Receive the installation instruction, and according to the installation instruction, install the bytecode trusted application of the second identification information at its own set location based on the open trust protocol OTRP; and after the installation is successful, send a return message of successful installation to the CA; after the CA receives the return message, initiate a second access request.

[0203] Since the principle of solving the problem by the above electronic device is similar to the trusted application calling method, the implementation of the above electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0204] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0205] The communication interface 102 is used for communication between the electronic device and other devices.

[0206] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk memory. Alternatively, the memory may be at least one storage device located away from the processor.

[0207] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processing processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0208] Example 10:

[0209] Based on the same technical concept, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program executable by an electronic device. When the program is executed on the electronic device, the electronic device implements the following steps:

[0210] receiving a first access request, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application;

[0211] Determine whether the bytecode trusted application with the second identification information is installed on the device, and if so, return confirmation information to the CA;

[0212] receiving a call command sent by the CA, wherein the call command is a command sent by the CA to the native trusted application corresponding to the first identification information after receiving the confirmation information;

[0213] The calling command received from the CA is forwarded to the bytecode trusted application of the second identification information.

[0214] In one possible implementation, the method further includes:

[0215] If it is determined that the bytecode trusted application with the second identification information is not installed, a prompt message indicating that the application has not been installed is returned to the CA; and the CA sends an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information;

[0216] Receive the installation instruction, and according to the installation instruction, install the bytecode trusted application of the second identification information at its own set location based on the open trust protocol OTRP; and after the installation is successful, send a return message of successful installation to the CA; after the CA receives the return message, initiate a second access request.

[0217] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the trusted application calling method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0218] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memories (NANDFLASH), solid-state drives (SSDs), etc.

[0219] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0220] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0221] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0222] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0223] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. An electronic device, characterized in that: The electronic device includes: a client application CA and a trusted application development platform; The CA is configured to initiate a first access request to a native trusted application of a trusted execution environment operating system associated with the trusted application development platform and corresponding to the CA, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application; The trusted application development platform is configured to receive the first access request, determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform, and send the first access request to the native trusted application corresponding to the first identification information; The native trusted application corresponding to the first identification information is configured to receive the first access request and determine whether the bytecode trusted application corresponding to the second identification information is installed on the native trusted application, and if so, return confirmation information to the CA; The CA is further configured to, after receiving the confirmation information, send a call command to the native trusted application corresponding to the first identification information; The native trusted application corresponding to the first identification information is further configured to transfer the call command received from the CA to the bytecode trusted application corresponding to the second identification information; The native trusted application corresponding to the first identification information is further configured to return a prompt message indicating that the application has not been installed to the CA if it is determined that the bytecode trusted application corresponding to the second identification information is not installed. The CA is further configured to send an installation instruction for installing the bytecode trusted application corresponding to the second identification information to the native trusted application corresponding to the first identification information; The native trusted application corresponding to the first identification information is further configured to install the bytecode trusted application corresponding to the second identification information at its own set location based on the open trust protocol (OTRP) according to the installation instruction; and after successful installation, send a return message of successful installation to the CA; The CA is further configured to initiate a second access request after receiving the returned information.

2. The electronic device according to claim 1, wherein The electronic device further comprises: A creation module is used to create the trusted application development platform based on bytecode technology that supports cross-platform functions, wherein the trusted application development platform connects native trusted applications corresponding to at least two trusted execution environment operating systems.

3. The electronic device according to claim 1, wherein The electronic device further comprises: a trusted application management platform; The CA is further configured to send an installation request for the bytecode trusted application containing the second identification information to the trusted application management platform; The trusted application management platform is configured to receive the installation request, assemble an Open Trust Protocol (OTRP) message containing installation information of the bytecode trusted application including the second identification information according to the installation request, and send the OTRP message to the CA; The CA is specifically configured to receive the OTRP message, and send the OTRP message and an installation instruction for installing the bytecode trusted application of the second identification information to the native trusted application corresponding to the first identification information.

4. A trusted application calling method, characterized in that: The method is applied to a client application CA, and the method includes: Initiating a first access request to a native trusted application of a trusted execution environment operating system associated with the CA and linked to a trusted application development platform, wherein the first access request carries first identification information of the electronic device to which the CA belongs and second identification information of a bytecode trusted application of any application; causing the trusted application development platform to receive the first access request, causing the trusted application development platform to determine, based on the first identification information, a native trusted application corresponding to the first identification information from among the native trusted applications corresponding to at least two trusted execution environment operating systems associated with the trusted application development platform, and causing the trusted application development platform to send the first access request to the native trusted application corresponding to the first identification information; receiving confirmation information returned by the native trusted application corresponding to the first identification information, wherein the confirmation information is sent by the native trusted application corresponding to the first identification information when the native trusted application receives the first access request and determines that the native trusted application corresponding to the first identification information has installed the bytecode trusted application corresponding to the second identification information; Sending a call command to the native trusted application corresponding to the first identification information; causing the native trusted application corresponding to the first identification information to forward the call command received from the CA to the bytecode trusted application of the second identification information; If a prompt message indicating that the native trusted application corresponding to the first identification information has not been installed is returned, sending an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information; causing the native trusted application corresponding to the first identification information to install the bytecode trusted application with the second identification information at its set location based on the Open Trust Protocol (OTRP) according to the installation instruction; Receive return information sent by the native trusted application corresponding to the first identification information, and initiate a second access request, wherein the return information is sent by the native trusted application corresponding to the first identification information when the bytecode trusted application of the second identification information is successfully installed.

5. The method according to claim 4, characterized in that After receiving the prompt information returned by the native trusted application corresponding to the first identification information indicating that the application has not been installed, and before sending the installation instruction for installing the bytecode trusted application corresponding to the first identification information to the native trusted application corresponding to the first identification information, the method further includes: Sending an installation request for the bytecode trusted application containing the second identification information to a trusted application management platform; receiving an open trust protocol (OTRP) message containing installation information of a bytecode trusted application including the second identification information, sent by the trusted application management platform, wherein the OTRP message is sent when the trusted application management platform receives the installation request and successfully assembles the OTRP message according to the installation request; The sending of an installation instruction for the bytecode trusted application corresponding to the first identification information to install the second identification information includes: The OTRP message and the installation instruction for installing the bytecode trusted application of the second identification information are sent to the native trusted application corresponding to the first identification information.

6. A trusted application calling method, characterized in that: The method is applied to native trusted applications and includes: receiving a first access request, wherein the first access request carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application; Determine whether the bytecode trusted application with the second identification information is installed on the device, and if so, return confirmation information to the CA; receiving a call command sent by the CA, wherein the call command is a command sent by the CA to the native trusted application corresponding to the first identification information after receiving the confirmation information; forwarding the call command received from the CA to the bytecode trusted application of the second identification information; If it is determined that the bytecode trusted application with the second identification information is not installed, a prompt message indicating that the application has not been installed is returned to the CA; and the CA sends an installation instruction for installing the bytecode trusted application with the second identification information to the native trusted application corresponding to the first identification information; Receive the installation instruction, and according to the installation instruction, install the bytecode trusted application of the second identification information at its own set location based on the open trust protocol OTRP; and after the installation is successful, send a return message of successful installation to the CA; after the CA receives the return message, initiate a second access request.

7. An electronic device, characterized in that: The electronic device includes at least a processor and a memory, and the processor is used to implement the steps of the trusted application calling method as described in any one of claims 4-5 when executing the computer program stored in the memory, or to implement the steps of the trusted application calling method as described in claim 6.

Images