Inter-device interaction authorization method, device and readable storage medium based on TEE environment

Abstract

The present application discloses a method, device and readable storage medium for device-to-device interaction authorization based on a TEE environment, wherein the method comprises: receiving a first temporary certificate uploaded by a first type of client; when verifying that the first temporary certificate is a valid certificate, determining whether to authorize the first type of client by judging whether the first permission service identifier uploaded by the first type of client exists; receiving a second permission service identifier uploaded by a second type of client; generating a second temporary certificate based on the second permission service identifier and a preset authorization certificate, and sending the second temporary certificate to the second type of client, so that the second type of client can encrypt the corresponding device information based on the second temporary certificate to obtain encrypted device information; receiving the encrypted device information sent by the second type of client, and determining whether to authorize the second type of client by parsing the encrypted device information. The present application solves the technical problem of low security of device-to-device interaction authorization in the prior art.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and readable storage medium for device-to-device interaction authorization based on a TEE environment. Background Art

[0002] With the rapid development of science and technology, people are becoming more and more dependent on communication devices, so the issue of secure authorization between devices has become more and more the focus of people's attention. At present, interactive authorization methods such as WIFI and BT (Bluetooth) are usually used to complete device authorization through text password verification to access data and information in the same network. However, since the text password is fixed, once a client with security risks completes the authorization connection, it is very easy to leak the text password in the server, and then easily steal the data and information in the server, resulting in low security of interactive authorization between devices. Summary of the invention

[0003] The main purpose of this application is to provide a device interaction authorization method, electronic device and readable storage medium based on a TEE environment, aiming to solve the technical problem of low security of device interaction authorization in the prior art.

[0004] To achieve the above purpose, the present application provides a method for device-to-device interaction authorization based on a TEE environment, which is applied to a server. The method for device-to-device interaction authorization based on a TEE environment includes:

[0005] If the client corresponding to the server is a first type of client, receiving a first temporary certificate uploaded by the first type of client;

[0006] When verifying that the first temporary certificate is a valid certificate, determining whether to authorize the first type of client by judging whether the first permission service identifier uploaded by the first type of client exists;

[0007] If the client corresponding to the server is a second-category client, receiving a second permission service identifier uploaded by the second-category client;

[0008] Generate a second temporary certificate according to the second authority service identifier and the preset authorization certificate, and send the second temporary certificate to the second type of client, so that the second type of client encrypts the corresponding device information according to the second temporary certificate to obtain encrypted device information;

[0009] The encrypted device information sent by the second-type client is received, and by parsing the encrypted device information, it is determined whether to authorize the second-type client.

[0010] Optionally, before the step of determining whether to authorize the first type of client by judging whether the first permission service identifier uploaded by the first type of client exists when verifying that the first temporary certificate is a valid certificate, the device-to-device interaction authorization method based on the TEE environment further includes:

[0011] Verifying, according to the first trusted application, whether the first temporary certificate is a valid certificate, obtaining a verification result, and sending the verification result to the first type of client;

[0012] The first service authority identifier uploaded by the first-type client is received, wherein the first service authority identifier is uploaded by the first-type client when it is determined that a verification success result has been received.

[0013] Optionally, the step of receiving the encrypted device information sent by the second-type client and determining whether to authorize the second-type client by parsing the encrypted device information includes:

[0014] receiving the encrypted device information sent by the second-type client, and verifying whether the second-type client is an authorized client;

[0015] If yes, decrypting the encrypted device information according to the first trusted application to obtain a decryption result;

[0016] When the decryption result is a successful decryption result, the second type of client is authorized.

[0017] Optionally, before the step of receiving the first temporary certificate uploaded by the first type of client, the device-to-device interaction authorization method based on the TEE environment further includes:

[0018] receiving a first authorization request sent by the first-type client, and determining, based on the first authorization request, whether a first key file corresponding to the first-type client is decrypted successfully;

[0019] If yes, a first communication channel is established.

[0020] Optionally, before the step of receiving the second permission service identifier uploaded by the second type of client, the device-to-device interaction authorization method based on the TEE environment further includes:

[0021] receiving a second authorization request sent by the second type of client, and generating a second key file according to the second authorization request;

[0022] When the second key file is sent to the second type of client, a second communication channel is established.

[0023] Optionally, the device interaction authorization method based on the TEE environment further includes:

[0024] Generate a root certificate according to the device information corresponding to the server, and send the root certificate to the first trusted application, so that the trusted application can store the root certificate in a preset storage partition; or

[0025] Using the device information corresponding to the server as an index, query and obtain the server certificate sent by the root server according to the certificate chain;

[0026] The server certificate is sent to the first trusted application, so that the first trusted application stores the server certificate in the preset storage partition.

[0027] To achieve the above object, the present application provides a method for authorization of device-to-device interaction based on a TEE environment, which is applied to a client, wherein the client includes a first type of client and a second type of client, and the method for authorization of device-to-device interaction based on a TEE environment includes:

[0028] If the client is the first type of client, sending the first temporary certificate to the server, so that the server can verify whether the first temporary certificate is a valid certificate;

[0029] When the server verifies that the first certificate is a valid certificate, the server sends a first authorization service identifier to the server, so that the server determines whether to authorize the first type of client by judging whether the first authorization service identifier exists;

[0030] If the client is the second type of client, sending the second authority service identifier to the server, so that the server generates a second temporary certificate according to the second authority service identifier and the preset authorization certificate;

[0031] receiving the second temporary certificate, and obtaining encrypted device information according to the device information corresponding to the second temporary certificate;

[0032] The encrypted device information is sent to the server, so that the server determines whether to authorize the second type of client by parsing the encrypted device information.

