SE-based TLS two-way authentication method, terminal device and readable storage medium

Abstract

The present application provides a TLS two-way authentication method and terminal device based on SE, the method comprising: the system loads and calls the function of the mbedtls function library, when the fifth function is called by the system, the TLS handshake data is sent to the SE for signature processing; when the sixth function is called by the system, the SE is instructed to perform encryption and signature processing on the TLS handshake data to obtain the first data; when the first interface is called by the system, the first data is sent to the server; when the second interface is called by the system, the server returns a second notification message; when the twelfth function is called by the system, the signature information carried in the second notification message and the ciphertext containing the communication symmetric key are sent to the SE; when the thirteenth function is called by the system, the SE verifies the signature information according to the acquired device-side private key, and decrypts the ciphertext to obtain the decryption information; when the fourteenth function is called by the system, the communication symmetric key is obtained from the decryption information.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a TLS two-way authentication method based on SE, a terminal device and a readable storage medium. Background Art

[0002] With the rapid development of science and technology, the existing TLS (Transport Layer Security Protocol) two-way authentication method is usually implemented using software. During the authentication process, the software is easily hacked, and the security of its authentication cannot be guaranteed and the processing efficiency is low. Therefore, how to implement a secure and efficient TLS two-way authentication has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] The present application provides a TLS two-way authentication method, a terminal device and a readable storage medium based on SE to achieve secure and efficient TLS two-way authentication.

[0004] First,

[0005] A tls two-way authentication method based on SE is applicable to a terminal device including a system and a security chip SE, and the system is configured with an mbedtls function library. The method includes:

[0006] The system loads and calls the function library, and the functions in the function library communicate with the SE and send corresponding instructions to the SE;

[0007] When the fifth function of the function library is loaded and called by the system, the fifth function communicates with the SE and sends the TLS handshake data to the SE for signature processing;

[0008] When the sixth function of the function library is loaded and called by the system, the sixth function communicates with the SE, instructs the SE to perform encryption and signature processing on the TLS handshake data according to the extracted server public key to obtain the encrypted TLS handshake data, and the SE saves the encrypted TLS handshake data as the first data;

[0009] When the first interface of the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server and sends the first data to the server;

[0010] When the second interface of the function library is loaded and called by the system, the second interface calls the communication interface to communicate with the server, and receives a second notification message returned by the server indicating that the signature verification of the first data is successful;

[0011] When the twelfth function of the function library is loaded and called by the system, the twelfth function communicates with the SE and sends the signature information and the ciphertext containing the communication symmetric key carried in the second notification message to the SE;

[0012] When the thirteenth function of the function library is loaded and called by the system, the thirteenth function communicates with the SE, instructing the SE to decrypt the ciphertext containing the communication symmetric key after successfully verifying the signature information according to the acquired device-side private key;

[0013] When the fourteenth function of the function library is loaded and called by the system, the fourteenth function communicates with the SE and obtains the communication symmetric key from the decrypted information;

[0014] When the custom key sending function is called, the acquired communication symmetric key is sent to SE, so that the system completes the communication handshake processing according to the communication symmetric key.

[0015] In a second aspect, a terminal device is provided, including:

[0016] Processor and memory;

[0017] The memory is used to store computer programs;

[0018] The processor is used to execute the above-mentioned SE-based TLS two-way authentication method by calling the computer program.

[0019] In a third aspect, a terminal device program is provided;

[0020] The processor is used to execute the above-mentioned SE-based TLS two-way authentication method by calling the computer program.

[0021] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer storage medium is used to store a computer program, and when the computer program is run on a computer, the computer can execute the above-mentioned SE-based TLS two-way authentication method.

[0022] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0023] In this application, through the above-mentioned scheme, tls two-way authentication is realized by introducing a hardware security chip SE (Security extention chip). Compared with the existing tls two-way authentication method, the authentication process is realized by the hardware security chip SE, which improves the processing efficiency of two-way authentication and enhances the security of two-way authentication; by calling the mbedtls function library, the application platform of this scheme can be expanded to the field of embedded operating systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the embodiments of the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0025] Figure 1 A flow chart of the SE-based TLS two-way authentication method provided for this application;

[0026] Figure 2 This is a schematic diagram of the structure of an electronic device for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0027] The present application proposes a TLS two-way authentication method, a terminal device and a readable storage medium based on SE. The specific implementation method of the present application is described in detail below in conjunction with the accompanying drawings.

[0028] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0029] Those skilled in the art will appreciate that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may also be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any one of the units and all combinations of one or more associated listed items.

[0030] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0031] To make the purpose, technical solution and advantages of the present application clearer, the implementation methods of the present application are further described in detail below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0032] Terminology: SE is

[0033] Embodiment 1

[0034] Embodiment 1 is a process embodiment of a tls two-way authentication method based on SE provided by this application. The method is applicable to a terminal device including a system and a security chip SE. The system is configured with an mbedtls function library, such as Figure 1 As shown, the following steps are included:

[0035] The system loads and calls the mbedtls function library. The functions in the library communicate with the SE and send corresponding instructions to the SE.

[0036] When the fifth function of the function library is loaded and called by the system, the fifth function communicates with the SE and sends the TLS handshake data to the SE for signature processing;

[0037] When the sixth function of the function library is loaded and called by the system, the sixth function communicates with the SE, instructs the SE to perform encryption and signature processing on the TLS handshake data according to the extracted server public key to obtain the encrypted TLS handshake data, and the SE saves the encrypted TLS handshake data as the first data;

[0038] When the first interface of the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server and sends the first data to the server;

[0039] When the second interface of the function library is loaded and called by the system, the second interface calls the communication interface to communicate with the server, and receives a second notification message returned by the server indicating that the signature verification of the first data is successful;

[0040] When the twelfth function of the function library is loaded and called by the system, the twelfth function communicates with the SE and sends the signature information and the ciphertext containing the communication symmetric key carried in the second notification message to the SE;

[0041] When the thirteenth function of the function library is loaded and called by the system, the thirteenth function communicates with the SE, instructing the SE to decrypt the ciphertext containing the communication symmetric key after successfully verifying the signature information according to the acquired device-side private key;

[0042] When the fourteenth function of the function library is loaded and called by the system, the fourteenth function communicates with the SE and obtains the communication symmetric key from the decrypted information;

[0043] When the custom key sending function is loaded and called by the system, the acquired communication symmetric key is sent to SE, so that the system completes the communication handshake processing according to the communication symmetric key.

[0044] Embodiment 2

[0045] Based on the technical solution provided by the present application, the technical solution is explained in detail below. As shown in Example 2, it is a processing flow of a possible implementation method of the SE-based TLS two-way authentication method provided by the present application.

[0046] In the present application, the terminal device includes a system and a SE, and an mbedtls function library is configured in the system, in which multiple functions are configured, each function is used to forward messages sent by the system; wherein, when the system needs to send a message to the SE, it calls the corresponding function in the function library, and the corresponding function is sent to the SE through the communication interface for corresponding processing.

[0047] The system loads and calls the mbedtls function library, and the functions in the function library communicate with the SE and send corresponding instructions to the SE.

[0048] Among them, when the first function of the function library is loaded and called by the system, the first function communicates with the SE and instructs the SE to perform initialization processing. In a possible implementation, when the first function in the function library is loaded and called by the system, the first function communicates with the SE and instructs the SE to perform corresponding initialization processing, so that the SE is ready for subsequent processing; waits to receive a reply message returned by the SE, and sends an initialization RSA algorithm instruction to the SE according to the reply message returned by the SE, so that the SE enters the RSA encryption algorithm state for subsequent communication handshake.

