An electronic device

Abstract

The application discloses an electronic device, a trusted application calling method and device, equipment and a medium, and is used for accurately managing trusted applications. In the application, after CA initiates calling information, the trusted application development platform can receive the calling information, determine a native trusted application corresponding to first identification information carried by the calling information from at least two TEE OSs corresponding to the native trusted applications contained in the trusted application development platform, and send the calling information to the native trusted application corresponding to the first identification information. The native trusted application corresponding to the first identification information receives the calling information, determines a bytecode trusted application corresponding to second identification information according to the second identification information carried by the calling information from at least one bytecode trusted application installed in the native trusted application, and calls the bytecode trusted application corresponding to the second identification information according to the calling information, so that the multiple bytecode trusted applications are managed in the native trusted application, and the purpose of accurately managing the trusted applications is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of trusted application invocation, and in particular to an electronic device, a trusted application invocation method and device, an electronic device, and a medium. BACKGROUND

[0002] The development of mobile communication technology has brought about the rapid development of mobile terminal technology. Modern mobile terminal devices provide a powerful and flexible Rich Execution Environment (REE), but at the same time, they also make the devices vulnerable to security threats. The Trusted Execution Environment (TEE) is a technical solution proposed to address the security risks existing in current mobile terminal devices. The TEE and the REE run in parallel on the same device. The TEE can ensure the storage, processing, and protection of sensitive data in a trusted environment and provides a secure execution environment for authorized security software (trusted software). Through execution protection, privacy, integrity, and data access permissions, end-to-end security is achieved. Among them, the Trusted Application (TA) runs on the TEE, and the Client Application (CA) runs on the REE. The CA invokes the TA to use the security functions provided by the TEE and the TA.

[0003] Traditional trusted applications are generally machine code programs running on a Trusted Execution Environment Operating System (TEE OS). For the same application, different versions of trusted applications need to be developed for different TEE OS hardware platforms such as Huawei iTrustee and Qualcomm QSEE to meet the usage requirements of different TEE OS hardware platforms. Therefore, it is necessary to develop trusted applications that can be applied to multiple TEE OS and can be used across different TEE OS hardware platforms.

[0004] However, even if a trusted application that can be applied to multiple TEE OS and can be used across different TEE OS hardware platforms is developed, how to manage the trusted application is a technical problem that needs to be solved at present. SUMMARY

[0005] The present application provides an electronic device, a trusted application invocation method and device, an electronic device, and a medium for accurately managing trusted applications.

[0006] In a first aspect, the present application provides an electronic device, comprising a client application CA and a trusted application development platform.

[0007] The CA is configured to initiate calling information of a native trusted application of a trusted execution environment operating system corresponding to the CA, which is connected to the trusted application development platform, wherein the calling information carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application.

[0008] The trusted application development platform is configured to receive the calling information, determine a native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform, and send the calling information to the native trusted application corresponding to the first identification information.

[0009] The native trusted application corresponding to the first identification information is configured to receive the calling information, determine a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the native trusted application, and call the bytecode trusted application corresponding to the second identification information according to the calling information.

[0010] The bytecode trusted application corresponding to the second identification information is configured to receive calling of the native trusted application corresponding to the first identification information, and perform corresponding operations according to the calling of the native trusted application corresponding to the first identification information.

[0011] In a possible implementation, the electronic device further includes:

[0012] A creating module is configured to create the trusted application development platform based on bytecode technology supporting cross-platform functions, wherein the trusted application development platform is connected to native trusted applications corresponding to at least two trusted execution environment operating systems.

[0013] In a possible implementation, the native trusted application corresponding to the first identification information is specifically configured to, if the received calling information is an access request, create a native trusted application instance, open a native trusted application session based on the native trusted application instance, and send a first instruction of opening the session to the bytecode trusted application corresponding to the second identification information.

[0014] The bytecode trusted application corresponding to the second identification information is specifically configured to, if the first instruction is received, create a bytecode trusted application instance, and open a bytecode trusted application session based on the bytecode trusted application instance.

[0015] In a possible implementation, the native trusted application corresponding to the first identification information is specifically configured to, if the received calling information is a calling command, transfer the calling command to the bytecode trusted application corresponding to the second identification information.

[0016] In a possible implementation, the bytecode trusted application corresponding to the second identification information is further configured to identify location information of a data storage location of the bytecode trusted application, and return the location information to the native trusted application corresponding to the first identification information.

[0017] The native trusted application corresponding to the first identification information is specifically configured to, if the location information is received, hand over the calling command to the bytecode trusted application corresponding to the second identification information based on the location information.

[0018] In a possible implementation, the bytecode trusted application corresponding to the second identification information is further configured to return an execution result of the calling command to the native trusted application corresponding to the first identification information.

[0019] The native trusted application corresponding to the first identification information is further configured to send the execution result to the CA.

[0020] In a possible implementation, the native trusted application corresponding to the first identification information is specifically configured to, if the received calling information is session closing information, send a second instruction of closing a session to the bytecode trusted application corresponding to the second identification information, and close a native trusted application session.

[0021] The bytecode trusted application corresponding to the second identification information is specifically configured to, if the second instruction is received, close a bytecode trusted application session, and destroy a bytecode trusted application instance.

[0022] The native trusted application corresponding to the first identification information is specifically configured to destroy a native trusted application instance.

[0023] In a possible implementation, the native trusted application corresponding to the first identification information is further configured to configure an independent subdirectory for each bytecode trusted application; for each bytecode trusted application, based on the independent subdirectory corresponding to the bytecode trusted application, the bytecode trusted application is configured with a specific access path, so that the bytecode trusted application accesses file information in the corresponding independent subdirectory.

[0024] In a possible implementation, the electronic device further includes a trusted execution environment operating system (TEE OS);

[0025] The TEE OS is configured to receive the calling information initiated by the CA, and send the calling information to the trusted application development platform.

[0026] The trusted application development platform is specifically configured to receive the calling information sent by the TEE OS based on a first global platform organization (GP) interface provided by the TEE OS or a self-owned interface.

[0027] In a possible implementation, the native trusted application corresponding to the first identification information is specifically configured to call the bytecode trusted application corresponding to the second identification information based on a preconfigured conversion interface.

[0028] The bytecode trusted application corresponding to the second identification information is specifically configured to receive the call of the native trusted application corresponding to the first identification information based on a preconfigured second GP interface.

[0029] In a second aspect, the present application further provides a trusted application calling method, the method being applied to a native trusted application, and the method comprising the following steps:

[0030] receiving calling information sent by a trusted application development platform, wherein the calling information carries first identification information of an electronic device and second identification information of a bytecode trusted application of any application; the calling information is calling information of a native trusted application of a trusted execution environment operating system corresponding to a client application (CA) and coupled to the trusted application development platform, which is initiated by the CA; the trusted application development platform sends the calling information when determining a native trusted application corresponding to the first identification information from at least two native trusted applications respectively corresponding to at least two trusted execution environment operating systems coupled to the trusted application development platform according to the first identification information;

[0031] determining a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the electronic device according to the second identification information, and calling the bytecode trusted application corresponding to the second identification information according to the calling information; making the bytecode trusted application corresponding to the second identification information receive the call of the native trusted application corresponding to the first identification information, and making the bytecode trusted application corresponding to the second identification information perform corresponding operations according to the call of the native trusted application corresponding to the first identification information.

[0032] In a possible implementation, if the received calling information is an access request, the calling of the bytecode trusted application corresponding to the second identification information according to the calling information comprises:

[0033] creating a native trusted application instance, opening a native trusted application session based on the native trusted application instance; and sending a first instruction of opening a session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information creates a bytecode trusted application instance after receiving the first instruction, and opens a bytecode trusted application session based on the bytecode trusted application instance.

[0034] In a possible implementation, if the received calling information is a calling command, the calling the bytecode trusted application corresponding to the second identification information according to the calling information comprises:

[0035] delivering the calling command to the bytecode trusted application corresponding to the second identification information.

[0036] In a possible implementation, after receiving the calling information sent by the trusted application development platform, and before delivering the calling command to the bytecode trusted application corresponding to the second identification information, the method further comprises:

[0037] receiving position information sent by the bytecode trusted application corresponding to the second identification information; wherein the position information is sent by the bytecode trusted application corresponding to the second identification information when the bytecode trusted application corresponding to the second identification information identifies the position information of the data storage position of itself;

[0038] the delivering the calling command to the bytecode trusted application corresponding to the second identification information comprises:

[0039] delivering the calling command to the bytecode trusted application corresponding to the second identification information identified by the position information based on the position information.

[0040] In a possible implementation, the method further comprises:

[0041] if the execution result sent by the bytecode trusted application corresponding to the second identification information is received, sending the execution result to the CA; wherein the execution result is sent by the bytecode trusted application corresponding to the second identification information after the bytecode trusted application corresponding to the second identification information executes the calling command.

[0042] In a possible implementation, if the received calling information is a closing session information, the calling the bytecode trusted application corresponding to the second identification information according to the calling information comprises:

[0043] close the native trusted application session, and send a second instruction of closing a session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information closes the bytecode trusted application session when receiving the second instruction, and destroys the bytecode trusted application instance corresponding to the second identification information;

[0044] destroy the native trusted application instance.

[0045] In a possible implementation, the method further includes:

[0046] configure an independent subdirectory for each bytecode trusted application respectively; and for each bytecode trusted application, configure a specific access path for the bytecode trusted application based on the independent subdirectory corresponding to the bytecode trusted application, so that the bytecode trusted application accesses file information in the corresponding independent subdirectory.