[0033] Optionally, the step of receiving the second temporary certificate and obtaining encrypted device information according to the device information corresponding to the second temporary certificate includes:

[0034] receiving the second temporary certificate, and writing the second temporary certificate into a second trusted application;

[0035] The device information corresponding to the second temporary certificate is encrypted in the second trusted application to obtain the encrypted device information.

[0036] To achieve the above-mentioned purpose, the present application also provides a device for device-to-device interaction authorization based on a TEE environment, the device-to-device interaction authorization based on a TEE environment is applied to a server, and the device-to-device interaction authorization based on a TEE environment includes:

[0037] A first receiving module, configured to receive a first temporary certificate uploaded by the first type of client if the client corresponding to the server is a first type of client;

[0038] A first authorization module, configured to determine whether to authorize the first type of client by judging whether a first authority service identifier uploaded by the first type of client exists when verifying that the first temporary certificate is a valid certificate;

[0039] The second receiving module is used to receive a second permission service identifier uploaded by the second-category client if the client corresponding to the server is a second-category client.

[0040] A generating module, configured to generate a second temporary certificate according to the second authority service identifier and the preset authorization certificate, and send the second temporary certificate to the second type of client, so that the second type of client encrypts the corresponding device information according to the second temporary certificate to obtain the encrypted device information;

[0041] A second authorization module, configured to receive the encrypted device information sent by the second type of client, and determine whether to authorize the second type of client by parsing the encrypted device information;

[0042] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0043] Verifying, according to the first trusted application, whether the first temporary certificate is a valid certificate, obtaining a verification result, and sending the verification result to the first type of client;

[0044] The first service authority identifier uploaded by the first-type client is received, wherein the first service authority identifier is uploaded by the first-type client when it is determined that a verification success result has been received.

[0045] Optionally, the second authorization module is further used to:

[0046] receiving the encrypted device information sent by the second-type client, and verifying whether the second-type client is an authorized client;

[0047] If yes, decrypting the encrypted device information according to the first trusted application to obtain a decryption result;

[0048] When the decryption result is a successful decryption result, the second type of client is authorized.

[0049] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0050] receiving a first authorization request sent by the first-type client, and determining, based on the first authorization request, whether a first key file corresponding to the first-type client is decrypted successfully;

[0051] If yes, a first communication channel is established.

[0052] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0053] receiving a second authorization request sent by the second type of client, and generating a second key file according to the second authorization request;

[0054] When the second key file is sent to the second type of client, a second communication channel is established.

[0055] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0056] Generate a root certificate according to the device information corresponding to the server, and send the root certificate to the first trusted application, so that the trusted application can store the root certificate in a preset storage partition; or

[0057] Using the device information corresponding to the server as an index, query and obtain the server certificate sent by the root server according to the certificate chain;

[0058] The server certificate is sent to the first trusted application, so that the first trusted application stores the server certificate in the preset storage partition.

[0059] To achieve the above-mentioned purpose, the present application further provides a device for device-to-device interaction authorization based on a TEE environment, wherein the device-to-device interaction authorization based on a TEE environment is applied to a client, wherein the client includes a first type of client and a second type of client, and the device-to-device interaction authorization based on a TEE environment includes:

[0060] A first sending module, configured to send the first temporary certificate to the server if the client is the first type of client, so that the server can verify whether the first temporary certificate is a valid certificate;

[0061] A second sending module is used for sending a first permission service identifier to the server when receiving the first certificate verified by the server as a valid certificate, so that the server can determine whether to authorize the first type of client by judging whether the first permission service identifier exists;

[0062] a third sending module, configured to send the second authority service identifier to the server if the client is the second type of client, so that the server generates a second temporary certificate according to the second authority service identifier and a preset authorization certificate;

[0063] A first receiving module, configured to receive the second temporary certificate, and obtain encrypted device information according to device information corresponding to the second temporary certificate;

[0064] The second sending module is used to send the encrypted device information to the server, so that the server can determine whether to authorize the second type of client by parsing the encrypted device information.

[0065] Optionally, the first receiving module is further used for:

[0066] receiving the second temporary certificate, and writing the second temporary certificate into a second trusted application;

[0067] The device information corresponding to the second temporary certificate is encrypted in the second trusted application to obtain the encrypted device information.

[0068] The present application also provides an electronic device, which includes: a memory, a processor, and a program of the device interaction authorization method based on the TEE environment stored in the memory and executable on the processor. When the program of the device interaction authorization method based on the TEE environment is executed by the processor, the steps of the device interaction authorization method based on the TEE environment as described above can be implemented.

[0069] The present application also provides a computer-readable storage medium, on which is stored a program for implementing a method for authorization to interact between devices based on a TEE environment. When the program for the method for authorization to interact between devices based on a TEE environment is executed by a processor, the steps of the method for authorization to interact between devices based on a TEE environment are implemented as described above.

[0070] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned device interaction authorization method based on the TEE environment.