[0049] After the SE is currently in the RSA encryption algorithm state, when the second function of the function library is loaded and called by the system, the second function communicates with the SE to inform the SE of the storage number of the server certificate.

[0050] In one possible implementation, based on the current RSA encryption algorithm status of the SE, when the second function of the function library is loaded and called by the system, the second function communicates with the SE and informs the SE of the storage number of the server certificate so that when the SE needs the server certificate, it can extract the corresponding server certificate according to the storage number.

[0051] After the SE learns the storage number of the server certificate, when the third function of the function library is loaded and called by the system, the third function communicates with the SE to instruct the SE to extract the server public key from the stored server certificate according to the obtained storage number.

[0052] In one possible implementation, after the SE learns the storage number of the server certificate, when the third function of the function library is loaded and called by the system, the third function communicates with the SE, instructing the SE that it can extract the corresponding server public key from the stored server certificate according to the storage number; the SE extracts the server public key according to the communication instruction of the third function.

[0053] When the fourth function of the function library is loaded and called by the system, the fourth function communicates with the SE and receives a first notification message sent by the SE indicating that the server public key has been extracted.

[0054] In one possible implementation, after receiving an instruction from the system, SE extracts the corresponding server public key from the server certificate corresponding to its own storage according to the storage number of the server certificate, and after the extraction is completed, returns a first notification message to the system that the server public key has been extracted; and when the fourth function in the function library is loaded and called by the system, the fourth function communicates with the SE and receives the above-mentioned first notification message sent by the SE.

[0055] When the fifth function of the function library is loaded and called by the system, the fifth function communicates with the SE and sends the TLS handshake data to the SE for signature processing.

[0056] In a possible implementation, when the fifth function in the function library is loaded and called by the system, the fifth function communicates with the SE and sends the TLS handshake data to the SE for corresponding signature processing.

[0057] When the sixth function of the function library is loaded and called by the system, the sixth function communicates with the SE, instructing the SE to encrypt the TLS handshake data according to the previously extracted server public key to obtain encrypted TLS handshake data, and the SE saves the encrypted TLS handshake data as the first data.

[0058] In one possible implementation, after the system learns that SE has extracted the server public key and gives the TLS handshake data to be processed to SE; when the sixth function in the function library is loaded and called by the system, the sixth function communicates with the SE, instructing SE to encrypt the TLS handshake data according to the extracted server public key to obtain corresponding encrypted TLS handshake data, and SE saves the encrypted TLS handshake data as the first data.

[0059] When the seventh function of the function library is loaded and called by the system, the seventh function communicates with the SE and receives the first data output by the SE.

[0060] In one possible implementation, after SE uses the extracted server public key to encrypt the TLS handshake data, it needs to return the processed first data to the system, and when the seventh function of the function library is loaded and called by the system, the seventh function communicates with the SE to receive the first data output by the SE.

[0061] When the eighth function of the function library is loaded and called by the system, the eighth function sets a filling character for the first data received by the seventh function to obtain filled data.

[0062] In one possible implementation, after the seventh function receives the first data sent by the SE, when the eighth function in the function library is loaded and called by the system, the eighth function performs character padding processing on the first data according to corresponding specification requirements to make it meet the corresponding character format.

[0063] When the ninth function of the function library is loaded and called by the system, the ninth function obtains the data length of the second data processed by the eighth function.

[0064] In a possible implementation, after the eighth function performs character padding processing on the first data, when the ninth function in the function library is loaded and called by the system, the ninth function obtains the data length of the second data processed by the eighth function.

[0065] Based on the acquired data length of the second data, when the first interface of the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server, and sends the second data to the server according to the data length of the second data.

[0066] In a possible implementation, when the first interface in the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server, and sends the second data to the server for processing according to the data length of the second data obtained by the ninth function.

[0067] After the first interface sends the second data to the server, when the second interface of the function library is loaded and called by the system, the second interface calls the communication interface to communicate with the server and receives a second notification message returned by the server indicating successful signature verification of the first data.

[0068] In one possible implementation, after the first interface sends the second data to the server, the server verifies the signature of the received data, and after successful verification, returns a notification message of successful verification to the system; when the second interface in the function library is loaded and called by the system, the second interface calls the communication interface to communicate with the server, and can receive the second notification message returned by the server; and the second notification message carries signature information containing the communication symmetric key.

[0069] When the tenth function of the function library is loaded and called by the system, the tenth function communicates with the SE and notifies the SE of the storage number of the device-side RSA private key.

[0070] In one possible implementation, after the second interface receives a notification message that the server has successfully verified the signature of the data, when the tenth function in the function library is loaded and called by the system, the tenth function communicates with the SE and gives the storage number of its own device-side RSA private key to the SE, so that the SE can obtain the device-side RSA private key according to the obtained storage number; the SE finds the corresponding device-side RSA private key according to the storage number of the device-side RSA private key.

[0071] When the eleventh function of the function library is loaded and called by the system, the eleventh function communicates with the SE to instruct the SE to verify the integrity of the RSA private key on the device side.

[0072] In one possible implementation, after SE finds the corresponding device-side RSA private key according to the storage number of the device-side RSA private key communicated by the tenth function, when the eleventh function in the function library is loaded and called by the system, the eleventh function communicates with the SE, instructing the SE to verify the integrity of the device-side RSA private key communicated by the tenth function, and based on the instruction, SE verifies the integrity of the found device-side RSA private key; when the integrity of the device-side RSA private key passes, it informs the system that the integrity verification passes.

[0073] When the twelfth function of the function library is loaded and called by the system, the twelfth function communicates with the SE and sends the first signature information and the ciphertext containing the communication symmetric key carried in the second notification message to the SE.

[0074] In one possible implementation, when the twelfth function in the function library is loaded and called by the system, the twelfth function communicates with the SE and sends the first signature information and the ciphertext containing the communication symmetric key carried in the second notification message received by the aforementioned second interface to the SE, so that the SE can verify the first signature information and decrypt the ciphertext containing the communication symmetric key.

[0075] When the thirteenth function of the function library is loaded and called by the system, the thirteenth function communicates with the SE, instructing the SE to verify the signature information according to the acquired device-side RSA private key, and decrypt the ciphertext containing the communication symmetric key to obtain the decryption information.

[0076] In one possible implementation, after the SE passes the integrity check of the device-side RSA private key, when the thirteenth function in the function library is loaded and called by the system, the thirteenth function communicates with the SE, instructing the SE to verify the signature information according to the obtained device-side RSA private key, and decrypt the ciphertext containing the communication symmetric key to obtain the decryption information.

[0077] Specifically, the SE uses the acquired device-side RSA private key to verify the first signature information, and at the same time decrypts the above-mentioned ciphertext data to obtain decryption information containing the communication symmetric key.

[0078] When the fourteenth function of the function library is loaded and called by the system, the fourteenth function communicates with the SE and obtains the communication symmetric key from the decryption information;

[0079] When the user-defined key sending function is loaded and called by the system, the acquired communication symmetric key is sent to the SE, so that the system completes the communication handshake processing according to the communication symmetric key.

[0080] In one possible implementation, after the fourteenth function communicates and receives the decryption information returned by SE, the negotiated communication symmetric key is obtained from the decryption information; when the custom key sending function is loaded and called by the system, the fourteenth function communicates with the SE and sends the obtained communication symmetric key to SE, so that the system can complete the communication handshake processing according to the obtained communication symmetric key, thereby realizing two-way authentication between the terminal device and the server.