[0047] In a possible implementation, the calling the bytecode trusted application corresponding to the second identification information includes:

[0048] calling the bytecode trusted application corresponding to the second identification information based on a preconfigured conversion interface.

[0049] In a third aspect, the present application provides a trusted application calling method, which is applied to a bytecode trusted application, and includes:

[0050] receiving a call of a native trusted application corresponding to first identification information; the call is initiated by the native trusted application corresponding to the first identification information according to call information sent by a trusted application development platform, when the native trusted application corresponding to the first identification information determines a bytecode trusted application corresponding to second identification information from at least one bytecode trusted application installed in the native trusted application corresponding to the first identification information itself according to the second identification information carried in the call information; wherein the call information is sent by the trusted application development platform when the trusted application development platform receives call information of a native trusted application of a trusted execution environment operating system corresponding to a client application (CA) initiated by the CA and connected to the trusted application development platform, and the trusted application development platform determines the native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to the trusted execution environment operating system connected to the trusted application development platform respectively according to first identification information of an electronic device carried in the call information;

[0051] performing a corresponding operation according to the call of the native trusted application corresponding to the first identification information.

[0052] In a possible implementation, the operation corresponding to the call of the native trusted application corresponding to the first identification information comprises:

[0053] If a first instruction of opening a session sent by the native trusted application corresponding to the first identification information is received, a bytecode trusted application instance is created, and a bytecode trusted application session is opened based on the bytecode trusted application instance; wherein the first instruction is sent by the native trusted application corresponding to the first identification information when the native trusted application corresponding to the first identification information identifies that the received call information is an access request, the native trusted application corresponding to the first identification information creates a native trusted application instance, and opens a native trusted application session based on the native trusted application instance.

[0054] In a possible implementation, after the bytecode trusted application session is opened, and before the call command transferred by the native trusted application corresponding to the first identification information is received, the method further comprises:

[0055] location information of a data storage position of the bytecode trusted application corresponding to the second identification information is identified, and the location information is returned to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information receives the location information, and the native trusted application corresponding to the first identification information transfers the call command to the bytecode trusted application corresponding to the second identification information identified by the location information based on the location information.

[0056] In a possible implementation, the method further comprises:

[0057] The execution result of the call command is returned to the native trusted application corresponding to the first identification information; and the native trusted application corresponding to the first identification information sends the execution result to the CA.

[0058] In a possible implementation, the operation corresponding to the call of the native trusted application corresponding to the first identification information comprises:

[0059] If a second instruction of closing a session sent by the native trusted application corresponding to the first identification information is received, the bytecode trusted application session is closed, and the bytecode trusted application instance is destroyed; wherein the second instruction is sent by the native trusted application corresponding to the first identification information when the received call information is closing session information.

[0060] In a possible implementation, the call of the native trusted application corresponding to the first identification information comprises:

[0061] receive, based on a preconfigured second GP interface, a call of the native trusted application corresponding to the first identification information.

[0062] In a fourth aspect, the present application provides a trusted application calling apparatus. The apparatus is applied to a native trusted application, and comprises:

[0063] The first receiving module is configured to receive calling information sent by a trusted application development platform, wherein the calling information carries first identification information of an electronic device and second identification information of a bytecode trusted application of any application; the calling information is calling information of a native trusted application of a trusted execution environment operating system corresponding to a client application (CA), which is initiated by the CA and sent by the trusted application development platform, when the trusted application development platform receives the calling information; the trusted application development platform determines a native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to the first identification information, which are connected to the trusted application development platform and correspond to at least two trusted execution environment operating systems respectively; and the calling information is sent by the trusted execution environment operating system corresponding to the first identification information according to the first identification information.

[0064] The calling module is configured to determine a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the apparatus according to the second identification information, and call the bytecode trusted application corresponding to the second identification information according to the calling information; make the bytecode trusted application corresponding to the second identification information receive a call of the native trusted application corresponding to the first identification information, and make the bytecode trusted application corresponding to the second identification information perform corresponding operations according to the call of the native trusted application corresponding to the first identification information.

[0065] In a possible implementation, the calling module is specifically configured to, if the received calling information is an access request, create a native trusted application instance, open a native trusted application session based on the native trusted application instance, and send a first instruction of opening a session to the bytecode trusted application corresponding to the second identification information; make the bytecode trusted application corresponding to the second identification information create a bytecode trusted application instance after receiving the first instruction, and make the bytecode trusted application corresponding to the second identification information open a bytecode trusted application session based on the bytecode trusted application instance.

[0066] In a possible implementation, the calling module is specifically configured to, if the received calling information is a call command, transfer the call command to the bytecode trusted application corresponding to the second identification information.

[0067] In a possible implementation, the calling module is further configured to receive position information sent by the bytecode trusted application corresponding to the second identification information; the position information is sent by the bytecode trusted application corresponding to the second identification information when the bytecode trusted application identifies position information of a data storage location.

[0068] The calling module is specifically configured to, based on the position information, transfer the calling command to the bytecode trusted application corresponding to the second identification information identified by the position information.

[0069] In a possible implementation, the apparatus further includes:

[0070] The sending module is configured to, if receiving an execution result sent by the bytecode trusted application corresponding to the second identification information, send the execution result to the CA; the execution result is sent by the bytecode trusted application corresponding to the second identification information after the bytecode trusted application executes the calling command.

[0071] In a possible implementation, the calling module is specifically configured to, if the received calling information is closing session information, close a native trusted application session, and send a second instruction of closing a session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information closes a bytecode trusted application session when receiving the second instruction, and the bytecode trusted application corresponding to the second identification information destroys a bytecode trusted application instance.

[0072] Destroy the native trusted application instance.

[0073] In a possible implementation, the apparatus further includes:

[0074] The configuration module is configured to configure an independent subdirectory for each bytecode trusted application; for each bytecode trusted application, based on the independent subdirectory corresponding to the bytecode trusted application, the configuration module configures a specific access path for the bytecode trusted application, so that the bytecode trusted application accesses file information in the corresponding independent subdirectory.

[0075] In a possible implementation, the calling module is specifically configured to call the bytecode trusted application corresponding to the second identification information based on a preconfigured conversion interface.

[0076] In a fifth aspect, the present application provides a trusted application calling apparatus, the apparatus being applied to a bytecode trusted application, and the apparatus including:

[0077] The second receiving module is configured to receive a call of the native trusted application corresponding to the first identification information; the call is initiated by the native trusted application corresponding to the first identification information according to the calling information when the native trusted application corresponding to the first identification information receives the calling information sent by the trusted application development platform, and the native trusted application corresponding to the first identification information determines the bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the native trusted application corresponding to the first identification information according to the second identification information carried in the calling information; wherein the calling information is sent by the trusted application development platform when the trusted application development platform receives the calling information of the native trusted application of the trusted execution environment operating system corresponding to the CA connected with the CA initiated by the client application (CA), and the trusted application development platform determines the native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to the trusted execution environment operating system connected with the trusted application development platform according to the first identification information of the electronic device carried in the calling information.

[0078] The execution module is configured to perform a corresponding operation according to the call of the native trusted application corresponding to the first identification information.

[0079] In a possible implementation, the execution module is specifically configured to create a bytecode trusted application instance and open a bytecode trusted application session based on the bytecode trusted application instance if a first instruction of opening a session sent by the native trusted application corresponding to the first identification information is received; wherein the first instruction is sent by the native trusted application corresponding to the first identification information when the native trusted application corresponding to the first identification information identifies that the received calling information is an access request, creates a native trusted application instance, and opens a native trusted application session based on the native trusted application instance.

[0080] In a possible implementation, the execution module is further configured to identify location information of a data storage location of the execution module, and return the location information to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information receives the location information, and the native trusted application corresponding to the first identification information transfers the calling command to the bytecode trusted application corresponding to the second identification information identified by the location information based on the location information.

[0081] In a possible implementation, the execution module is further configured to return an execution result of the calling command to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information sends the execution result to the CA.

[0082] In a possible implementation, the execution module is specifically configured to, if the first identification information corresponds to a second instruction of closing a session sent by the native trusted application, close the bytecode trusted application session and destroy the bytecode trusted application instance; wherein the second instruction is sent by the native trusted application corresponding to the first identification information to the bytecode trusted application corresponding to the second identification information when the received calling information is closing session information.

[0083] In a possible implementation, the second receiving module is specifically configured to receive calling of the native trusted application corresponding to the first identification information based on a preconfigured second GP interface.

[0084] In a sixth aspect, the present application provides an electronic device, which comprises at least a processor and a memory, and the processor is configured to implement the steps of the trusted application calling method according to any of the above aspects when executing the computer program stored in the memory.

[0085] In a seventh aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is configured to implement the steps of the trusted application calling method according to any of the above aspects when executed by a processor.