[0071] The present application provides a method for interactive authorization between devices based on a TEE environment, an electronic device, and a readable storage medium, that is, if the client corresponding to the server is a first type of client, a first temporary certificate uploaded by the first type of client is received, and then when the first temporary certificate is verified to be a valid certificate, by judging whether the first permission service identifier uploaded by the first type of client exists, it is determined whether to authorize the first type of client, so that the purpose of completing the interactive authorization between the server and the first type of client based on verifying the validity of the temporary certificate can be achieved; if the client corresponding to the server is a second type of client, a second permission service identifier uploaded by the second type of client is received, and then according to the second permission service identifier and the preset authorization certificate, Generate a second temporary certificate, and send the second temporary certificate to the second type of client, so that the second type of client can encrypt the corresponding device information according to the second temporary certificate to obtain the encrypted device information, and then receive the encrypted device information sent by the second type of client. By parsing the encrypted device information, it is determined whether to authorize the second type of client, so as to achieve the purpose of completing the interactive authorization between the server and the second type of client based on the temporary certificate generated by the trusted application of the server. Since the server is an authorized device and the client is a device to be authorized, the first type of client is a device to be authorized with a built-in certificate, and the second type of client is a device to be authorized without a built-in certificate. The verification or generation of the temporary certificate is completed based on the TA (Trusted Application) running in the TEE (Trusted Execution Environment), and the TA can ensure that the written data cannot be tampered with, so it overcomes the technical defect that the data information of the server is easily stolen during the interactive authorization process between devices in the prior art, so the security of the interactive authorization between devices is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0073] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0074] Figure 1 This is a flowchart of the first embodiment of the device interaction authorization method based on the TEE environment of this application;

[0075] Figure 2This is a flow chart of the second embodiment of the device interaction authorization method based on the TEE environment of this application;

[0076] Figure 3 This is a schematic diagram of the device structure of the hardware operating environment involved in the device interaction authorization method based on the TEE environment in the embodiment of the present application.

[0077] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0078] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0079] Embodiment 1

[0080] The present application embodiment provides a method for authorization of device-to-device interaction based on a TEE environment. In the first embodiment of the method for authorization of device-to-device interaction based on a TEE environment of the present application, refer to Figure 1 The device interaction authorization method based on the TEE environment is applied to the server, including:

[0081] Step S10: if the client corresponding to the server is a first type of client, receiving a first temporary certificate uploaded by the first type of client;

[0082] In this embodiment, it should be noted that the server and the client are both devices that integrate TA (Trusted Application) and application software, wherein the server is an authorized device, and the server's applications include SA (Server Application) and TA, wherein the SA is an authorized application running in REE (Rich Execution Environment), and TA is an authorized application running in TEE, and the client is a device to be authorized, and the client's applications include CA (Client Application) and TA, and the client includes a first type of client and a second type of client, wherein the first type of client is a device to be authorized with a built-in certificate, and the second type of client is a device to be authorized without a built-in certificate, and the first temporary certificate is a temporary certificate generated by a client with a built-in certificate using a client certificate stored in TA.

[0083] In addition, it should be noted that the server is used to authorize the client, and can be a root server or a primary server. The root server is a top-level service provider device with a built-in certificate, and the primary server is a server device or a client device authorized by the root server. When the primary server authorizes the client as a server and the client has a built-in certificate, the client is a secondary server. The server is burned with a trusted certificate during the production process, and has the function of configuring the authorization time limit, authorization capability and permissions of its authorized subordinate devices. For example, assuming that the server does not grant its authorized subordinate devices authorization capabilities, the subordinate devices cannot become a server.

[0084] Exemplarily, if the client corresponding to the server is identified as a client with a built-in certificate, a first temporary certificate uploaded by the client with the built-in certificate is received, wherein the identification method can be a method of identification based on data information transmitted through an encrypted communication channel, and the encrypted communication channel can be an HTTPS secure communication link.

[0085] Regarding step S10, before the step of receiving the first temporary certificate uploaded by the first type of client, the device interaction authorization method based on the TEE environment also includes:

[0086] Step A10, receiving a first authorization request sent by the first type of client, and judging whether a first key file corresponding to the first type of client is decrypted successfully according to the first authorization request;

[0087] Step A20: If yes, then establish a first communication channel.

[0088] In this embodiment, it should be noted that the first communication channel is used for communication between the server and the first type of client through the RSA public key encryption algorithm, the first key file is a JSON generated based on the user's password and the information to be encrypted, and the first authorization request is a security authorization request. For example, assuming that device A and device B are produced by the same manufacturer and both have trusted certificates burned in the production process, the first authorization request sent by device B received by device A as a server is a security authorization request.

[0089] Exemplarily, when receiving a security authorization request sent by a client with a built-in certificate, it is verified that the private key corresponding to the server can decrypt the public key of the client with the built-in certificate; if the private key corresponding to the server application can decrypt the public key of the client with the built-in certificate, the server corresponding to the client is determined to be a trusted device, and the first communication channel is established; if the private key corresponding to the server application cannot decrypt the public key of the client with the built-in certificate, the server corresponding to the client is determined to be an illegal device, wherein the receiving method can be a method in which the server periodically monitors the client, and the decryption method can be by writing a code program.

[0090] Step S20, when verifying that the first temporary certificate is a valid certificate, determining whether to authorize the first type of client by judging whether the first permission service identifier uploaded by the first type of client exists;

[0091] In this embodiment, it should be noted that the valid certificate is a certificate issued by the server based on the server certificate. The first permission service identifier is used to identify the permission service configuration range sent by the client with a built-in certificate to the server application. Specifically, it may be a PMC (Permission Code), etc. The authorization method may be that the server application provides the client with the service permission corresponding to the permission service identifier. For example, assuming that the permission service identifier is a storage permission, if the server application has the permission service identifier, the server application provides the client with storage permission.