[0081] In a possible implementation, when the user-defined key sending function is loaded and called by the system, the user-defined key sending function communicates with the SE and sends the acquired communication symmetric key to the SE. Then, when the sixteenth function in the function library is loaded and called by the system, the system acquires the communication symmetric key stored in the SE and uses the communication symmetric key to encrypt a predetermined character string and then generates a handshake end instruction.

[0082] When the first interface of the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server and sends a handshake end instruction to the server;

[0083] After receiving the handshake end instruction, the server uses the communication symmetric key stored in itself to decrypt the handshake end instruction to obtain a character string, encrypts the character string using the communication key stored in itself to generate a handshake end instruction response, and returns the handshake end instruction response to the system;

[0084] When the second interface of the function library is loaded and called by the system, the second interface calls the communication interface to communicate with the server and receives a response of a handshake end instruction returned by the server;

[0085] When the seventeenth function in the function library is loaded and called by the system, the system obtains the communication symmetric key stored in SE, and uses the communication symmetric key to decrypt the response to the handshake end instruction returned by the server to obtain a character string, so that SE can complete the communication handshake processing according to the obtained communication symmetric key, thereby realizing two-way authentication between the terminal device and the server.

[0086] When the fifteenth function of the function library is loaded and called by the system, the fifteenth function communicates with the SE to instruct the SE to exit the RSA encryption algorithm state.

[0087] In one possible implementation, after the system and SE complete the communication handshake processing, when the fifteenth function in the function library is loaded and called by the system, the fifteenth function communicates with the SE to instruct the SE to exit the current RSA encryption algorithm state. The SE releases the resource data related to the communication handshake processing according to the instruction, thereby realizing the exit from the RSA encryption algorithm state.

[0088] In a possible implementation, when the first function of the function library is loaded and called by the system, the first function communicates with the SE to instruct the SE to perform initialization processing, and when the first interface of the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server and sends the third data generated by the system according to the handshake data version number, the first random number and the encryption algorithm list to the server;

[0089] When the second interface of the function library is loaded and called by the system, the second interface calls the communication interface to communicate with the server, and receives the second signature information generated according to the handshake data version number, the second random number and the encryption algorithm used and returned by the server;

[0090] When the second interface calls the communication interface to receive the second signature information sent by the server, the first function of the function library is loaded and called by the system, and the first function communicates with the SE to instruct the SE to perform initialization processing;

[0091] When the first function of the function library is loaded and called by the system, the first function communicates with the SE to instruct the SE to perform initialization processing. When the tenth function in the function library is loaded and called by the system, the tenth function communicates with the SE and gives the storage number of its own device-side RSA private key to the SE, so that the SE can obtain the device-side RSA private key according to the obtained storage number; the SE finds the corresponding device-side RSA private key according to the storage number of the device-side RSA private key;

[0092] In this embodiment, the device-side RSA private key is pre-stored in the SE.

[0093] When the eleventh function of the function library is loaded and called by the system, the eleventh function communicates with the SE to instruct the SE to verify the integrity of the RSA private key on the device side. The SE verifies the integrity of the found RSA private key on the device side and informs the system that the integrity verification is passed.

[0094] When the twelfth function of the function library is loaded and called by the system, the twelfth function communicates with the SE and sends the second signature information to the SE, so that the SE can verify and decrypt the second signature information.

[0095] When the thirteenth function of the function library is loaded and called by the system, the thirteenth function communicates with the SE and instructs the SE to verify and decrypt the second signature information according to the acquired device-side RSA private key.

[0096] In one possible implementation, after SE passes the integrity check of the device-side RSA private key, when the thirteenth function in the function library is loaded and called by the system, the thirteenth function communicates with the SE, instructing the SE to verify and decrypt the obtained second signature information according to the device-side RSA private key.

[0097] Specifically, SE uses the device-side RSA private key to decrypt the second signature information to obtain the decrypted second signature information, and verifies the decrypted second signature information, and informs the system of the verification success result after the verification succeeds.

[0098] In one possible implementation, when the second function of the function library is loaded and called by the system, the second function communicates with the SE, and before sending the storage number of the server certificate to the SE, the SE verifies the decrypted second signature information, and informs the system of the verification success result after the verification succeeds.

[0099] In the embodiment, in a possible implementation method, when the first function of the function library is loaded and called by the system, the first function communicates with the SE, instructs the SE to perform initialization processing, and then the system instructs the SE to obtain the device-side RSA private key and verify the RSA completeness. The process only needs to be executed once, and the RSA private key can participate in the verification and decryption process of the signature information sent by the server multiple times.

[0100] Embodiment 3

[0101] Based on the technical solution provided by the present application, the technical solution is explained in detail with a specific implementation method below. As shown in Example 3, it is a specific processing flow of a possible implementation method of the SE-based TLS two-way authentication method provided by the present application. In this embodiment, the terminal device takes a cloud speaker as an example, a system and an SE are set in the cloud speaker, and a plurality of functions (mbedtls_rsa_init function, mbedtls_rsa_import function, mbedtls_rsa_import_raw function, mbedtls_rsa_complete function, mbedtls_rsa_export function, mbedtls_rsa_export_raw function, mbedtls_rsa_export_crt function, mbedtls_rsa_set_padding function, mbedtls_rsa_get_len function, tls send interface, tls_recv interface, mbedtls_rsa_private function, mbedtls_rsa_check_privkey function, mbedtls_rsa_public function, mbedtls_rsa_check_pub_priv function, mbedtls_rsa_gen_key function and mbedtls_rsa_free function) are configured in the system. Function) of the mbedtls function library.

[0102] In this embodiment, SE is a hardware security chip (Security extention chip).

[0103] The cloud speaker system loads and calls the mbedtls library, which communicates with the SE and sends corresponding instructions to the SE. Specifically:

[0104] When the mbedtls_rsa_init function (the first function) of the function library is loaded and called by the system, mbedtls_rsa_init function communicates with SE and sends an initialization instruction to SE. After SE replies with completion information, it continues to send the initialization RSA algorithm instruction aa e9 fb 6b 2f ca 43 a9 ​​74 05 3b 48 c9 20 bd f2 51 75 65 63 494e 46 4f 20 20 20 20 20 20 20 20 20 02 20 20 20 20 20 20 20 20 20 ec cc to SE, instructing SE to initialize RSA algorithm processing; SE performs corresponding RSA algorithm initialization processing according to the received instruction, so that SE enters the RSA encryption algorithm state.

[0105] After SE performs initialization processing based on the instructions of the mbedtls_rsa_init function, based on the current RSA encryption algorithm state of SE, when the mbedtls_rsa_import function (the second function) of the function library is loaded and called by the system, the mbedtls_rsa_import function communicates with SE and informs SE of the storage number ec cc 10 20 20 2020 20 01 20 20 20 02 of the server certificate. SE can extract the corresponding server certificate according to the received storage number.

[0106] When the mbedtls_rsa_import_raw function (the third function) is loaded and called by the system, the mbedtls_rsa_import_raw function communicates with SE and sends an instruction fe b1 40 e2 e7 03 6ab7 8e 98 7a 6f d0 9a c0 3c 51 75 65 63 49 4e 46 4f to extract the server public key to SE. SE extracts the corresponding server public key in the server certificate based on the storage number according to the received instruction. After SE extracts the server public key, it sends a first notification message 15 ac 10 23 bb 8b 3c c7 84 a1 61 of the extracted server public key to the system.