[0086] Since the CA initiates the calling information in the present application, the trusted application development platform can receive the calling information, and determine the native trusted application corresponding to the first identification information of the electronic device carried by the calling information from at least two (multiple) TEE OSs corresponding to the native trusted application, and send the calling information to the native trusted application corresponding to the first identification information; the native trusted application corresponding to the first identification information receives the calling information, and determines the bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in itself according to the second identification information carried by the calling information, and calls the bytecode trusted application corresponding to the second identification information according to the calling information; the bytecode trusted application corresponding to the second identification information can receive the calling of the native trusted application corresponding to the first identification information, and perform corresponding operations according to the calling of the native trusted application corresponding to the first identification information, so as to accurately call the bytecode trusted application of the second identification information, and realize the management of multiple bytecode trusted applications in the native trusted application, and achieve the purpose of accurately managing the trusted application. BRIEF DESCRIPTION OF DRAWINGS

[0087] In order to more clearly illustrate the embodiments of the present application or the implementation manners in the related art, the accompanying drawings needed to be used in the embodiments or related art description will be briefly introduced. Obviously, the accompanying drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0088] Figure 1 A first electronic device structure schematic diagram provided by some embodiments is shown;

[0089] Figure 2 A second electronic device structure schematic diagram provided by some embodiments is shown;

[0090] Figure 3 A first trusted application calling process schematic diagram provided by some embodiments is shown;

[0091] Figure 4 A second trusted application calling process schematic diagram provided by some embodiments is shown;

[0092] Figure 5 A first trusted application calling device schematic diagram provided by some embodiments is shown;

[0093] Figure 6 A first electronic device structure schematic diagram provided by some embodiments is shown;

[0094] Figure 7 A third trusted application calling process schematic diagram provided by some embodiments is shown;

[0095] Figure 8 A second trusted application calling device schematic diagram provided by some embodiments is shown;

[0096] Figure 9 A second electronic device structure schematic diagram provided by some embodiments is shown. DETAILED DESCRIPTION

[0097] In order to accurately manage the trusted application, the present application provides an electronic device, a trusted application calling method, a device, an apparatus and a medium.

[0098] In order to make the purpose and implementation manner of the present application more clear, the present application will be described clearly and completely in the following description of the exemplary embodiments of the present application with reference to the accompanying drawings. Obviously, the described exemplary embodiments are only some embodiments of the present application, not all embodiments.

[0099] The terms "first", "second", "third", and the like in the description and in the claims of the present application and above-described drawings are used for distinguishing between similar or identical objects or entities without necessarily implying a specific order or sequence, unless otherwise specified. It is to be understood that the terms so used are interchangeable under appropriate circumstances.

[0100] The terms "comprise", "comprising", "include", "including", "have", "having", "contain", "containing", "provide", "provided", "provide for", "provided for", and the like, are used in the detailed description and in the claims of this application in a manner to mean "including but not limited to".

[0101] Finally, it should be noted that the above-described embodiments are merely intended to illustrate the technical solutions of the present application, but not to limit the same; although the present application has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that the technical solutions recorded in the above-described embodiments can be modified or equivalent replacements can be made to some or all of the technical features; and such modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0102] Embodiment 1:

[0103] Figure 1 A first electronic device structure provided by some embodiments is shown, which includes a client application (CA) 11 and a trusted application development platform 12;

[0104] The CA 11 is configured to initiate calling information of a native trusted application of a trusted execution environment operating system corresponding to the CA 11, which is connected to the trusted application development platform 12, wherein the calling information carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application;

[0105] The trusted application development platform 12 is configured to receive the calling information, determine a native trusted application corresponding to the first identification information from at least two native trusted applications respectively corresponding to trusted execution environment operating systems connected to the trusted application development platform 12 according to the first identification information, and send the calling information to the native trusted application corresponding to the first identification information;

[0106] The native trusted application corresponding to the first identification information 13 is configured to receive the calling information, determine a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in itself according to the second identification information, and call the bytecode trusted application corresponding to the second identification information 14 according to the calling information;

[0107] The bytecode trusted application 14 corresponding to the second identification information is configured to receive a call of the native trusted application 13 corresponding to the first identification information, and perform corresponding operation according to the call of the native trusted application 13 corresponding to the first identification information.

[0108] In a possible implementation, the electronic device of the present application can be a PC, a mobile terminal, or the like, and can also be a server or the like. Figure 2 A second electronic device structure diagram provided by some embodiments is shown, referring to Figure 2 For example, the trusted execution environment operating system (TEE OS) in the electronic device can be any TEE OS, such as Huawei iTrustee or Qualcomm QSEE.

[0109] In a possible implementation, for each TEE OS, a trusted application corresponding to the TEE OS (referred to as a native trusted application for convenience) can be created. The creation of the trusted application corresponding to the TEE OS can use existing technologies, which will not be described here. In a possible implementation, in order to develop a trusted application applicable to multiple TEE OSs and usable across different TEE OS hardware platforms for any application, thereby reducing the development cycle and development cost of the trusted application, the electronic device can further include a creation module. The creation module can create a trusted application development platform 12 (trusted application development framework) that links the native trusted applications (referred to as Native TA for convenience) corresponding to multiple (at least two) TEE OSs based on bytecode technology (such as WebAssembly bytecode technology) supporting cross-platform functions. WebAssembly is a new specification formulated by the World Wide Web Consortium (W3C) community group composed of mainstream browser manufacturers, which defines a new format that is portable, small in size, fast to load, and compatible with the Web.

[0110] The application can construct the native TAs corresponding to the plurality of TEE OSs into a trusted application development platform 12 based on a bytecode technology (such as a WebAssembly bytecode technology) supporting cross-platform functions. The trusted application development platform 12 can provide a unified development interface upwardly. For example, the trusted application development platform 12 can provide a unified Global Platform (GP) interface upwardly. A trusted application developer can no longer need to pay attention to the specific version of the TEE OS hardware platform, but only needs to develop a trusted application (for convenience, referred to as a bytecode trusted application) corresponding to an application such as the Construction Bank or the Agricultural Bank based on the trusted application development platform 12. The bytecode trusted application (for convenience, referred to as a Bytecode Trusted Application, BTA) is a trusted application developed based on the trusted application development platform 12 and applicable to different TEE OSs and usable across different TEE OS hardware platforms. The application can only develop one corresponding trusted application for each application. Compared with the related art, which needs to develop one trusted application for different TEE OS hardware platforms for each application and needs to develop multiple different versions of trusted applications for the same application, the application can shorten the development cycle of the trusted application, reduce the development cost, and at the same time achieve the purpose of “one development, multiple terminal deployment” and realize the rapid deployment and promotion of the application.

[0111] Referring to Figure 2 In a possible implementation, the trusted execution environment operating system (TEEOS) in the electronic device can receive the calling information initiated by the CA 11 and send the calling information to the trusted application development platform 12. The trusted application development platform 12 can receive the calling information sent by the TEE OS based on a Global Platform (GP) interface (for convenience, referred to as a first GP interface) provided by the TEE OS or a self-owned interface provided by the TEE OS.

[0112] In a possible implementation, the conversion interface can be preconfigured in the native trusted application 13 corresponding to the first identification information. The native trusted application 13 corresponding to the first identification information can call the bytecode trusted application 14 corresponding to the second identification information based on the preconfigured conversion interface.

[0113] In a possible implementation, considering that there are a large number of single-TEE OS hardware platforms such as Huawei iTrustee or Qualcomm QSEE, which have been developed in the related art and can only be used for single-TEE OS hardware platforms, and that the trusted applications (referred to as single trusted applications for convenience) cannot be used across different TEE OS hardware platforms, the single trusted applications usually directly interact with the TEE OS based on a preconfigured GP interface. In order to enable the single trusted applications to also run as the BTA in the native trusted application, the application can preconfigure a GP interface (referred to as a second GP interface for convenience) for the bytecode trusted application. Any bytecode trusted application (including the single trusted application) can receive the call of the native trusted application 13 corresponding to the first identification information based on the second GP interface.

[0114] In a possible implementation, when a security function provided by a trusted execution environment (Trusted Execution Environment, TEE) needs to be used, a client application (Client Application, CA) 11 in an electronic device can initiate call information of a native trusted application corresponding to a TEE OS corresponding to the CA 11 included in a trusted application development platform 12. For example, assuming that the TEE OS of the electronic device is Huawei iTrustee, the CA 11 in the electronic device can initiate call information of a native trusted application corresponding to the Huawei iTrustee TEE OS included in the trusted application development platform 12. In a possible implementation, the call information can carry identification information (referred to as first identification information for convenience) of the electronic device and identification information (referred to as second identification information for convenience) of a bytecode trusted application of any application to be called. The first identification information and the second identification information can be flexibly set according to requirements, which are not limited in the application. For example, the first identification information of the electronic device can include model information, brand information, and the like of the electronic device. In a possible implementation, in addition to the model information, the brand information, and the like of the electronic device, the first identification information can further include identification information of the native trusted application, such as a name of the native trusted application and a version number of the native trusted application, which are applicable to the electronic device. The second identification information of the bytecode trusted application can be identification information such as a name of the bytecode trusted application and a name of a supplier of the bytecode trusted application.

[0115] The CA11 initiates the calling information, and after the trusted application development platform 12 receives the calling information, the trusted application development platform 12 can determine the Native TA corresponding to the first identification information of the electronic device from the Native TAs corresponding to the at least two (multiple) TEE OSs associated with the trusted application development platform 12 according to the first identification information of the electronic device carried in the calling information, and send the calling information to the Native TA corresponding to the first identification information. For example, if the brand of the electronic device is Huawei, the first identification information of the electronic device can include the name of the native trusted application applicable to the Huawei brand electronic device (terminal) and the version number of the native trusted application, and the like, and the trusted application development platform 12 can determine the native trusted application corresponding to the Huawei iTrustee TEE OS as the native trusted application corresponding to the first identification information.

[0116] In a possible implementation, the native trusted applications corresponding to the multiple (at least two) TEE OSs can be directly integrated in the trusted application development platform 12, and the trusted application development platform 12 includes (associates with) the native trusted applications corresponding to the multiple TEE OSs. In a possible implementation, if the native trusted applications corresponding to the multiple TEE OSs are all integrated in the trusted application development platform 12, the space occupied by the trusted application development platform 12 can be large. In order to save space, the trusted application development platform 12 can first include (associate with) only the identification information of the native trusted applications corresponding to the multiple TEE OSs, and after the trusted application development platform 12 determines the identification information of the native trusted application corresponding to the first identification information of the electronic device according to the correspondence between the identification information of the electronic device and the identification information of the native trusted application, the trusted application development platform 12 can download and install the native trusted application corresponding to the first identification information from the backend application platform associated with the trusted application development platform 12 to the trusted application development platform 12 through over-the-air (OTA) technology. In a possible implementation, after the trusted application development platform 12 includes the native trusted application corresponding to the first identification information, the trusted application development platform 12 can send the first access request to the native trusted application (Native TA) corresponding to the first identification information.