[0092] Exemplarily, when it is verified that the first temporary certificate is a valid certificate, it is determined whether to authorize the client by judging whether the first authority service identifier exists, wherein the verification method may be through monitoring the verification results, the certificate information includes user information, user public key, CA signature, etc., and the authorization content may be through authorized storage permissions, authorization permissions, browsing permissions, etc.

[0093] Regarding step S20, when verifying that the first temporary certificate is a valid certificate, before the step of determining whether to authorize the first type of client by judging whether the first permission service identifier uploaded by the first type of client exists, the device-to-device interaction authorization method based on the TEE environment also includes:

[0094] Step B10: verifying whether the first temporary certificate is a valid certificate according to the first trusted application, obtaining a verification result, and sending the verification result to the first type of client;

[0095] Step B20: receiving the first service authority identifier uploaded by the first type of client, wherein the first service authority identifier is uploaded by the first type of client when it determines that a verification success result has been received.

[0096] In this embodiment, it should be noted that the first trusted application is a TA of the server, and the verification result is a verification success result or a verification failure result.

[0097] Exemplarily, the TA of the server is called, and the certificate information in the first temporary certificate is verified in the TA to be consistent. If the certificate information is consistent, the first temporary certificate is determined to be a valid certificate, and a verification success result is obtained; if the certificate information is inconsistent, the first temporary certificate is determined to be an invalid certificate, and a verification failure result is obtained, and the verification success result or the verification failure result is sent to the client of the built-in certificate; the first service authority identifier uploaded by the client of the built-in certificate is received, wherein the first service authority identifier is uploaded by the client of the built-in certificate when the verification success result is received, and wherein the uploading method can be a method of uploading through SA based on the first communication channel.

[0098] Step S30: if the client corresponding to the server is a second type of client, receiving a second permission service identifier uploaded by the second type of client;

[0099] Step S40: Generate a second temporary certificate according to the second authority service identifier and the preset authorization certificate, and send the second temporary certificate to the second type of client, so that the second type of client encrypts the corresponding device information according to the second temporary certificate to obtain encrypted device information;

[0100] In this embodiment, it should be noted that the second type of client is an authorized device without a built-in certificate, the second temporary certificate is a temporary certificate generated by the server using a preset authorization certificate stored in the TA, the preset authorization certificate is a digital device certificate burned by the server during the production process, the second permission service identifier is used to identify the permission service configuration range sent by the client without a built-in certificate to the server, and can specifically be a PMC (Permission Code), etc. The device information is used to distinguish the device from similar devices, and the encrypted device information is encrypted device information. For example, assuming that the second type of client is a set-top box, the device information can be STB ID (set-top box production serial number), CA ID (set-top box encryption serial number), IMEI (International Mobile Equipment Identity), SCID (set-top box encryption card serial number), etc.

[0101] Exemplarily, if it is identified that the client corresponding to the server is a client without a built-in certificate, the second authority service identifier of the client without a built-in certificate to be uploaded by the server is received; the preset authorization certificate stored in the TA corresponding to the server is called, and a second temporary certificate is generated in the TA based on the preset authorization certificate and the second authority service identifier, and the second temporary certificate is sent to the client without a built-in certificate, so that the client without a built-in certificate can encrypt the corresponding device information based on the second temporary certificate to obtain the encrypted device information, wherein the encryption method can be an encryption method using an RSA asymmetric encryption algorithm, and the uploading and sending can be done through a secure link communication based on HTTPS.

[0102] Regarding step S30, before the step of receiving the second permission service identifier uploaded by the second type of client, the device-to-device interaction authorization method based on the TEE environment further includes:

[0103] Step C10, receiving a second authorization request sent by the second type of client, and generating a second key file according to the second authorization request;

[0104] Step C20: When the second key file is sent to the second type of client, a second communication channel is established.

[0105] In this embodiment, it should be noted that the second communication channel is used for communication between the server and the second type of client, the second key file is a JSON generated based on the user's password and the information to be encrypted, and the second authorization request is a secure connection request. For example, assuming that device A and device B are produced by different manufacturers, during the production process, device A has a trusted certificate burned in, and device B has not had a trusted certificate burned in, then the second authorization request received by device A as a server from device B is a secure connection request.

[0106] Exemplarily, when a secure connection request is received from a client without a built-in certificate, a second key file is generated in the first trusted application based on the secure connection request; when the second key file is sent to the client without a built-in certificate, a second communication channel is established.

[0107] Regarding step A10 or C10, before the step of receiving the first authorization request sent by the first type of client or the step of receiving the second authorization request sent by the second type of client, the device-to-device interactive authorization method based on the TEE environment further includes:

[0108] Step D10, generating a root certificate according to the device information corresponding to the server, and sending the root certificate to the first trusted application, so that the trusted application stores the root certificate in a preset storage partition; or

[0109] Step D20, using the device information corresponding to the server as an index, querying and obtaining the server certificate sent by the root server according to the certificate chain;

[0110] Step D30: Send the server certificate to the first trusted application, so that the first trusted application stores the server certificate in the preset storage partition.

[0111] In this embodiment, it should be noted that the certificate chain includes a root certificate, an intermediate certificate and a user certificate. The generation method can be generated through OPENSSL (Open Secure socket layer cipher Library), the server certificate is the intermediate certificate issued by the certificate chain, the preset storage partition is the RPMB (Replay Protected Memory Block) partition of the first trusted application, and the RPMB partition is used to ensure the security of the written data information by encryption. The server can be divided into a root server, a first-level certificate server, a second-level certificate server, etc., among which the root server is the first authorized device.