[0107] When the mbedtls_rsa_complete function (the fourth function) is loaded and called by the system, the mbedtls_rsa_complete function communicates with the SE and receives a first notification message sent by the SE indicating that the server public key has been extracted.

[0108] 06 44 eb cc fc ff ef ef fb 3e 7f9e f5 9e f3 9c e7 3c e7 39 cf 76 6f 20 50 44 tls_rsa_export tls_rsa_export_data 94 1b 20 1a ea 02 05 6c 69 3b ad 71a9 da d6 8e b8 74 6a 5d a6 d4 65 a6 76 55 5b 5b 6d e5 05 97 a9 5d 67 88 e2 8cad 75 c4 4e 5b 14 67 b9 20 9a cb 9a ef 39 f7 06 44 eb cc fc ff ef ef fb 3e 7f9e f5 9e f3 9c e7 3c e7 39 cf 76 6f 20 50 e9 5b 35 73 53 43 10 fc 23 20 15 75fd 5d 95 1f 3d 23 ff 40 d6 e9 3d ab cf ce 54 6e 44 d2 bf 7a 27 ba eb df 9f 7f28 6b 5b 54 f2 63 f0 cb 9b 5e ff e4 7f 5e 9b 7b 20 b7 4c ea 0f a4 d1 7f fc 376f f9 fd fb 35 86 09 d7 a7 52 a8 7b 12 a4 71 90 8e 93 a8 07 a1 c2 bf c1 23 e5de e1 a8 5b 63 a8 bf f6 a7 e1 a8 6d f6 71 cb 71 34 5e d1 80 e2 22 1b 6c bc 3709 92 1e f1 3b 8f bd db ae 50 2f bf 4e ff 11 f1 32 e1 b2 40 b7 5c be 4e ea e843 15 39 af 19 15 0d b5 c6 09 d7 79 1b cd a6 35 20 26 80 bd 2c c4 34 a6 35 10ec d2 f3 b5 ec 6b ec 07 dd 6b 3b 50 42 45 d3 d1 ee e7 6f a2 09 ce a6 73 11 7bdb 99 40 ff 6e b2 47 d1 1d 78 f3 54 3b 23 b7 b6 51 aa b8 6e f9 4d 5c 2a ba c9ee 45 d9 8a 86 39 is sent to the SE for signature.

[0109] When the mbedtls_rsa_export_raw function (the sixth function) is loaded and called by the system, the mbedtls_rsa_export_raw function communicates with the SE and sends a processing instruction d9 d3 01 16 c1 2a cf 13 cc 8737 94 34 ea 0e 6c 67 60 8c e3 86 ca 2f dc 54 6b 40 f1 d3 9b 6c 6d to the SE, instructing the SE to encrypt the TLS handshake data according to the extracted server public key, and obtain the encrypted TLS handshake data f3 15 b6 b605 fe b9 6d 5f d5 0c 67 55 2d 1f de 50 50 8e 1b fe ca 4b 61 96 1b 4a e5 c2 484b 3b f2 23 66 c8 9b f2 01 5e 56 f6 bf ce c5 84 2f cf 24 66 78 dc 7e dd 72 4f4c 37 79 33 c3 14 db 1d d8 8f c2 63 bb 49 c1 d4 16 48 03 5e 72 c0 47 06 38 dca4 61 0c dd 4d 76 98 da e4 54 4c b7 ec 76 f6 0d 82 48 31 b9 22 b2 59 fb 0d 8a38 d1 8e 82 88 a6 af af a3 ec fa 6b fc e6 0f bb d7 dd 64 52 b6 b6 1e eb de d881 77 c9 24 a3 09 2f b9 6f b6 a2 86 8a 1c d4 c0 de 56 50 8d 1d 88 52 b2 04 1be6 44 7c d2 f1 3b 7d 52 4f cd f1 bb db 9f 1d 5b c7 66 b6 21 4a cb 53 94 d9 6d48 d7 9d 57 39 29 ce ea 34 71 2f 39 d7 72 5f 39 4f 73 aa 32 ca 6e 2d 33 d9 5f2a 5b 6b ff aa ec b4 5d f5 18 55 6c 7d cc 54 fc d2 63 6b 8b bf 7a ec 74 b1 6a29 55 62 5d 6a 2a 79 69 e9 da 92 af 96 9e 2e 31 e8 0d 49 86 f4 4b e7 f4 c9aa5f c0 d2 e8 35 49 9a f4 9b e7 d4 c9 7e e7 1f 14 e8 0c 03 24 3a bd eb 1c 9d ac68 3a 27 8f 6c 08 16 88 0c 04 89 38 af da 48 b9 38 16 ef 49 11 af 3d ff 92 fc70 93 06 30 7c af e9 74 3b 4d 9d 8b b8 34 64 ec fe f3 49 02 99 c1 40 7a bd 954e ff f6 3c 91 3e f0 a4 eb 9c.

[0110] According to the instruction of mbedtls_rsa_export_raw function, SE uses the server public key extracted above to encrypt the tls handshake data to obtain the corresponding encrypted tls handshake data. After encrypting the tls handshake data, SE sends the encrypted tls handshake data to the system.

[0111] When the mbedtls_rsa_export_crt function (the seventh function) is loaded and called by the system, the mbedtls_rsa_export_crt function communicates with the SE and receives the encrypted tls handshake data output by the SE.

[0112] After the mbedtls_rsa_export_crt function obtains the encrypted TLS handshake data output by SE, when the mbedtls_rsa_set_padding function (the eighth function) is loaded and called by the system, the mbedtls_rsa_set_padding function performs character padding on the encrypted TLS handshake data according to the corresponding character format specification, and obtains the padded data aa 86 aa b0 d6 98 2a 5e aa 595b 81 a1 f1 1f ae 97 b3 4d 73 46 e313 fd f2 08 c5 92 2d a1 ed de d4 29 e7 29 81 48 d8 23 17 dc 54 e2 f8 6f bf 3912 94 98 dd e6 17 0b 29 3b e5 db fd ed 1a 19 05 67 45 b5 6b c8 29 fe f2 1b b211 c6 eb f4 43 c6 eb e4 43 9a e4 4f 8c 82 bb 32 32 94 57 07 d1 7c 90 8c ba 4186 68 9b 52 c6 e8 20 4f 3a 45 9b 65 14 e8 05 db 8c 3d 6e 19 4f d1 89 87 bf 3812 99 05 ab 8c dc 0d 3d fc 89 8a 9c 54 56 cb a2 c4 9b 6e a1 35 94 a5 d8 53 ad11 ec 58 b6 a5 15 8d 37 35 a5 1d 55 8f 01 da 4c f7 63 51 c2 b1 86 1f c3 10 3fab 9b bd 6d d0 e2 33 0b 77 8e 3f fc 86 51 f5 6d b4 b3 2e 6c b5 71 5c 93 9d 8b63 23 b9 fa 6b 69 06 c4 67 7e 12 ce 5a 9d fb 8c 9b 1a 50 34 11 8d 12 e0 56 45a3 f8 4e b7 d2 b9 31 ac ce 18 d6 a4 bb 88 67 ad 35 06 37 94 70 e7 af 23 fd b9b0 68 4e d1 c0 71 79 20 43 82 c0 7c e2 be 8e 34 ca ac 688e e3 ce b5 56 e4 304e 32 4b c9 6d84 39 ff 70 e3 19 11 d0 ca e5 5a 5b d5 ba 38 36 c1 b7 aa ec 13eb 68 15 be 91 99 19 6e 3a 5e 06 b7 92 8e 56 8c 27 db 29 bf b4 06 45 54 2c 4ff9 a9 d9 f1 59 8a 69 88 cf 10 0a 3f 28 84 7d 91 63 ae 46 96 1a f1 de ce 85 0567 1d 6b d0 8c 52 1b c6 45 c8 9a 54 93 c8 1b 72 c5 ee 86 67 8c e7 1f 0c bf 38c2 e9 d7 ae a6 74 59 ee f0 d7 8c e4 45 06.