[0117] In a possible implementation, the bytecodes of at least one application (BTA) can be pre-installed at a set position such as a data area of the Native TA, and the BTA can run in the Native TA based on a WebAssembly virtual machine. After receiving the calling information, the Native TA 13 of the first identification information can determine the BTA 14 corresponding to the second identification information from the at least one BTA installed therein according to the second identification information carried in the calling information, and call the BTA 14 corresponding to the second identification information according to the calling information.

[0118] In a possible implementation, the second identification information corresponding BTA 14 can receive the call of the first identification information Native TA 13, and can perform corresponding operations according to the call.

[0119] Since the CA 11 initiates the call information in the present application, the trusted application development platform 12 can receive the call information, and determine the native trusted application corresponding to the first identification information of the electronic device carried by the call information from at least two (multiple) TEE OS respectively corresponding native trusted applications connected to the trusted application development platform 12, and send the call information to the native trusted application corresponding to the first identification information. The native trusted application 13 corresponding to the first identification information receives the call information, and according to the second identification information carried by the call information, determines the bytecode trusted application 14 corresponding to the second identification information from at least one bytecode trusted application installed in itself, and calls the bytecode trusted application 14 corresponding to the second identification information according to the call information. The bytecode trusted application 14 corresponding to the second identification information can receive the call of the native trusted application 13 corresponding to the first identification information, and perform corresponding operations according to the call of the native trusted application 13 corresponding to the first identification information, so as to accurately call the bytecode trusted application of the second identification information, and realize the management of multiple bytecode trusted applications in the native trusted application, and realize the purpose of accurately managing the trusted application.

[0120] Embodiment 2:

[0121] In order to accurately manage the trusted application, on the basis of the above-mentioned embodiments, in the embodiments of the present application, the native trusted application 13 corresponding to the first identification information is specifically used for, if the received call information is an access request, creating a native trusted application instance, opening a native trusted application session based on the native trusted application instance; and sending a first instruction for opening a session to the bytecode trusted application 14 corresponding to the second identification information.

[0122] The bytecode trusted application 14 corresponding to the second identification information is specifically used for, if the first instruction is received, creating a bytecode trusted application instance, and opening a bytecode trusted application session based on the bytecode trusted application instance.

[0123] In a possible implementation, the call information initiated by the CA 11 can be an access request. Specifically, if the Native TA 13 of the first identification information identifies that the received call information is an access request, the Native TA 13 of the first identification information can first create a native trusted application instance, then open a native trusted application session based on the native trusted application instance, and send an instruction for opening a session (for convenience of description, referred to as a first instruction) to the BTA 14 corresponding to the second identification information according to the second identification information carried in the access request. For example, refer to Figure 2The Native TA 13 of the first identification information can first implement creation of a native trusted application instance based on a creation instance entry function (TA_CreateEntryPoint) and initialize a running environment of a WebAssembly virtual machine of the bytecode trusted application. Then, the Native TA 13 implements opening of a native trusted application session based on an opening session entry function (TA_OpenSessionEntryPoint), and calls the opening session entry function (WA_OpenSessionEntryPoint) of the conversion entry of the bytecode trusted application based on the conversion interface, to implement sending of a first instruction of opening a session to the BTA 14 corresponding to the second identification information.

[0124] In a possible implementation, after receiving the first instruction, the BTA 14 corresponding to the second identification information can create a bytecode trusted application instance and open a bytecode trusted application session based on the bytecode trusted application instance. In a possible implementation, after the BTA 14 corresponding to the second identification information identifies that the opening session entry function (WA_OpenSessionEntryPoint) of the conversion entry is called, the BTA 14 corresponding to the second identification information can consider that the first instruction is received, and then can first call the creation instance entry function (TA_CreateEntryPoint) of the bytecode trusted application to implement creation of a bytecode trusted application instance, and then call the opening session entry function (TA_OpenSessionEntryPoint) of the bytecode trusted application to implement opening of a bytecode trusted application session, so as to open the session of the bytecode trusted application 14 corresponding to the second identification information.

[0125] In a possible implementation, after the BTA 14 corresponding to the second identification information opens the bytecode trusted application session, the Native TA 13 of the first identification information can return confirmation information of success of session opening to the CA 11. After receiving the confirmation information, the CA 11 can then initiate calling of a command.

[0126] In order to accurately manage the trusted application, on the basis of the above embodiments, in the embodiments of the present application, the native trusted application 13 corresponding to the first identification information is specifically used for, if the received calling information is a calling command, transferring the calling command to the bytecode trusted application 14 corresponding to the second identification information.

[0127] In a possible implementation, if the calling information initiated by the CA 11 is a calling command, the Native TA 13 of the first identification information can transfer (such as transparently transmit) the calling command to the BTA 14 corresponding to the second identification information when identifying that the received calling information is a calling command. For example, refer to Figure 2When the Native TA 13 of the first identification information identifies that the received invocation information is the invocation command, it can be considered that the sending command entry function (TA_InvokeCommandEntryPoint) of the native trusted application needs to be invoked, and the sending command function (WA_InvokeCommandEntry) of the conversion entry of the bytecode trusted application is invoked based on the conversion interface. When the sending command function (WA_InvokeCommandEntry) of the conversion entry is invoked, the BTA 14 of the second identification information can invoke the command entry function (TA_InvokeCommandEntryPoint), receive the invocation command transferred by the native trusted application, and perform the corresponding operation in the invocation command.

[0128] In a possible implementation, after the BTA 14 of the second identification information creates the bytecode trusted application instance and opens the bytecode trusted application session, the BTA 14 of the second identification information can identify the location information of the data storage location of the BTA 14 of the second identification information itself, and return the location information to the native trusted application 13 corresponding to the first identification information. For example, the location information can be set in the session context, and the bytecode trusted application session context pointer is returned to the native trusted application 13 corresponding to the first identification information through the session context double pointer, so as to return the location information to the native trusted application 13 corresponding to the first identification information. In a possible implementation, the BTA can return the location information to the Native TA 13 of the first identification information based on the following code:

[0129] TEE_Result TA_OpenSessionEntryPoint(uint32_t paramTypes,

[0130] TEE_Param params[4],

[0131] void**sessionContext)。

[0132] When the Native TA 13 of the first identification information receives the location information, when the invocation command is transferred to the BTA 14 corresponding to the second identification information, the invocation command can be quickly and accurately transferred to the bytecode trusted application 14 corresponding to the second identification information identified by the location information based on the location information. In a possible implementation, the invocation command can be transferred to the BTA 14 corresponding to the second identification information based on the following code:

[0133] TEE_Result TA_InvokeCommandEntryPoint(void*sessionContext, uint32_t cmd_id, uint32_t paramTypes, TEE_Param params[4]).

[0134] In a possible implementation, the BTA 14 corresponding to the second identification information can return the execution result of the invoked command to the Native TA 13 of the first identification information after performing the corresponding operation according to the invoked command. The Native TA 13 of the first identification information can send the execution result to the CA 11. In a possible implementation, the CA 11 can initiate to close the session information after receiving the execution result.

[0135] In order to accurately manage the trusted application, on the basis of the above embodiments, in the embodiments of the present application, the native trusted application 13 corresponding to the first identification information is specifically configured to, if the received invocation information is the close session information, send the second instruction of closing the session to the bytecode trusted application 14 corresponding to the second identification information, and close the native trusted application session.

[0136] The bytecode trusted application 14 corresponding to the second identification information is specifically configured to, if the second instruction is received, close the bytecode trusted application session, and destroy the bytecode trusted application instance.

[0137] The native trusted application 13 corresponding to the first identification information is specifically configured to destroy the native trusted application instance.

[0138] In a possible implementation, the invocation information initiated by the CA 11 can be the close session information. Referring to Figure 2 When the Native TA 13 of the first identification information identifies that the received invocation information is the close session information, the Native TA 13 of the first identification information can call the close session entry function (TA_CloseSessionEntryPoint) of the native trusted application to close the native trusted application session, and call the close session entry function (WA_CloseSessionEntryPoint) of the conversion entry of the bytecode trusted application based on the conversion interface, to achieve sending the instruction (for convenience of description, referred to as the second instruction) of closing the session to the BTA 14 corresponding to the second identification information.

[0139] In one possible implementation, after the session close entry function (WA_CloseSessionEntryPoint) of the conversion entry point of BTA14 corresponding to the second identification information is called, BTA14 corresponding to the second identification information can be considered to have received the second instruction. It can then call the session close entry function (TA_CloseSessionEntryPoint) of the bytecode trusted application to close the bytecode trusted application session, and destroy the bytecode trusted application instance by calling the instance destruction entry function (TA_DestroyEntryPoint) of the bytecode trusted application. The Native TA13 of the first identification information can then call the native trusted application instance destruction function (TA_DestroyEntryPoint) to destroy the native trusted application instance.