[0112] Exemplarily, when the server is a root server, a root certificate is generated based on the device information of the root server, and the root certificate is sent to the trusted application corresponding to the root server, so that the trusted application can store the root certificate in the RPMB partition; when the server is not a root server, the device information of the server is used as an index to query the preset key-value pair database of the root server corresponding to the server, and the server certificate sent by the root server based on the certificate chain is obtained in the preset key-value pair database; the server certificate is sent to the trusted application corresponding to the server, so that the trusted application can store the server certificate in the RPMB partition, wherein the preset key-value pair database is used to store the mapping relationship between the root certificate of the root server and the intermediate certificate of the authorized sub-device, and the query method can be a key-value pair query method, wherein the device information of the server is used as the key and the server certificate is used as the value.

[0113] Step S50: receiving the encrypted device information sent by the second-type client, and determining whether to authorize the second-type client by parsing the encrypted device information.

[0114] Exemplarily, based on the SA receiving the encrypted device information sent by the client without a built-in certificate, the encrypted device information is parsed by the first trusted application. If the encrypted device parsing is successful, the client without a built-in certificate is authorized. If the encrypted device information parsing fails, the client without a built-in certificate is not authorized. The specific content of the authorization can be storage permissions and browsing permissions, etc., and the service permissions do not include authorization permissions.

[0115] Regarding step S50, the step of receiving the encrypted device information sent by the second type of client and determining whether to authorize the second type of client by parsing the encrypted device information includes:

[0116] Step S51, receiving the encrypted device information sent by the second type of client, and verifying whether the second type of client is an authorized client;

[0117] Step S52: If yes, decrypt the encrypted device information according to the first trusted application to obtain a decryption result;

[0118] Step S53: when the decryption result is a successful decryption result, authorize the second type of client.

[0119] In this embodiment, it should be noted that the authorized client is a client to which the server can grant service permissions, wherein the client may be one or more, and the decryption result includes a decryption success result or a decryption failure result.

[0120] Exemplarily, the encrypted device information uploaded by the client without a built-in certificate is received, and it is determined whether the client without a built-in certificate is an authorized client; if the client without a built-in certificate is an authorized client, the trusted application corresponding to the server is called to decrypt the encrypted device information to obtain the decryption success result or the decryption failure result; when the decryption result is a decryption success result, the client without a built-in certificate is authorized, wherein the determination method may be determination of functional permissions and permission period, etc., the encryption and decryption method may be by means of an asymmetric encryption algorithm, the authorized content may be storage permissions and browsing permissions, etc., wherein the service permissions do not include authorization permissions.

[0121] The present application provides a method for interactive authorization between devices based on a TEE environment, an electronic device, and a readable storage medium, that is, if the client corresponding to the server is a first type of client, a first temporary certificate uploaded by the first type of client is received, and then when the first temporary certificate is verified to be a valid certificate, by judging whether the first permission service identifier uploaded by the first type of client exists, it is determined whether to authorize the first type of client, so that the purpose of completing the interactive authorization between the server and the first type of client based on verifying the validity of the temporary certificate can be achieved; if the client corresponding to the server is a second type of client, a second permission service identifier uploaded by the second type of client is received, and then according to the second permission service identifier and the preset authorization certificate, Generate a second temporary certificate, and send the second temporary certificate to the second type of client, so that the second type of client can encrypt the corresponding device information according to the second temporary certificate to obtain the encrypted device information, and then receive the encrypted device information sent by the second type of client. By parsing the encrypted device information, it is determined whether to authorize the second type of client, so as to achieve the purpose of completing the interactive authorization between the server and the second type of client based on the temporary certificate generated by the trusted application of the server. Since the server is an authorized device and the client is a device to be authorized, the first type of client is a device to be authorized with a built-in certificate, and the second type of client is a device to be authorized without a built-in certificate. The verification or generation of the temporary certificate is completed based on the TA (Trusted Application) running in the TEE (Trusted Execution Environment), and the TA can ensure that the written data cannot be tampered with, so it overcomes the technical defect that the data information of the server is easily stolen during the interactive authorization process between devices in the prior art, so the security of the interactive authorization between devices is improved.

[0122] Embodiment 2

[0123] Further, refer to Figure 2 In another embodiment of the present application, the same or similar content as the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated later. On this basis, it is applied to the client, the client includes a first type of client and a second type of client, and the device-to-device interaction authorization method based on the TEE environment includes:

[0124] Step E10: if the client is the first type of client, sending the first temporary certificate to the server, so that the server can verify whether the first temporary certificate is a valid certificate;

[0125] Step E20, when the server verifies that the first certificate is a valid certificate, the server sends the first permission service identifier to the server, so that the server determines whether to authorize the first type of client by judging whether the first permission service identifier exists;

[0126] Exemplarily, if the client identified by the server is a client with a built-in certificate, a first temporary certificate is generated based on the client certificate corresponding to the client with the built-in certificate, and the first temporary certificate is sent to the server so that the server can verify whether the first temporary certificate is a valid certificate; when the server verifies that the first certificate is a valid certificate, the first authority service identifier is sent to the server so that the server can determine whether to authorize the first type of client by judging whether the first authority service identifier exists.

[0127] Step E30: if the client is the second type of client, sending the second authority service identifier to the server, so that the server generates a second temporary certificate according to the second authority service identifier and the preset authorization certificate;

[0128] Step E40, receiving the second temporary certificate, and obtaining encrypted device information according to the device information corresponding to the second temporary certificate;

[0129] Step E50: sending the encrypted device information to the server, so that the server can determine whether to authorize the second type of client by parsing the encrypted device information.