[0113] After the mbedtls_rsa_set_padding function performs character padding processing on the encrypted TLS handshake data, when the mbedtls_rsa_get_len function (the ninth function) is loaded and called by the system, the mbedtls_rsa_get_len function obtains the data length of the padded data processed by the mbedtls_rsa_set_padding function.

[0114] 4c bb 50 35 ba 41 1d 8d 98 74 2e c5 0d 34 1e 0e 34 96 3c e4 ac 62 b2 7a 42 5a 83 3a f6 a071 7b 03 8a 22 a2 1e 6c bb 50 35 ba 41 1d 8d 98 74 2e c5 0d 34 1e 0e 34 96 3c e4 ac 62 b2 7a 42 5a 83 3a f6 a071 7b 03 8a 22 a2 1e 6c bb 50 35 ba 41 1d 8d 98 74 2e c5 0d 34 1e 0e 34 96 3c e4 ac 62 b2 7a 42 5a 83 3a f6 a071 7b 03 8a 22 a2 81fc e9 4a 76 ce 3a ac 75 2e 18 49 37 1b 5b 74 50 c6 5e 88 66 e7 38 51 a2 e0 7edc 89 c6 a7 34 8d 67 d3 58 c4 b7 75 9b 22 c7 36 9d 89 8c 81 13 ae 33 fa 35 4545 e0 de 2b dd 84 7e 64 53 2c 87 eb 4f 76 d1 ed 2a a4 1b c5 f0 72 74 2a 22 b261 64 c4 be 42 a1 5e 95 20 bf 58 e2 dc 6b 0c 6b 98 cd dd 70 a7 70 d7 81 07 745c 64 56 2c f7 23 d0 36 8d cd e0 10 3f bf 0b 31 42 3d 86 f1 71 77 05 f7 59 ab2a e1 ef 17 67 3b 43 d9 d6 56 57 1b a1 8e e4 a9 a0 a9 6e b8 11 6a 86 a7 50 144f 11 40 59 38 71 7c a7 02 9b 36 41 7f 39 bf ca 64 6b fb 5a ad eb 56 f7 e2 5e63 9b 9a 34 b5 a9 29 d4 b0 b7 9d 98 be d3 48 34 24 b6 91 20 c7 35 13 cf c4 233a 40 c6 91 9c ad 2d 24 9a 88 8b 6b 38 74 83 2a 57 34 8c 54 76 36 51 bc97 4281 8d 11 15 39 b0 5e 90 b2 49 03 77 05 df 30 22 3e ae 61 a7 b1 b3 69 ef 0d 0a55 e4 e4 0b f4 22 0c 89 20 4a 63 7c 30 44 72 c2 d8 a6 fc 8b d1 fc aa ec a3 37b4 93 f0 ba 78 cd 20 37 ac 3a.

[0115] 11 60 64 4f 82 f9 94 09 d760 15 53 5c 0b 6a 20 79 2f 8c d6 56 5b 9b 56 b7 a0 65 3a bf 2a 6f 8e 5b55 03 d8 38 e6 b4 e0 1c 63 61 83 1a 99 8d e1 d8 da 86 65 63 58 20 d7 16 36 049e 7c 20 9e cd 5f 84 f7 73 6b 51 9b 3a 6f 92 5b b5 11 60 64 4f 82 f9 94 09 d760 15 53 5c 0b 6a 20 79 2f 8c d6 96 ff 47 dc 26 29 ef e0 56 12 d0 12 c2 7b 8364 4d 78 04 40 8a d5 01 9d a9 16 1b 8f 10 03 b7 da 8f f7 92 80 29 c2 14 ac 35d2 0d 13 94 98 82 7b 6f 48 4f 51 03 9c 16 01 54 44 8d ed 08 61 08 a8 9d 56 e353 2a e7 11 19 d9 10 dd ad ee d0 9a 6c 3c a1 ce 6b 53 27 42 ca db 77 43 4d 46b7 51 64 48 db d7 21 b4 88 15 ad ef 6c 3a d5 8e 08 b2 8d 20 8f 74 af e9 38 d53e 86 44 37 ce c1 09 50 f1 86 36 82 aa is returned to the system.

[0116] 6a 20 9e 8d e1 d8 da 86 65 63 58 20d7 16 36 04 9e 7c 20 9e cd 5f 84 f7 73 6b 51 9b 3a 6f 92 5b b5 11 60 64 4f 82f9 94 09 d7 60 15 53 5c 0b 6a 20 9e 8d e1 d8 da 86 65 63 58 20d7 16 36 04 9e 7c 20 9e cd 5f 84 f7 73 6b 51 9b 3a 6f 92 5b b5 11 60 64 4f 82f9 94 09 d7 60 15 53 5c 0b 6a 20 79 2f 8c d6 96 ff 47 dc 26 29 ef e0 56 12 d012 c2 7b 83 64 4d 78 04 40 8a d5 01 9d a9 16 1b 8f 10 03 b7 da 8f f7 92 80 29c2 14 ac 35 d2 0d 13 94 98 82 7b 6f 48 4f 51 03 9c 16 01 54 44 8d ed 08 61 08a8 9d 56 e3 53 2a e7 11 19 d9 10 dd ad ee d0 9a 6c 3c a1 ce 6b 53 27 42 ca db77 43 4d 46 b7 51 64 48 db d7 21 b4 88 15 ad ef 6c 3a d5 8e 08 b2 8d 20 8f 74af e9 38 d5 3e 86 44 37 ce c1 09 50 f1 86 36 82 aa, the notification message carries the result of successful signature verification, and the second notification message carries the ciphertext including the first signature information and the communication symmetric key.

[0117] After the tls_recv interface receives the notification message that the server has successfully verified the signature of the data, when the mbedtls_rsa_private function (the tenth function) is loaded and called by the system, the mbedtls_rsa_private function communicates with the SE and gives the storage number of the device-side RSA private key f8 f0 f4 4d 82 06 fe 8e 25 62 51 a2 8c 0d 83 da81 e3 2f 1e 56 d7 a4 b0 0f 8d 06 09 64 ed 3d 9c 9c 35 31 8b 6e 81 33 b4 e1 f689 c3 3b 8d bf bb to the SE, so that the SE can obtain the device-side RSA private key according to the obtained storage number.

[0118] After the mbedtls_rsa_private function gives the storage number of the device-side RSA private key to the SE, when the mbedtls_rsa_check_privkey function (the eleventh function) is loaded and called by the system, the mbedtls_rsa_check_privkey function communicates with the SE and sends the instruction 41 f9 dd 76 57 20 8e 2a 36 9c 9d 0d92 eb 40 3b 91 1a d3 e6 47 87 02 87 b4 b8 to the SE, instructing the SE to verify the integrity of the device-side RSA private key.

[0119] Based on the instruction of the mbedtls_rsa_check_privkey function, the SE obtains the corresponding device-side RSA private key through the storage number of the device-side RSA private key communicated by the mbedtls_rsa_private function, and verifies the integrity of the device-side RSA private key.