[0140] In one possible implementation, after receiving the second instruction, the BTA14 corresponding to the second identification information may only call the bytecode trusted application's session close entry function (TA_CloseSessionEntryPoint) to close the bytecode trusted application session. Then, the Native TA13 of the first identification information can subsequently call the native trusted application's instance destruction function (TA_DestroyEntryPoint) to destroy the native trusted application instance, and call the bytecode trusted application's instance destruction entry function (WA_DestroyEntryPoint) based on the conversion interface. After the BTA14 corresponding to the second identification information recognizes that the conversion entry's instance destruction entry function (WA_DestroyEntryPoint) has been called, it can call the bytecode trusted application's instance destruction entry function (TA_DestroyEntryPoint) to destroy the bytecode trusted application instance.

[0141] To facilitate understanding, the trusted application invocation process provided in this application will be illustrated below with a specific embodiment. Figure 3 The diagram illustrates a first-type trusted application invocation process provided by some embodiments, such as... Figure 3 As shown, CA11 in the electronic device initiates an access request (opening a native trusted application session). In one possible implementation, CA11 can initiate the access request by calling the session open function (TEEC_OpenSession), and the access request can carry (specify) the first identification information of the electronic device and the second identification information of the bytecode trusted application of any application to be invoked. In one possible implementation, CA11 can initiate the access request based on the following code:

[0142] PARAM[0]: TEE_PARAM_TYPE_VALUE_INOUT, params[0].value.a = INSTALL_TA - command ID

[0143] params[0].value.a = INSTALL_TA - command ID

[0144] PARAM[1]: TEE_PARAM_TYPE_MEMREF_INPUT, params[1].memref.buffer = BTA name

[0145] PARAM[2]: TEE_PARAM_TYPE_MEMREF_INPUT, params[2].memref.buffer = SP name

[0146] PARAM[3]: TEE_PARAM_TYPE_MEMREF_INPUT, params[3].memref.buffer = BTA binary content

[0147] After the CA 11 initiates the access request, the TEE OS in the electronic device can receive the access information initiated by the CA 11, and send the calling information to the trusted application development platform 12. The trusted application development platform 12 receives the access information, and according to the first identification information, determines the native trusted application corresponding to the first identification information from at least two native trusted applications respectively corresponding to the trusted execution environment operating systems connected by the trusted application development platform 12, and sends the calling information to the native trusted application corresponding to the first identification information.

[0148] The Native TA 13 corresponding to the first identification information can first implement the creation of the native trusted application instance based on the creation instance entry function (TA_CreateEntryPoint), and then implement the opening of the native trusted application session based on the opening session entry function (TA_OpenSessionEntryPoint); and based on the conversion interface, call the opening session entry function (WA_OpenSessionEntryPoint) of the conversion entry of the bytecode trusted application, to implement the sending of the first instruction of opening the session to the BTA 14 corresponding to the second identification information.

[0149] After the BTA 14 corresponding to the second identification information identifies that the open session entry function (WA_OpenSessionEntryPoint) of the conversion entry is called, the BTA 14 corresponding to the second identification information can first call the create instance entry function (TA_CreateEntryPoint) of the bytecode trusted application to implement the creation of the bytecode trusted application instance, and then call the open session entry function (TA_OpenSessionEntryPoint) of the bytecode trusted application to implement the opening (creation) of the bytecode trusted application session.

[0150] In a possible implementation, after the BTA 14 corresponding to the second identification information creates the bytecode trusted application instance and opens the bytecode trusted application session, the BTA 14 corresponding to the second identification information can identify the location information of the data storage location of the BTA 14 itself, and return the location information to the native trusted application 13 corresponding to the first identification information. The location information can be set in the session context, and the bytecode trusted application session context pointer is returned to the native trusted application 13 corresponding to the first identification information through the session context double pointer.

[0151] In a possible implementation, when the native TA 13 corresponding to the first identification information receives the location information, the native TA 13 can save the location information (sessionContext) in the native trusted application session context. The TEE OS can also save the native trusted application session context (sessionContext).

[0152] The native TA 13 corresponding to the first identification information can return the confirmation information of the successful session opening to the CA 11. After receiving the confirmation information, the CA 11 can initiate a call command. The TEE OS in the electronic device can receive the call command initiated by the CA 11, and send the call command to the native TA 13 corresponding to the first identification information by loading the native trusted application session context.

[0153] When the Native TA 13 corresponding to the first identification information identifies that the received invocation information is an invocation command, the Native TA 13 can transfer the invocation command to the BTA 14 corresponding to the second identification information. The Native TA 13 corresponding to the first identification information can invoke a sending command entry function (TA_InvokeCommandEntryPoint) of the native trusted application, locate the BTA 14 corresponding to the second identification information from a session context (sessionContext), and invoke a sending command function (WA_InvokeCommandEntry) of a conversion entry of the BTA 14 corresponding to the second identification information based on a conversion interface. After the BTA 14 corresponding to the second identification information identifies that the sending command function (WA_InvokeCommandEntry) of the conversion entry is invoked, the BTA 14 can invoke a command entry function (TA_InvokeCommandEntryPoint), receive the invocation command transferred by the native trusted application, and perform a corresponding operation in the invocation command.

[0154] After the BTA 14 corresponding to the second identification information performs the corresponding operation according to the invocation command, the BTA 14 can further return an execution result of the invocation command to the Native TA 13 corresponding to the first identification information. The Native TA 13 corresponding to the first identification information can send the execution result to the CA 11.

[0155] In a possible implementation, after the CA 11 receives the execution result, the CA 11 can further initiate closing session information. The Native TA 13 corresponding to the first identification information receives the closing session information, identifies that the received invocation information is the closing session information, and can invoke a closing session entry function (TA_CloseSessionEntryPoint) of the native trusted application to close a session of the native trusted application, and invoke a closing session entry function (WA_CloseSessionEntryPoint) of a conversion entry of the bytecode trusted application based on a conversion interface. The BTA 14 corresponding to the second identification information can further invoke the closing session entry function (TA_CloseSessionEntryPoint) of the bytecode trusted application to close a session of the bytecode trusted application, and destroy an instance of the bytecode trusted application by invoking a destroy instance entry function (TA_DestroyEntryPoint) of the bytecode trusted application. The Native TA 13 corresponding to the first identification information can further invoke a destroy instance function (TA_DestroyEntryPoint) of the native trusted application to destroy an instance of the native trusted application. Meanwhile, the TEE OS can release a session context (sessionContext) of the native trusted application.

[0156] Embodiment 3:

[0157] In order to realize data storage isolation between multiple BTAs and ensure the data security of each BTA, on the basis of the above embodiments, in the embodiments of the present application, the first identification information corresponding to the native trusted application 13 is further configured to configure an independent subdirectory for each bytecode trusted application; for each bytecode trusted application, based on the independent subdirectory corresponding to the bytecode trusted application, a specific access path is configured for the bytecode trusted application, so that the bytecode trusted application accesses the file information in the corresponding independent subdirectory.

[0158] In a possible implementation, the Native TA can configure an independent subdirectory for each BTA when installing each BTA. For example, when any BTA needs to open or create a file according to the corresponding operation, the Native TA can always add the corresponding subdirectory as a prefix in the access file path provided by the BTA. That is, the Native TA can configure a specific access path for each BTA based on the independent subdirectory corresponding to the BTA, so that the BTA can only access the file information in the independent subdirectory corresponding to the BTA, but cannot access the file information in other directories.

[0159] In a possible implementation, in order to realize data storage isolation between multiple BTAs, the subdirectory and the access file path provided by the BTA can be an independent path (absolute path), rather than a relative path containing, for example, “..” to represent the upper directory.

[0160] Since the present application can configure an independent subdirectory for each BTA, each BTA can only access the file information in the unique subdirectory of itself, and cannot access the file information of other BTAs that do not belong to its own authority, so as to realize data storage isolation between multiple BTAs and ensure data security.

[0161] Embodiment 4:

[0162] Based on the same technical concept, the present application provides a trusted application calling method, which is applied to a native trusted application, Figure 4 Fig. 2 shows a second trusted application calling process provided by some embodiments, and Fig. 3 shows a third trusted application calling process provided by some embodiments. Figure 4 As shown in the figure, the process includes the following steps:

[0163] S401: receive calling information sent by a trusted application development platform; wherein the calling information carries first identification information of an electronic device and second identification information of bytecode trusted application of any application; the calling information is calling information of a native trusted application of a trusted execution environment operating system corresponding to a client application CA, which is initiated by the CA and sent by the trusted application development platform, and the trusted application development platform determines a native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to the trusted execution environment operating system connected to the trusted application development platform according to the first identification information.

[0164] S402: determine a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the electronic device according to the second identification information, and call the bytecode trusted application corresponding to the second identification information according to the calling information; make the bytecode trusted application corresponding to the second identification information receive calling of the native trusted application corresponding to the first identification information, and make the bytecode trusted application corresponding to the second identification information perform corresponding operations according to the calling of the native trusted application corresponding to the first identification information.

[0165] In a possible implementation, if the received calling information is an access request, the calling of the bytecode trusted application corresponding to the second identification information according to the calling information includes:

[0166] creating a native trusted application instance, opening a native trusted application session based on the native trusted application instance, and sending a first instruction of opening a session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information creates a bytecode trusted application instance after receiving the first instruction, and opens a bytecode trusted application session based on the bytecode trusted application instance.

[0167] In a possible implementation, if the received calling information is a calling command, the calling of the bytecode trusted application corresponding to the second identification information according to the calling information includes:

[0168] delivering the calling command to the bytecode trusted application corresponding to the second identification information.