[0130] Exemplarily, if the client identified by the server is a client with a built-in certificate, the second authority service identifier is sent to the server, so that the server can generate a second temporary certificate based on the second authority service identifier and a preset authorization certificate; the second temporary certificate is received, and the device information of the client without a built-in certificate is encrypting based on the second temporary certificate to obtain encrypted device information; the encrypted device information is sent to the server, so that the server can determine whether to authorize the second type of client by parsing the encrypted device information.

[0131] Regarding step E40, in the step of receiving the second temporary certificate sent by the server application, the step of receiving the second temporary certificate and obtaining encrypted device information according to the device information corresponding to the second temporary certificate includes:

[0132] Step E41, receiving the second temporary certificate, and writing the second temporary certificate into a second trusted application;

[0133] Step E42: encrypt the device information corresponding to the second temporary certificate in the second trusted application to obtain the encrypted device information.

[0134] Exemplarily, a second temporary certificate sent by the server is received, the second temporary certificate and the device information of the client without a built-in certificate are written to a trusted application of the client without a built-in certificate, the device information is encrypted according to the trusted application of the client without a built-in certificate, and the encrypted device information is obtained, wherein the encryption method can be a method of encrypting by an RSA asymmetric encryption algorithm, and the sending method can be a method of sending based on an encrypted communication channel corresponding to the application to be authorized without a built-in certificate, wherein the second trusted application is a trusted application of the client without a built-in certificate.

[0135] The embodiment of the present application provides a method for authorization of device interaction based on a TEE environment, that is, if the client is the first type of client, a first temporary certificate is sent to a server, so that the server can verify whether the first temporary certificate is a valid certificate, and then when receiving the first certificate verified by the server as a valid certificate, a first authority service identifier is sent to the server, so that the server can determine whether to authorize the first type of client by judging whether the first authority service identifier exists. If the client is the second type of client, a second authority service identifier is sent to the server, so that the server can generate a second temporary certificate according to the second authority service identifier and a preset authorization certificate, receive the second temporary certificate, obtain encrypted device information according to the device information corresponding to the second temporary certificate, and send the encrypted device information to the server, so that the server can determine whether to authorize the second type of client by parsing the encrypted device information. Since the verification or generation of the temporary certificate is completed based on the TA running on the TEE, and the interaction process between the client and the server is based on an encrypted communication channel, the technical defect of the server's data information being easily stolen during the authorization process of interaction between devices in the prior art is overcome, thereby improving the security of authorization of interaction between devices.

[0136] Embodiment 3

[0137] The embodiment of the present application also provides a device for authorization to interact between devices based on a TEE environment, the device for authorization to interact between devices based on a TEE environment is applied to a server, and the device for authorization to interact between devices based on a TEE environment includes:

[0138] A first receiving module, configured to receive a first temporary certificate uploaded by the first type of client if the client corresponding to the server is a first type of client;

[0139] A first authorization module, configured to determine whether to authorize the first type of client by judging whether a first authority service identifier uploaded by the first type of client exists when verifying that the first temporary certificate is a valid certificate;

[0140] The second receiving module is used to receive a second permission service identifier uploaded by the second-category client if the client corresponding to the server is a second-category client.

[0141] A generating module, configured to generate a second temporary certificate according to the second authority service identifier and the preset authorization certificate, and send the second temporary certificate to the second type of client, so that the second type of client encrypts the corresponding device information according to the second temporary certificate to obtain the encrypted device information;

[0142] A second authorization module, configured to receive the encrypted device information sent by the second type of client, and determine whether to authorize the second type of client by parsing the encrypted device information;

[0143] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0144] Verifying, according to the first trusted application, whether the first temporary certificate is a valid certificate, obtaining a verification result, and sending the verification result to the first type of client;

[0145] The first service authority identifier uploaded by the first-type client is received, wherein the first service authority identifier is uploaded by the first-type client when it is determined that a verification success result has been received.

[0146] Optionally, the second authorization module is further used to:

[0147] receiving the encrypted device information sent by the second-type client, and verifying whether the second-type client is an authorized client;

[0148] If yes, decrypting the encrypted device information according to the first trusted application to obtain a decryption result;

[0149] When the decryption result is a successful decryption result, the second type of client is authorized.

[0150] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0151] receiving a first authorization request sent by the first-type client, and determining, based on the first authorization request, whether a first key file corresponding to the first-type client is decrypted successfully;

[0152] If yes, a first communication channel is established.

[0153] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0154] receiving a second authorization request sent by the second type of client, and generating a second key file according to the second authorization request;

[0155] When the second key file is sent to the second type of client, a second communication channel is established.

[0156] Optionally, the device-to-device interaction authorization device based on the TEE environment is further used for:

[0157] Generate a root certificate according to the device information corresponding to the server, and send the root certificate to the first trusted application, so that the trusted application can store the root certificate in a preset storage partition; or

[0158] Using the device information corresponding to the server as an index, query and obtain the server certificate sent by the root server according to the certificate chain;

[0159] The server certificate is sent to the first trusted application, so that the first trusted application stores the server certificate in the preset storage partition.