[0120] After the SE passes the integrity check of the RSA private key on the device side, when the mbedtls_rsa_public function (the twelfth function) is loaded and called by the system, the mbedtls_rsa_public function communicates with the SE.The first signature information and the ciphertext containing the communication symmetric key in the second notification message received by the tls_recv interface are 70 f6 5f 17 2fb6 a2 09 d7 9b 46 65 a1 68 2c 35 df 06 79 56 21 ee 6d 20 69 ac 58 1a 3c ea 74b1 5e cf 06 6f 60 be 9c 0d 3c 9e ca 86 b4 3c 24 d0 d6 8f 6f 84 96 13 4d c4 8c5b ad 06 36 86 5f 95 45 b7 eb b3 e8 5b 54 6a 14 8c dd d6 8f e2 da dd be 1b ad26 0f 31 90 28 27 86 35 8c a5 d9 88 b2 40 d6 c8 1b c8 08 fb c8 b2 22 19 d1 8cf8 1b c2 99 eb b4 03 e9 ce 5c 97 a5 fc cd 49 26 c8 dd d1 ce 40 dd 36 4e 5b 66eb 7c ba 8a c8 48 3b c7 b0 68 1c e2 a9 ae 92 82 92 b2 28 a7 ea 30 31 23 d3 ad2a d3 f1 32 4a 65 47 13 0d fc 47 ae 45 d6 91 4e 94 20 bf bc d0 b2 c8 bc 28 97e0 c7 f5 e3 3c a6 9f 61 c1 12 99 8c f8 e3 42 b4 53 0b 33 0c 94 d6 8e 26 20 fe75 d7 83 be 19 85 96 42 f3 83 30 36 b0 1f e7 aa fe 38 11 ef 2d 65 5b ec 66 59e3 05 94 d0 e8 66 c5 91 27 2e 67 5b 58 33 0b 63 ba fa 72 21 bf dd f7 41 eb cb65 c3 f8 c6 a0 c9 4d 2f db 1f 93 8d b8 c0 40 8b 08 54 96 35 0b 61 ae 26 41 d118 cd 07 91 09 4d ea 76 ef f4 33 d9 7e ee 96 32 22 63 07 58 3d 46 5e 46 1a 7905 a9 b4 send to SE,So that SE can verify and decrypt the signature information.

[0121] When the mbedtls_rsa_check_pub_priv function (the thirteenth function) is loaded and called by the system, the mbedtls_rsa_check_pub_priv function communicates with the SE and sends the instruction 27 c8 c2 2e e8 9ce1 65 3b 9c ba b2 28 3e 88 f8 ce b9 af 6c 51 e4 01 7b d3 1c 5d 59 5d d9 to the SE, instructing the SE to verify the first signature information communicated by the mbedtls_rsa_public function according to the device-side RSA private key and then decrypt the ciphertext containing the communication symmetric key.

[0122] According to the instruction of the mbedtls_rsa_check_pub_priv function, the SE uses the acquired device-side RSA private key to verify the first signature information, and decrypts the above ciphertext data to obtain decrypted information, wherein the decrypted information carries the communication symmetric key.

[0123] mbedtls_rsa_gen_key function (the fourteenth function), after receiving the decrypted information containing the communication symmetric key returned by SE, obtains the carried communication symmetric key from it; when the custom function import_key_to_se is loaded and called by the system, the custom function import_key_to_se communicates with the SE and converts the communication symmetric key da 4e 30 88 3f d5 f5 74 eb 99 ec d0 6f 1b 9d 8a 76 22 b0 33 fb 8c 10 d6 a2 1114 68 23 07 90 91 cc dd 2c 44 36 12 19 bb b3 f1 6a 4a a4 b0 7f d1 7a 15 56 c7a3 5e 33 12 ed 04 29 3b f7 83 5d a3 67 ec 40 57 7e 9e f0 49 2b d0 ff 9f 3f d83f 6a 2d 2e fb a9 ec f7 76 22 fd 15 a3 5f 3b 81 64 e7 5a ec 9a 14 86 d5 d9 119f 2d 34 e2 51 4f b6 d8 4f b4 a2 d8 79 90 1e 6b 35 18 83 d0 26 b0 3f b7 3e 8ad0 da 45 08 7d b8 04 a1 df 2e 44 e8 18 a4 75 90 d2 8e d2 6c 77 2c d0 dd 79 49ae 6c d6 96 11 8c 8e 27 28 13 1f 88 cf 80 e7 ba 88 07 78 b7 ce d9 e2 f4 37 4794 45 f3 5a e0 08 5b a7 cb 18 61 df 59 b6 d3 0e 3d 62 9d b2 10 71 61 0d 4a 36c2 9e 56 cf 51 04 e2 d6 12 88 2c d3 3a 67 39 17 a0 73 72 d2 79 e9 48 6e 83 09a0 62 6e d1 75ba 66eb 78 12 56 f0 87 15 2a 72 14 16 8a d5 1c d5 38 e5 79 44d6 1b a0 7b 64 79 6f 18 e9 73 ea 68 6c 9b 46 70 9a fa 60 ae b7 75 3b b6 9f 5de4 21 a421 0f 69 8e 9a 19 9a 3f e7 d5 1c ae bf a6 31 a0 1c 4d bd e2 a8 d7 d3e9 45 69 61 0d 04 a3 a8 0f b7 46 58 2a 8e 46 e4 45 14 8c cc 8f e0 ae 1d d7 393f 30 46 b8 4b 9c c5 ce 47 46 6f 31 2a ce c9 53 e6 08 3a c4 f0 ab 0c a8 5d 6f40 b7 28 3d 8a 32 e8 1b db f5 46 f2 16 9d ec f5 1c e8 21 74 78 ed 04 ae a2 5e91 0b 7b 2d 46 51 5e cf ce is sent to SE, so that the system can complete the communication handshake processing according to the communication symmetric key, and realize the two-way authentication processing between the cloud speaker and the server.