[0169] In a possible implementation, after the receiving of the calling information sent by the trusted application development platform and before the delivering of the calling command to the bytecode trusted application corresponding to the second identification information, the method further includes:

[0170] receive position information sent by the bytecode trusted application corresponding to the second identification information; wherein the position information is position information sent by the bytecode trusted application corresponding to the second identification information when the bytecode trusted application identifies the position information of its own data storage position;

[0171] The handing over of the calling command to the bytecode trusted application corresponding to the second identification information includes:

[0172] The handing over of the calling command to the bytecode trusted application corresponding to the second identification information includes:

[0173] In a possible implementation, the method further includes:

[0174] If the execution result sent by the bytecode trusted application corresponding to the second identification information is received, the execution result is sent to the CA; wherein the execution result is sent by the bytecode trusted application corresponding to the second identification information after the bytecode trusted application executes the calling command.

[0175] In a possible implementation, if the received calling information is closing session information, the calling of the bytecode trusted application corresponding to the second identification information according to the calling information includes:

[0176] closing the native trusted application session, and sending a second instruction of closing the session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information closes the bytecode trusted application session when the second instruction is received, and the bytecode trusted application corresponding to the second identification information destroys the bytecode trusted application instance;

[0177] destroying the native trusted application instance.

[0178] In a possible implementation, the method further includes:

[0179] configuring an independent subdirectory for each bytecode trusted application respectively; for each bytecode trusted application, based on the independent subdirectory corresponding to the bytecode trusted application, configuring a specific access path for the bytecode trusted application, so that the bytecode trusted application accesses the file information in the corresponding independent subdirectory.

[0180] In a possible implementation, the calling of the bytecode trusted application corresponding to the second identification information includes:

[0181] based on a preconfigured conversion interface, calling the bytecode trusted application corresponding to the second identification information.

[0182] Embodiment 5:

[0183] Based on the same technical concept, the application provides a trusted application calling device, which is applied to a native trusted application (a native trusted application corresponding to first identification information), Figure 5 A first trusted application calling device provided by some embodiments is shown in a schematic diagram, as shown in the figure, the device comprises: Figure 5

[0184] A first receiving module 51 is configured to receive calling information sent by a trusted application development platform, wherein the calling information carries first identification information of an electronic device and second identification information of a bytecode trusted application of any application; the calling information is calling information of a native trusted application of a trusted execution environment operating system corresponding to a client application CA, which is initiated by the CA and connected to the trusted application development platform, and is sent by the trusted application development platform when determining a native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to the trusted execution environment operating system connected to the trusted application development platform according to the first identification information;

[0185] A calling module 52 is configured to determine a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the device according to the second identification information, and call the bytecode trusted application corresponding to the second identification information according to the calling information; make the bytecode trusted application corresponding to the second identification information receive the calling of the native trusted application corresponding to the first identification information, and make the bytecode trusted application corresponding to the second identification information perform corresponding operations according to the calling of the native trusted application corresponding to the first identification information.

[0186] In a possible implementation, the calling module 52 is specifically configured to create a native trusted application instance if the received calling information is an access request, open a native trusted application session based on the native trusted application instance, and send a first instruction for opening a session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information creates a bytecode trusted application instance after receiving the first instruction, and opens a bytecode trusted application session based on the bytecode trusted application instance.

[0187] In a possible implementation, the calling module 52 is specifically configured to transfer the calling command to the bytecode trusted application corresponding to the second identification information if the received calling information is the calling command.

[0188] ​In a possible implementation, the calling module 52 is further configured to receive position information sent by the bytecode trusted application corresponding to the second identification information; the position information is sent by the bytecode trusted application corresponding to the second identification information when the bytecode trusted application identifies the position information of the data storage position of the bytecode trusted application.

[0189] The calling module 52 is specifically configured to, based on the position information, transfer the calling command to the bytecode trusted application corresponding to the second identification information identified by the position information.

[0190] In a possible implementation, the apparatus further includes:

[0191] The sending module is configured to, if receiving an execution result sent by the bytecode trusted application corresponding to the second identification information, send the execution result to the CA; the execution result is sent by the bytecode trusted application corresponding to the second identification information after the bytecode trusted application executes the calling command.

[0192] In a possible implementation, the calling module 52 is specifically configured to, if the received calling information is closing session information, close the native trusted application session, and send a second instruction of closing the session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information closes the bytecode trusted application session when receiving the second instruction, and the bytecode trusted application corresponding to the second identification information destroys the bytecode trusted application instance.

[0193] Destroy the native trusted application instance.

[0194] In a possible implementation, the apparatus further includes:

[0195] The configuration module is configured to configure an independent subdirectory for each bytecode trusted application; for each bytecode trusted application, based on the independent subdirectory corresponding to the bytecode trusted application, configure a specific access path for the bytecode trusted application, so that the bytecode trusted application accesses the file information in the corresponding independent subdirectory.

[0196] In a possible implementation, the calling module 52 is specifically configured to call the bytecode trusted application corresponding to the second identification information based on a preconfigured conversion interface.

[0197] Embodiment 6

[0198] Based on the same technical concept, the present application further provides an electronic device, Figure 6 Fig. 1 shows a first electronic device structure schematic diagram provided by some embodiments, as shown in Figure 6As shown, it comprises a processor 61, a communication interface 62, a memory 63 and a communication bus 64, wherein the processor 61, the communication interface 62 and the memory 63 communicate with each other through the communication bus 64;

[0199] The memory 63 stores a computer program, which, when executed by the processor 61, causes the processor 61 to perform the following steps:

[0200] receive the calling information sent by the trusted application development platform, wherein the calling information carries the first identification information of the electronic device and the second identification information of the bytecode trusted application of any application; the calling information is the calling information of the native trusted application of the trusted execution environment operating system corresponding to the CA connected with the trusted application development platform initiated by the client application CA, and the trusted application development platform determines the native trusted application corresponding to the first identification information from the native trusted applications corresponding to at least two trusted execution environment operating systems connected with the trusted application development platform according to the first identification information, and sends the calling information when the native trusted application corresponding to the first identification information is determined;

[0201] According to the second identification information, determine the bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in itself, and according to the calling information, call the bytecode trusted application corresponding to the second identification information; make the bytecode trusted application corresponding to the second identification information receive the calling of the native trusted application corresponding to the first identification information, and make the bytecode trusted application corresponding to the second identification information execute corresponding operations according to the calling of the native trusted application corresponding to the first identification information.

[0202] In a possible implementation, the processor 61 is specifically configured to, if the received calling information is an access request, create a native trusted application instance, open a native trusted application session based on the native trusted application instance; and send a first instruction of opening a session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information creates a bytecode trusted application instance after receiving the first instruction, and opens a bytecode trusted application session based on the bytecode trusted application instance.

[0203] In a possible implementation, the processor 61 is specifically configured to, if the received calling information is a calling command, transfer the calling command to the bytecode trusted application corresponding to the second identification information.

[0204] In a possible implementation, the processor 61 is further configured to receive position information sent by the bytecode trusted application corresponding to the second identification information based on the second identification information; and the position information is sent by the bytecode trusted application corresponding to the second identification information when the bytecode trusted application corresponding to the second identification information identifies the position information of the data storage position.

[0205] Based on the position information, the calling command is transferred to the bytecode trusted application corresponding to the second identification information identified by the position information.

[0206] In a possible implementation, the processor 61 is further configured to send execution result sent by the bytecode trusted application corresponding to the second identification information to the CA if the execution result is received; and the execution result is sent by the bytecode trusted application corresponding to the second identification information after the bytecode trusted application corresponding to the second identification information executes the calling command.

[0207] In a possible implementation, the processor 61 is specifically configured to close the native trusted application session if the received calling information is the closing session information, and send a second instruction for closing the session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information closes the bytecode trusted application session when the second instruction is received, and the bytecode trusted application corresponding to the second identification information destroys the bytecode trusted application instance.

[0208] The native trusted application instance is destroyed.

[0209] In a possible implementation, the processor 61 is further configured to configure an independent subdirectory for each bytecode trusted application; and for each bytecode trusted application, a specific access path is configured for the bytecode trusted application based on the independent subdirectory corresponding to the bytecode trusted application, so that the bytecode trusted application accesses file information in the corresponding independent subdirectory.

[0210] In a possible implementation, the processor 61 is specifically configured to call the bytecode trusted application corresponding to the second identification information based on a preconfigured conversion interface.

[0211] Since the principle of solving the problem of the above electronic device is similar to the trusted application calling method, the implementation of the above electronic device can refer to the implementation of the method, and the repeated parts will not be described here.

[0212] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0213] The communication interface 62 is used for communication between the above electronic device and other devices.

[0214] The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0215] The processor mentioned above can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; can also be a Digital Signal Processing (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0216] Embodiment 7:

[0217] Based on the same technical concept, the embodiment of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program executable by an electronic device, when the program runs on the electronic device, the electronic device executes the following steps:

[0218] receive the calling information sent by the trusted application development platform, wherein the calling information carries the first identification information of the electronic device and the second identification information of the bytecode trusted application of any application; the calling information is the calling information of the native trusted application of the trusted execution environment operating system corresponding to the CA connected with the trusted application development platform initiated by the client application CA, and the trusted application development platform determines the native trusted application corresponding to the first identification information from the native trusted applications corresponding to at least two trusted execution environment operating systems connected with the trusted application development platform according to the first identification information, and sends the calling information when the first identification information is sent;

[0219] According to the second identification information, a bytecode trusted application corresponding to the second identification information is determined from at least one bytecode trusted application installed in the self, and the bytecode trusted application corresponding to the second identification information is invoked according to the calling information; the bytecode trusted application corresponding to the second identification information receives the calling of the native trusted application corresponding to the first identification information, and the bytecode trusted application corresponding to the second identification information performs corresponding operations according to the calling of the native trusted application corresponding to the first identification information.