[0160] The device-to-device interactive authorization device based on the TEE environment provided by the present invention adopts the device-to-device interactive authorization method based on the TEE environment in the above-mentioned embodiment 1 or embodiment 2, and solves the technical problem of low security of device-to-device interactive authorization. Compared with the prior art, the beneficial effects of the device-to-device interactive authorization device based on the TEE environment provided by the embodiment of the present invention are the same as the beneficial effects of the device-to-device interactive authorization method based on the TEE environment provided by the above-mentioned embodiment, and other technical features in the device-to-device interactive authorization device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0161] Embodiment 4

[0162] The embodiment of the present application further provides a device for inter-device interaction authorization based on a TEE environment, wherein the device for inter-device interaction authorization based on a TEE environment is applied to a client, and the device for inter-device interaction authorization based on a TEE environment includes:

[0163] A first sending module, configured to send the first temporary certificate to the server if the client is the first type of client, so that the server can verify whether the first temporary certificate is a valid certificate;

[0164] A second sending module is used for sending a first permission service identifier to the server when receiving the first certificate verified by the server as a valid certificate, so that the server can determine whether to authorize the first type of client by judging whether the first permission service identifier exists;

[0165] a third sending module, configured to send the second authority service identifier to the server if the client is the second type of client, so that the server generates a second temporary certificate according to the second authority service identifier and a preset authorization certificate;

[0166] A first receiving module, configured to receive the second temporary certificate, and obtain encrypted device information according to device information corresponding to the second temporary certificate;

[0167] The second sending module is used to send the encrypted device information to the server, so that the server can determine whether to authorize the second type of client by parsing the encrypted device information.

[0168] Optionally, the first receiving module is further used for:

[0169] receiving the second temporary certificate, and writing the second temporary certificate into a second trusted application;

[0170] The device information corresponding to the second temporary certificate is encrypted in the second trusted application to obtain the encrypted device information.

[0171] The device-to-device interactive authorization device based on the TEE environment provided by the present invention adopts the device-to-device interactive authorization method based on the TEE environment in the above-mentioned embodiment 1 or embodiment 2, and solves the technical problem of low security of device-to-device interactive authorization. Compared with the prior art, the beneficial effects of the device-to-device interactive authorization device based on the TEE environment provided by the embodiment of the present invention are the same as the beneficial effects of the device-to-device interactive authorization method based on the TEE environment provided by the above-mentioned embodiment, and other technical features in the device-to-device interactive authorization device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0172] Embodiment 5

[0173] An embodiment of the present invention provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the device-to-device interaction authorization method based on the TEE environment in the above-mentioned embodiment one.

[0174] Reference below Figure 3, which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0175] like Figure 3 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processing device, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0176] Typically, the following systems can be connected to the I / O interface: input devices including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices including, for example, a magnetic tape, a hard disk, etc.; and communication devices. The communication device can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0177] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0178] The electronic device provided by the present invention adopts the device-to-device interaction authorization method based on the TEE environment in the above-mentioned embodiment 1 or embodiment 2, which solves the technical problem of low security of device-to-device interaction authorization. Compared with the prior art, the beneficial effects of the electronic device provided by the embodiment of the present invention are the same as the beneficial effects of the device-to-device interaction authorization method based on the TEE environment provided by the above-mentioned embodiment 1, and other technical features in the electronic device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0179] It should be understood that the various parts of the present disclosure can be implemented with hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0180] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0181] Embodiment 6

[0182] This embodiment provides a computer-readable storage medium having computer-readable program instructions stored thereon, and the computer-readable program instructions are used to execute the device-to-device interaction authorization method based on the TEE environment in the above-mentioned embodiment 1.

[0183] The computer-readable storage medium provided in the embodiment of the present invention may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0184] The computer-readable storage medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0185] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by an electronic device, the electronic device: if the client corresponding to the server is a first type of client, then receives the first temporary certificate uploaded by the first type of client; when verifying that the first temporary certificate is a valid certificate, determines whether to authorize the first type of client by judging whether the first authority service identifier uploaded by the first type of client exists; if the client corresponding to the server is a second type of client, then receives the second authority service identifier uploaded by the second type of client; generates a second temporary certificate based on the second authority service identifier and a preset authorization certificate, and sends the second temporary certificate to the second type of client, so that the second type of client can encrypt the corresponding device information based on the second temporary certificate to obtain encrypted device information; receives the encrypted device information sent by the second type of client, and determines whether to authorize the second type of client by parsing the encrypted device information.

[0186] Alternatively, if the client is the first type of client, the first temporary certificate is sent to the server so that the server can verify whether the first temporary certificate is a valid certificate; when receiving the result that the server verifies that the first certificate is a valid certificate, the first authority service identifier is sent to the server so that the server can determine whether to authorize the first type of client by judging whether the first authority service identifier exists; if the client is the second type of client, the second authority service identifier is sent to the server so that the server can generate a second temporary certificate based on the second authority service identifier and a preset authorization certificate; the second temporary certificate is received, and encrypted device information is obtained based on the device information corresponding to the second temporary certificate; the encrypted device information is sent to the server so that the server can determine whether to authorize the second type of client by parsing the encrypted device information.

[0187] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0188] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0189] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of the module does not limit the unit itself in some cases.

[0190] The computer-readable storage medium provided by the present invention stores computer-readable program instructions for executing the above-mentioned device-to-device interaction authorization method based on the TEE environment, which solves the technical problem of low security of device-to-device interaction authorization. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the embodiment of the present invention are the same as the beneficial effects of the device-to-device interaction authorization method based on the TEE environment provided by the above-mentioned embodiment 1 or embodiment 2, and will not be repeated here.

[0191] Embodiment 7

[0192] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned device interaction authorization method based on the TEE environment.