[0124] In this embodiment, when the custom function import_key_to is loaded and called by the system, the custom function import_key_to communicates with the SE and sends the acquired communication symmetric key to the SE. Then, when the sixteenth function (mbedtls_aes_setkey_enc) in the function library is loaded and called by the system, the system acquires the communication symmetric key da 4e 30 88 3f d5 f5 74 eb 99 ec d0 6f 1b 9d 8a 76 22 b0 33fb 8c 10 d6 a2 11 14 68 23 07 90 91 cc dd 2c 44 36 12 19 bb b3 f1 6a 4a a4 b07f d1 7a 15 56 c7 a3 5e 33 12 ed 04 29 3b f7 83 5d a3 67 ec 40 57 7e 9e f0 492b d0 ff 9f 3f d8 3f 6a 2d 2e fb a9 ec f7 76 22 fd 15 a3 5f 3b 81 64 e7 5a ec9a 14 86 d5 d9 11 9f 2d 34 e2 51 4f b6 d8 4f b4 a2 d8 79 90 1e 6b 35 18 83 d026 b0 3f b7 3e 8a d0 da 45 08 7d b8 04 a1 df 2e 44 e8 18 a4 75 90 d2 8e d2 6c77 2c d0 dd 79 49 ae 6c d6 96 11 8c 8e 27 28 13 1f 88 cf 80 e7 ba 88 07 78 b7ce d9 e2 f4 37 47 94 45 f3 5a e0 08 5b a7 cb 18 61 df 59 b6 d3 0e 3d 62 9d b210 71 61 0d 4a 36 c2 9e 56 cf 51 04 e2 d6 12 88 2c d3 3a 67 39 17 a0 73 72 d279 e9 48 6e 83 09 a0 62 6e d1 75ba 66 eb 78 12 56 f0 87 15 2a 72 14 16 8a d51c d5 38 e5 79 44 d6 1b a0 7b 64 79 6f 18 e9 73 ea 68 6c 9b 46 70 9a fa 60 aeb7 75 3b b6 9f 5d e421 a4 21 0f 69 8e 9a 19 9a 3f e7 d5 1c ae bf a6 31 a0 1c4d bd e2 a8 d7 d3 e9 45 69 61 0d 04 a3 a8 0f b7 46 58 2a 8e 46 e4 45 14 8c cc8f e0 ae 1d d7 39 3f 30 46 b8 4b 9c c5 ce 47 46 6f 31 2a ce c9 53 e6 08 3a c4f0 ab 0c a8 5d 6f 40 b7 28 3d 8a 32 e8 1b db f5 46 f2 16 9d ec f5 1c e8 21 7478 ed 04 ae a2 5e 91 0b 7b 2d 46 51 5e cf ce, and use the communication symmetric key to encrypt the predetermined string handshake finish and generate the handshake finish instruction 03 03 49 d1 40 3a 23 d3 0b 68 0360 4b 68 43 60 8b 68 83 60 cb 68 c3 60 0b 69 03 61 4b 69 43 61 8b 69 83 61 cb69 c3 61 0b 6a 03 62 4b 6a 43 62 8b 6a 83 62 cb 6a c3 62 0b 6b 03 63 4b 6b 4363 8b 6b 83 63 cb 6b c3 63 40 30 40 31 40 3a db d2 30 32 0b d3 0b 68 03 60 4b68 43 60 8b 68 83 60 cb 68 c3 60 10 30 10 31 10 3a f3 d2 0c 32 05 d3;

[0125] When the tls send interface (first interface) of the function library is loaded and called by the system, when the tls send interface calls the communication interface to communicate with the server, a handshake end instruction is sent to the server;

[0126] After receiving the handshake end instruction, the server uses its own stored communication symmetric key da 4e 30 88 3fd5 f5 74 eb 99 ec d0 6f 1b 9d 8a 76 22 b0 33 fb 8c 10 d6 a2 11 14 68 23 07 9091 cc dd 2c 44 36 12 19 bb b3 f1 6a 4a a4 b0 7f d1 7a 15 56 c7 a3 5e 33 12 ed04 29 3b f7 83 5d a3 67 ec 40 57 7e 9e f0 49 2b d0 ff 9f 3f d8 3f 6a 2d 2e fba9 ec f7 76 22 fd 15 a3 5f 3b 81 64 e7 5a ec 9a 14 86 d5 d9 11 9f 2d 34 e2 514f b6 d8 4f b4 a2 d8 79 90 1e 6b 35 18 83 d0 26 b0 3f b7 3e 8a d0 da 45 08 7db8 04 a1 df 2e 44 e8 18 a4 75 90 d2 8e d2 6c 77 2c d0 dd 79 49 ae 6c d6 96 118c 8e 27 28 13 1f 88 cf 80 e7 ba 88 07 78 b7 ce d9 e2 f4 37 47 94 45 f3 5a e008 5b a7 cb 18 61 df 59 b6 d3 0e 3d 62 9d b2 10 71 61 0d 4a 36 c2 9e 56 cf 5104 e2 d6 12 88 2c d3 3a 67 39 17 a0 73 72 d2 79 e9 48 6e 83 09 a0 62 6e d1 75ba 66 eb 78 12 56 f0 87 15 2a 72 14 16 8a d5 1c d5 38 e5 79 44 d6 1b a0 7b 6479 6f 18 e9 73 ea 68 6c 9b 46 70 9a fa 60 ae b7 75 3b b6 9f 5d e4 21 a4 21 0f69 8e 9a 19 9a 3f e7 d5 1c ae bf a6 31 a0 1c 4d bd e2 a8 d7 d3 e9 45 69 61 0d04 a3 a8 0f b7 46 58 2a 8e 46 e4 4514 8c cc 8f e0 ae 1d d7 39 3f 30 46 b8 4b9c c5 ce 47 46 6f 31 2a ce c9 53 e6 08 3a c4 f0 ab 0c a8 5d 6f 40 b7 28 3d 8a32 e8 1b db f5 46 f2 16 9d ec f5 1c e8 21 74 78 ed 04 ae a2 5e 91 0b 7b 2d 4651 5e cf ce Decrypt the handshake end instruction to get the string, use the communication symmetric key stored in itself to encrypt the string and generate the handshake end instruction response 03 80 60 46 70 47 20 bf 08 2a 13 d3 8b 07b1 d0 10 f0 03 03 ae d0 c3 f1 04 03 d2 1a db 07 1c bf 11 f8 01 3b 20 f8 01 3ba4 d3 31 f8 02 3b 20 f8 02 3b 9f e7 04 3a d9 d3 01 3a 11 f8 01 3b 20 f8 01 3bf9 d2 0b 78 03 70 4b 78 43 70 8b 78 83 70 60 46 70 47 80 ea 01 0c 1c f0 03 0f37 d1 10 f0 03 0c 20 f0 03 20 21 f0 03 01 50 f8 04 2b 08 bf 51 f8 04 3b 0e d08c f0 03 0c 6f f0 7f 43 4f ea, and returns the handshake end command response to the system;

[0127] When the tls_recv interface (second interface) of the function library is loaded and called by the system, the tls_recv interface calls the communication interface to communicate with the server and receives a response to the handshake end instruction returned by the server;

[0128] When the seventeenth function in the function library is loaded and called by the system, the system obtains the communication symmetric key stored in SE, and uses the communication symmetric key to decrypt the response to the handshake end instruction returned by the server to obtain a character string, so that SE can complete the communication handshake processing according to the obtained communication symmetric key, thereby realizing two-way authentication between the terminal device and the server.

[0129] When the mbedtls_rsa_free function (the fifteenth function) is loaded and called by the system, the mbedtls_rsa_free function communicates with the SE and sends an instruction 52 37 96 43 cc df 38 42 97 c0 b5 83 9e cb c336 7b 20 e0 04 f7 a6 70 96 ad 10 db f0 13 ae 0b 26 to the SE, instructing the SE to exit the current RSA encryption algorithm state according to the received instruction.

[0130] SE releases the relevant resource data of the communication handshake processing according to the instruction of mbedtls_rsa_free function, thereby exiting the RSA encryption algorithm state.