[0220] In a possible implementation, if the received calling information is an access request, the invoking the bytecode trusted application corresponding to the second identification information according to the calling information comprises:

[0221] A native trusted application instance is created, a native trusted application session is opened based on the native trusted application instance, and a first instruction of opening a session is sent to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information creates a bytecode trusted application instance after receiving the first instruction, and opens a bytecode trusted application session based on the bytecode trusted application instance.

[0222] In a possible implementation, if the received calling information is a calling command, the invoking the bytecode trusted application corresponding to the second identification information according to the calling information comprises:

[0223] The calling command is transferred to the bytecode trusted application corresponding to the second identification information.

[0224] In a possible implementation, after the calling information sent by the trusted application development platform is received, and before the calling command is transferred to the bytecode trusted application corresponding to the second identification information, the method further comprises:

[0225] Position information sent by the bytecode trusted application corresponding to the second identification information is received, wherein the position information is sent by the bytecode trusted application corresponding to the second identification information when the bytecode trusted application corresponding to the second identification information identifies position information of a data storage position of the self;

[0226] The transferring the calling command to the bytecode trusted application corresponding to the second identification information comprises:

[0227] The calling command is transferred to the bytecode trusted application corresponding to the second identification information identified by the position information based on the position information.

[0228] In a possible implementation, the method further comprises:

[0229] If the execution result sent by the bytecode trusted application corresponding to the second identification information is received, the execution result is sent to the CA; wherein the execution result is sent by the bytecode trusted application corresponding to the second identification information after the bytecode trusted application corresponding to the second identification information executes the calling command.

[0230] In a possible implementation, if the received calling information is the closing session information, the calling the bytecode trusted application corresponding to the second identification information according to the calling information comprises:

[0231] closing the native trusted application session, and sending a second instruction of closing the session to the bytecode trusted application corresponding to the second identification information, so that the bytecode trusted application corresponding to the second identification information closes the bytecode trusted application session when the second instruction is received, and the bytecode trusted application corresponding to the second identification information destroys the bytecode trusted application instance;

[0232] destroying the native trusted application instance.

[0233] In a possible implementation, the method further comprises:

[0234] configuring an independent subdirectory for each bytecode trusted application respectively; for each bytecode trusted application, based on the independent subdirectory corresponding to the bytecode trusted application, a specific access path is configured for the bytecode trusted application, so that the bytecode trusted application accesses the file information in the corresponding independent subdirectory.

[0235] In a possible implementation, the calling the bytecode trusted application corresponding to the second identification information comprises:

[0236] calling the bytecode trusted application corresponding to the second identification information based on the preconfigured conversion interface.

[0237] The computer readable storage medium described above can be any available medium or data storage device accessible by the processor in the electronic device, including but not limited to magnetic memories such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical memories such as CD, DVD, BD, HVD, etc., and semiconductor memories such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state disk (SSD), etc.

[0238] Embodiment 8:

[0239] Based on the same technical concept, the present application provides a trusted application calling method, which is applied to a bytecode trusted application, Figure 7 a third trusted application calling process schematic diagram provided by some embodiments is shown, as shown in the figure, the process comprises the following steps: Figure 7 the bytecode trusted application corresponding to the second identification information is called according to the calling information.

[0240] S701: receiving a call of a native trusted application corresponding to first identification information; the call is initiated by the native trusted application corresponding to the first identification information according to the call information when the native trusted application corresponding to the first identification information receives the call information sent by a trusted application development platform, and the native trusted application corresponding to the first identification information determines a bytecode trusted application corresponding to second identification information from at least one bytecode trusted application installed in the native trusted application corresponding to the first identification information according to the second identification information carried in the call information; wherein the call information is sent by the trusted application development platform when the trusted application development platform receives call information of a client application CA to a native trusted application of a trusted execution environment operating system corresponding to the CA connected to the trusted application development platform, and the trusted application development platform determines the native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to the trusted execution environment operating system connected to the trusted application development platform according to the first identification information of an electronic device carried in the call information;

[0241] S702: performing a corresponding operation according to the call of the native trusted application corresponding to the first identification information.

[0242] In a possible implementation, the performing a corresponding operation according to the call of the native trusted application corresponding to the first identification information includes:

[0243] If a first instruction of opening a session sent by the native trusted application corresponding to the first identification information is received, a bytecode trusted application instance is created, and a bytecode trusted application session is opened based on the bytecode trusted application instance; wherein the first instruction is sent by the native trusted application corresponding to the first identification information when the native trusted application corresponding to the first identification information identifies that the received call information is an access request, and the native trusted application corresponding to the first identification information creates a native trusted application instance and opens a native trusted application session based on the native trusted application instance.

[0244] In a possible implementation, after the bytecode trusted application session is opened, and before the call command transferred by the native trusted application corresponding to the first identification information is received, the method further includes:

[0245] identify location information of the self-data storage location, and return the location information to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information receives the location information, and the native trusted application corresponding to the first identification information transfers the calling command to the bytecode trusted application corresponding to the second identification information based on the location information.

[0246] In a possible implementation, the method further includes:

[0247] returning an execution result of the calling command to the native trusted application corresponding to the first identification information; and causing the native trusted application corresponding to the first identification information to send the execution result to the CA.

[0248] In a possible implementation, the performing corresponding operations according to the calling of the native trusted application corresponding to the first identification information includes:

[0249] if a second instruction of closing a session sent by the native trusted application corresponding to the first identification information is received, closing the bytecode trusted application session and destroying the bytecode trusted application instance; wherein the second instruction is sent by the native trusted application corresponding to the first identification information to the bytecode trusted application corresponding to the second identification information when the received calling information is closing session information.

[0250] In a possible implementation, the receiving the calling of the native trusted application corresponding to the first identification information includes:

[0251] receiving the calling of the native trusted application corresponding to the first identification information based on a preconfigured second GP interface.

[0252] Embodiment 9

[0253] Based on the same technical concept, the present application provides a trusted application calling device, the device is applied to a bytecode trusted application, Figure 8 a second trusted application calling device provided by some embodiments is shown, as shown in Figure 8 the device includes:

[0254] The second receiving module 81 is configured to receive a call of a native trusted application corresponding to first identification information; the call is initiated by the native trusted application corresponding to the first identification information according to call information sent by a trusted application development platform, and the native trusted application corresponding to the first identification information determines a bytecode trusted application corresponding to second identification information from at least one bytecode trusted application installed in the native trusted application corresponding to the first identification information according to the second identification information carried in the call information; and the native trusted application corresponding to the first identification information initiates the bytecode trusted application corresponding to the second identification information according to the call information; wherein the call information is sent by the trusted application development platform when the trusted application development platform receives call information of a native trusted application of a trusted execution environment operating system corresponding to a client application (CA) and connected to the trusted application development platform, and the trusted application development platform determines the native trusted application corresponding to first identification information of an electronic device from at least two native trusted applications corresponding to the trusted execution environment operating system connected to the trusted application development platform according to the first identification information carried in the call information.

[0255] The execution module 82 is configured to perform corresponding operations according to the call of the native trusted application corresponding to the first identification information.

[0256] In a possible implementation, the execution module 82 is specifically configured to create a bytecode trusted application instance and open a bytecode trusted application session based on the bytecode trusted application instance if a first instruction of opening a session sent by the native trusted application corresponding to the first identification information is received; wherein the first instruction is sent by the native trusted application corresponding to the first identification information when the native trusted application corresponding to the first identification information identifies that the received call information is an access request, creates a native trusted application instance, and opens a native trusted application session based on the native trusted application instance.

[0257] In a possible implementation, the execution module 82 is further configured to identify location information of a data storage location of the bytecode trusted application, and return the location information to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information receives the location information, and the native trusted application corresponding to the first identification information transfers the call command to the bytecode trusted application corresponding to the second identification information identified by the location information based on the location information.

[0258] In a possible implementation, the execution module 82 is further configured to return an execution result of the call command to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information sends the execution result to the CA.

[0259] In a possible implementation, the execution module 82 is specifically configured to, if receiving a second instruction of closing a session sent by the native trusted application corresponding to the first identification information, close the bytecode trusted application session and destroy the bytecode trusted application instance; wherein the second instruction is sent by the native trusted application corresponding to the first identification information to the bytecode trusted application corresponding to the second identification information when the received calling information is closing session information.

[0260] In a possible implementation, the second receiving module 81 is specifically configured to receive calling of the native trusted application corresponding to the first identification information based on a preconfigured second GP interface.

[0261] Embodiment 10:

[0262] Based on the same technical concept, the present application further provides an electronic device, Figure 9 Fig. 2 shows a second electronic device structure schematic diagram provided by some embodiments, and Fig. 3 shows a third electronic device structure schematic diagram provided by some embodiments. Figure 9 As shown, the electronic device includes a processor 91, a communication interface 92, a memory 93 and a communication bus 94, wherein the processor 91, the communication interface 92 and the memory 93 complete mutual communication through the communication bus 94.

[0263] The memory 93 stores a computer program, and when the program is executed by the processor 91, the processor 91 executes the following steps:

[0264] receiving calling of a native trusted application corresponding to first identification information; the calling is initiated by the native trusted application corresponding to the first identification information according to calling information sent by a trusted application development platform when the native trusted application corresponding to the first identification information receives the calling information, and the native trusted application corresponding to the first identification information determines a bytecode trusted application corresponding to second identification information from at least one bytecode trusted application installed in the native trusted application corresponding to the first identification information itself according to the second identification information carried in the calling information; wherein the calling information is sent by the trusted application development platform when the trusted application development platform determines the native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to respective trusted execution environment operating systems connected to the trusted application development platform according to first identification information of an electronic device carried in the calling information, and the calling information is initiated by a client application CA to a native trusted application of a trusted execution environment operating system corresponding to the CA connected to the trusted application development platform;

[0265] According to the calling of the native trusted application corresponding to the first identification information, a corresponding operation is performed.