[0193] The computer program product provided by this application solves the technical problem of low security of interactive authorization between devices. Compared with the prior art, the beneficial effects of the computer program product provided by the embodiment of the present invention are the same as the beneficial effects of the interactive authorization method between devices based on the TEE environment provided by the above-mentioned embodiment 1 or embodiment 2, and will not be repeated here.

[0194] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. A method for device interaction authorization based on TEE environment, characterized in that: Applied to the server, the device-to-device interaction authorization method based on the TEE environment includes: If the client corresponding to the server is a first type of client, receiving a first temporary certificate uploaded by the first type of client, wherein the first type of client is a device to be authorized with a built-in certificate; When verifying that the first temporary certificate is a valid certificate, determining whether to authorize the first type of client by judging whether the first permission service identifier uploaded by the first type of client exists; If the client corresponding to the server is a second-category client, receiving a second permission service identifier uploaded by the second-category client, wherein the second-category client is a device to be authorized without a built-in certificate; Generate a second temporary certificate according to the second authority service identifier and the preset authorization certificate, and send the second temporary certificate to the second type of client, so that the second type of client encrypts the corresponding device information according to the second temporary certificate to obtain encrypted device information; receiving the encrypted device information sent by the second-type client, and determining whether to authorize the second-type client by parsing the encrypted device information; Before the step of determining whether to authorize the first type of client by judging whether the first permission service identifier uploaded by the first type of client exists when verifying that the first temporary certificate is a valid certificate, the device-to-device interaction authorization method based on the TEE environment further includes: Verify, based on a first trusted application, whether the first temporary certificate is a valid certificate, obtain a verification result, and send the verification result to the first type of client, wherein the first trusted application is an authorized application running on the server in the TEE environment; Receiving a first service authority identifier uploaded by the first-category client, wherein the first service authority identifier is uploaded by the first-category client when the first-category client determines that a verification success result has been received; The step of receiving the encrypted device information sent by the second type of client and determining whether to authorize the second type of client by parsing the encrypted device information comprises: receiving the encrypted device information sent by the second-type client, and verifying whether the second-type client is an authorized client; If yes, decrypting the encrypted device information according to the first trusted application to obtain a decryption result; When the decryption result is a successful decryption result, the second type of client is authorized.

2. The device interaction authorization method based on the TEE environment as claimed in claim 1, characterized in that: Before the step of receiving the first temporary certificate uploaded by the first type of client, the device interaction authorization method based on the TEE environment also includes: receiving a first authorization request sent by the first-type client, and determining, based on the first authorization request, whether a first key file corresponding to the first-type client is decrypted successfully; If yes, a first communication channel is established.

3. The device interaction authorization method based on the TEE environment as claimed in claim 1, characterized in that: Before the step of receiving the second permission service identifier uploaded by the second type of client, the device-to-device interaction authorization method based on the TEE environment further includes: receiving a second authorization request sent by the second type of client, and generating a second key file according to the second authorization request; When the second key file is sent to the second type of client, a second communication channel is established.

4. The device interaction authorization method based on the TEE environment as described in any one of claims 1 to 3, characterized in that: The device interaction authorization method based on the TEE environment also includes: Generate a root certificate according to the device information corresponding to the server, and send the root certificate to the first trusted application, so that the trusted application can store the root certificate in a preset storage partition; or Using the device information corresponding to the server as an index, query and obtain the server certificate sent by the root server according to the certificate chain; The server certificate is sent to the first trusted application, so that the first trusted application stores the server certificate in the preset storage partition.

5. A method for device interaction authorization based on TEE environment, characterized in that: Applied to a client, the client includes a first type of client and a second type of client, the first type of client is a device to be authorized with a built-in certificate, and the second type of client is a device to be authorized without a built-in certificate, and the device-to-device interactive authorization method based on the TEE environment includes: If the client is the first type of client, the first temporary certificate is sent to the server, so that the server verifies whether the first temporary certificate is a valid certificate based on the first trusted application, obtains a verification result, and sends the verification result to the first type of client, wherein the first trusted application is an authorized application running on the server in the TEE environment; When the server verifies that the first temporary certificate is a valid certificate, the server sends the first authorization service identifier to the server, so that the server determines whether to authorize the first type of client by judging whether the first authorization service identifier exists; If the client is the second type of client, sending the second authority service identifier to the server, so that the server generates a second temporary certificate according to the second authority service identifier and the preset authorization certificate; receiving the second temporary certificate, and obtaining encrypted device information according to the device information corresponding to the second temporary certificate; The encrypted device information is sent to the server for the server to verify whether the second type of client is an authorized client. If so, the encrypted device information is decrypted according to the first trusted application to obtain a decryption result; when the decryption result is a successful decryption result, the second type of client is authorized.

6. The device interaction authorization method based on the TEE environment as claimed in claim 5, characterized in that: The step of receiving the second temporary certificate and obtaining encrypted device information according to the device information corresponding to the second temporary certificate includes: receiving the second temporary certificate, and writing the second temporary certificate into a second trusted application; The device information corresponding to the second temporary certificate is encrypted in the second trusted application to obtain the encrypted device information.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the device-to-device interaction authorization method based on the TEE environment as described in any one of claims 1 to 6.

8. A readable storage medium, characterized in that: The readable storage medium stores a program for implementing a method for authorization to interact between devices based on a TEE environment, and the program for implementing a method for authorization to interact between devices based on a TEE environment is executed by a processor to implement the steps of the method for authorization to interact between devices based on a TEE environment as described in any one of claims 1 to 6.

Images