[0266] In a possible implementation, the processor 91 is specifically configured to, if receiving a first instruction of opening a session sent by the native trusted application corresponding to the first identification information, create a bytecode trusted application instance, and open a bytecode trusted application session based on the bytecode trusted application instance; wherein the first instruction is sent by the native trusted application corresponding to the first identification information when the native trusted application corresponding to the first identification information identifies that the received calling information is an access request, the native trusted application corresponding to the first identification information creates a native trusted application instance, and opens a native trusted application session based on the native trusted application instance.

[0267] In a possible implementation, the processor 91 is further configured to identify location information of a self data storage location, and return the location information to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information receives the location information, and the native trusted application corresponding to the first identification information transfers the calling command to the bytecode trusted application corresponding to the second identification information identified by the location information based on the location information.

[0268] In a possible implementation, the processor 91 is further configured to return an execution result of the calling command to the native trusted application corresponding to the first identification information; and the native trusted application corresponding to the first identification information sends the execution result to the CA.

[0269] In a possible implementation, the processor 91 is specifically configured to, if receiving a second instruction of closing a session sent by the native trusted application corresponding to the first identification information, close the bytecode trusted application session, and destroy the bytecode trusted application instance; wherein the second instruction is sent by the native trusted application corresponding to the first identification information when the native trusted application corresponding to the first identification information receives calling information that is closing session information.

[0270] In a possible implementation, the processor 91 is specifically configured to receive the calling of the native trusted application corresponding to the first identification information based on a preconfigured second GP interface.

[0271] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0272] The communication interface 92 is used for communication between the above electronic device and other devices.

[0273] The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0274] The processor mentioned above can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; can also be a Digital Signal Processing (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0275] Embodiment 11:

[0276] Based on the same technical concept, the embodiment of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program executable by an electronic device, when the program runs on the electronic device, makes the electronic device execute the following steps:

[0277] receiving a call of a native trusted application corresponding to the first identification information; the call is initiated by the native trusted application corresponding to the first identification information according to the calling information sent by the trusted application development platform when the calling information received by the native trusted application corresponding to the first identification information carries second identification information, and the native trusted application corresponding to the first identification information determines the bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the native trusted application corresponding to the first identification information; wherein the calling information is sent by the trusted application development platform when the trusted application development platform receives calling information of a native trusted application of a trusted execution environment operating system corresponding to a client application (CA) initiated by the CA, and the trusted application development platform determines the native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to the trusted execution environment operating system connected to the trusted application development platform according to the first identification information of an electronic device carried in the calling information;

[0278] performing a corresponding operation according to the call of the native trusted application corresponding to the first identification information.

[0279] In a possible implementation, the performing a corresponding operation according to the call of the native trusted application corresponding to the first identification information includes:

[0280] if a first instruction of opening a session sent by the native trusted application corresponding to the first identification information is received, creating a bytecode trusted application instance, and opening a bytecode trusted application session based on the bytecode trusted application instance; wherein the first instruction is sent by the native trusted application corresponding to the first identification information when the native trusted application corresponding to the first identification information identifies that the received calling information is an access request, and the native trusted application corresponding to the first identification information creates a native trusted application instance and opens a native trusted application session based on the native trusted application instance.

[0281] In a possible implementation, after the bytecode trusted application session is opened, and before the calling command transferred by the native trusted application corresponding to the first identification information is received, the method further includes:

[0282] identifying location information of a data storage location of the native trusted application corresponding to the first identification information, and returning the location information to the native trusted application corresponding to the first identification information, so that the native trusted application corresponding to the first identification information receives the location information, and transfers the calling command to the bytecode trusted application corresponding to the second identification information identified by the location information based on the location information.

[0283] In a possible implementation, the method further includes:

[0284] returning an execution result of the calling command to the native trusted application corresponding to the first identification information; and causing the native trusted application corresponding to the first identification information to send the execution result to the CA.

[0285] In a possible implementation, the performing corresponding operations according to the calling of the native trusted application corresponding to the first identification information includes:

[0286] If a second instruction of closing a session sent by the native trusted application corresponding to the first identification information is received, the bytecode trusted application session is closed, and the bytecode trusted application instance is destroyed; the second instruction is sent by the native trusted application corresponding to the first identification information to the bytecode trusted application corresponding to the second identification information when the received calling information is closing session information.

[0287] In a possible implementation, the receiving the calling of the native trusted application corresponding to the first identification information includes:

[0288] receiving the calling of the native trusted application corresponding to the first identification information based on a preconfigured second GP interface.

[0289] The computer readable storage medium described above can be any available medium or data storage device that the processor in the electronic device can access, including but not limited to a magnetic memory such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc., an optical memory such as a CD, a DVD, a BD, a HVD, etc., and a semiconductor memory such as a ROM, an EPROM, an EEPROM, a non-volatile memory (NAND FLASH), a solid state disk (SSD), etc.

[0290] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to a magnetic disk storage, a CD-ROM, an optical storage, etc.) containing computer usable program code.

[0291] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0292] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0293] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 Figure 1 one or more flow or blocks

[0294] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. An electronic device, comprising: The electronic device comprises a client application (CA) and a trusted application development platform; The CA is configured to initiate calling information of a native trusted application of a trusted execution environment operating system corresponding to the CA, which is connected to the trusted application development platform, wherein the calling information carries first identification information of the electronic device and second identification information of a bytecode trusted application of any application; The trusted application development platform is configured to receive the calling information, determine a native trusted application corresponding to the first identification information from at least two native trusted applications corresponding to at least two trusted execution environment operating systems connected to the trusted application development platform according to the first identification information, and send the calling information to the native trusted application corresponding to the first identification information; The native trusted application corresponding to the first identification information is configured to receive the calling information, determine a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the native trusted application corresponding to the first identification information according to the second identification information, and call the bytecode trusted application corresponding to the second identification information according to the calling information; The bytecode trusted application corresponding to the second identification information is configured to receive the calling of the native trusted application corresponding to the first identification information, and perform corresponding operations according to the calling of the native trusted application corresponding to the first identification information; The native trusted application corresponding to the first identification information is specifically configured to, if the received calling information is an access request, create a native trusted application instance based on a creation instance entry function, initialize a running environment of a virtual machine of a bytecode trusted application, open a native trusted application session based on an open session entry function, and call an open session entry function of a conversion entry of a bytecode trusted application based on a conversion interface, and send a first instruction of opening a session to the bytecode trusted application corresponding to the second identification information.

2. The electronic device of claim 1, wherein, The electronic device further comprises: A creation module configured to create the trusted application development platform based on bytecode technology supporting cross-platform functions, wherein the trusted application development platform is connected to native trusted applications corresponding to at least two trusted execution environment operating systems.

3. The electronic device of claim 1, wherein, The bytecode trusted application corresponding to the second identification information is specifically configured to, if the first instruction is received, create a bytecode trusted application instance, and open a bytecode trusted application session based on the bytecode trusted application instance.

4. The electronic device of claim 1, wherein, The native trusted application corresponding to the first identification information is specifically configured to, if the received calling information is a calling command, transfer the calling command to the bytecode trusted application corresponding to the second identification information.

5. The electronic device of claim 4, wherein, The bytecode trusted application corresponding to the second identification information is further configured to identify location information of a data storage position of the bytecode trusted application, and return the location information to the native trusted application corresponding to the first identification information; The native trusted application corresponding to the first identification information is specifically configured to, if the location information is received, transfer the calling command to the bytecode trusted application corresponding to the second identification information identified by the location information based on the location information.

6. The electronic device of claim 4, wherein, The bytecode trusted application corresponding to the second identification information is further configured to return an execution result of the call command to the native trusted application corresponding to the first identification information. The native trusted application corresponding to the first identification information is further configured to send the execution result to the CA.

7. The electronic device of claim 3, wherein, The native trusted application corresponding to the first identification information is specifically configured to, if the received call information is the close session information, send a second instruction of closing a session to the bytecode trusted application corresponding to the second identification information, and close the native trusted application session. The bytecode trusted application corresponding to the second identification information is specifically configured to, if the second instruction is received, close a bytecode trusted application session, and destroy a bytecode trusted application instance. The native trusted application corresponding to the first identification information is specifically configured to destroy a native trusted application instance.

8. The electronic device of claim 1, wherein, The native trusted application corresponding to the first identification information is further configured to configure an independent subdirectory for each bytecode trusted application; for each bytecode trusted application, based on the independent subdirectory corresponding to the bytecode trusted application, the bytecode trusted application is configured with a specific access path, so that the bytecode trusted application accesses file information in the corresponding independent subdirectory.

9. The electronic device of claim 1, wherein, The electronic device further includes a trusted execution environment operating system (TEE OS); The TEE OS is configured to receive the call information initiated by the CA, and send the call information to the trusted application development platform; The trusted application development platform is specifically configured to receive the call information sent by the TEE OS based on a first global platform organization (GP) interface provided by the TEE OS or a self-owned interface.

10. The electronic device of any of claims 1-9, wherein, The native trusted application corresponding to the first identification information is specifically configured to call the bytecode trusted application corresponding to the second identification information based on a preconfigured conversion interface. The bytecode trusted application corresponding to the second identification information is specifically configured to receive the call of the native trusted application corresponding to the first identification information based on a preconfigured second GP interface.

Images