[0131] In this embodiment, when the mbedtls_rsa_init function (the first function) of the function library is loaded and called by the system, the mbedtls_rsa_init function communicates with the SE and sends an initialization instruction to the SE. After the SE replies with completion information, the mbedtls_rsa_init function continues to send an initialization RSA algorithm instruction aa e9 fb 6b 2f ca 43 a9 ​​74 05 3b 48 c9 20 bd f2 51 7565 63 49 4e 46 4f 20 2020 20 20 20 20 20 02 20 20 20 20 20 20 20 20 20 20ec cc to the SE, instructing the SE to initialize the RSA algorithm processing; the SE performs corresponding RSA algorithm initialization processing according to the received instruction, so that before the SE enters the RSA encryption algorithm state, the following may also be included:

[0132] 06 44 eb cc fc ff efef fb 3e 7f 9e f5 9e f3 9c e7 3c e7 39 cf 76 6f 20 50 e9 5b 35 73 53 43 10 fc23 20 . When the tls send interface (the first interface) is loaded and called by the system, the first interface calls the communication interface to communicate with the server, and the system generates the third data 3b ad 71 a9 da d6 8e b8 74 6a 5d a6 d4 65 a6 76 55 5b 5b 6d e5 05 97 a9 5d67 88 e2 8c ad 75 c4 4e 5b 14 67 b9 20 9a cb 9a ef 39 f7 06 44 eb cc fc ff efef fb 3e 7f 9e f5 9e f3 9c e7 3c e7 39 cf 76 6f 20 50 e9 5b 35 73 53 43 10 fc23 20 15 75 fd 5d 95 1f 3d 23 ff 40 d6 e9 3d ab cf ce 54 6e 44 d2 bf 7a 27 baeb df 9f 7f 28 6b 5b 54 f2 63 f0 cb 9b 5e ff e4 7f 5e 9b 7b 20 b7 4c ea 0f a4d1 7f fc 37 6f f9 fd fb 35 86 09 d7 a7 52 a8 7b 12 a4 71 90 8e 93 a8 07 a1 c2bf c1 23 e5 de e1 a8 5b 63 a8 bf f6 a7 e1 a8 6d f6 71 cb 71 34 5e d1 80 e2 221b 6c bc 37 09 92 1e f1 3b 8f bd db ae 50 2f bf 4e ff 11 f1 32 e1 b2 40 b7 5cbe 4e ea e8 43 15 39 af 19 15 0d b5 c6 09 d7 79 1b cd a6 35 20 26 80 bd 2c c434 a6 35 10 ec d2 f3 b5 ec 6b ec 07 send to server;

[0133] After receiving the third data sent by the TLS send interface, the server generates the second signature information 98 2a 5e aa 59 5b 81 a1 f1 1f ae 97 b34d 73 46 e3 13 fd f2 08 c5 92 2d a1 ed de d4 29 e7 29 81 48 d8 23 17 dc 54 e2f8 6f bf 39 12 94 98 dd e6 17 0b 29 3b e5 db fd ed 1a 19 05 67 45 b5 6b c8 29fe f2 1b b2 11 c6 eb f4 43 c6 eb e4 43 9a e4 4f 8c 82 bb 32 32 94 57 07 d1 7c90 8c ba 41 86 68 9b 52 c6 e8 20 4f 3a 45 9b 65 14 e8 05 db 8c 3d 6e 19 4f d189 87 bf 38 12 99 05 ab 8c dc 0d 3d fc 89 8a 9c 54 56 cb a2 c4 9b 6e a1 35 94a5 d8 53 ad 11 ec 58 b6 a5 15 8d 37 35 a5 1d 55 8f 01 da 4c f7 63 51 c2 b1 861f c3 10 3f ab 9b bd 6d d0 e2 33 0b 77 8e 3f fc 86 51 f5 6d b4 b3 2e 6c b5 715c 93 9d 8b 63 23 b9 fa 6b 69 06 c4 67 7e 12 ce 5a 9d fb 8c 9b 1a 50 34 11 8d12 e0 56 45 a3 f8 4e b7 d2 b9 31 ac ce 18 d6 a4 bb 88 67 ad 35 06 37 94 70 e7af 23 fd b9 b0 68 4e d1 c0 71 79 20 43 82 c0 7c e2 be 8e 34 ca ac 68 8e e3 ceb5 56 e4 30 4e 32 4b c9 6d 84 39 ff 70 e3 19 11 d0 ca e5 5a 5b d5 ba 38 36 c1b7 aa ec 13 eb 68 15 be 91 99 19 6e 3a 5e 06 b7 92 8e 568c 27 db 29 bf b4 0645 54 2c 4f f9 a9 d9 f1 59 8a 69 88 cf 10 0a 3f 28 84 7d 91 63 ae 46 96 1a f1de ce 85 05 67 1d 6b d0 8c 52 1b c6 45 c8 9a 54 93 c8 1b 72 c5 ee 86 67 8c e71f 0c bf 38 c2 e9 d7 ae a6 74 59 ee f0 d7 8c e4 45 06 returned to the system;

[0134] When the function library tls_recv interface (the second interface) is loaded and called by the system, the second interface calls the communication interface to communicate with the server, and receives the second signature information returned by the server: 98 2a 5e aa 59 5b 81 a1 f11f ae 97 b3 4d 73 46 e3 13 fd f2 08 c5 92 2d a1 ed de d4 29 e7 29 81 48 d8 2317 dc 54 e2 f8 6f bf 39 12 94 98 dd e6 17 0b 29 3b e5 db fd ed 1a 19 05 67 45b5 6b c8 29 fe f2 1b b2 11 c6 eb f4 43 c6 eb e4 43 9a e4 4f 8c 82 bb 32 32 9457 07 d1 7c 90 8c ba 41 86 68 9b 52 c6 e8 20 4f 3a 45 9b 65 14 e8 05 db 8c 3d6e 19 4f d1 89 87 bf 38 12 99 05 ab 8c dc 0d 3d fc 89 8a 9c 54 56 cb a2 c4 9b6e a1 35 94 a5 d8 53 ad 11 ec 58 b6 a5 15 8d 37 35 a5 1d 55 8f 01 da 4c f7 6351 c2 b1 86 1f c3 10 3f ab 9b bd 6d d0 e2 33 0b 77 8e 3f fc 86 51 f5 6d b4 b32e 6c b5 71 5c 93 9d 8b 63 23 b9 fa 6b 69 06 c4 67 7e 12 ce 5a 9d fb 8c 9b 1a50 34 11 8d 12 e0 56 45 a3 f8 4e b7 d2 b9 31 ac ce 18 d6 a4 bb 88 67 ad 35 0637 94 70 e7 af 23 fd b9 b0 68 4e d1 c0 71 79 20 43 82 c0 7c e2 be 8e 34ca ac68 8e e3 ce b5 56 e4 30 4e 32 4b c9 6d 84 39 ff 70 e3 19 11 d0 ca e5 5a 5b d5ba 38 36 c1 b7 aa ec 13 eb 68 15 be 91 99 19 6e 3a 5e 06 b7 928e 56 8c 27 db29 bf b4 06 45 54 2c 4f f9 a9 d9 f1 59 8a 69 88 cf 10 0a 3f 28 84 7d 91 63 ae46 96 1a f1 de ce 85 05 67 1d 6b d0 8c 52 1b c6 45 c8 9a 54 93 c8 1b 72 c5 ee86 67 8c e7 1f0c bf 38 c2 e9 d7 ae a6 74 59 ee f0 d7 8c e4 45 06.

[0135] After the system receives the second signature information returned by the server, when the mbedtls_rsa_init function (the first function) of the function library is loaded and called by the system, the mbedtls_rsa_init function communicates with the SE and sends an initialization instruction to the SE. After the SE replies with the completion information, the mbedtls_rsa_init function continues to send the initialization RSA algorithm instruction to the SE: aa e9 fb 6b 2f ca 43 a974 05 3b 48 c9 20 bd f2 51 75 65 63 49 4e 46 4f 20 20 20 20 20 20 20 20 02 2020 20 20 20 20 20 20 20 20 ec cc, instructs SE to initialize RSA algorithm processing; SE performs corresponding RSA algorithm initialization processing according to the received instruction, so that SE enters the RSA encryption algorithm state, and when the mbedtls_rsa_import function (the second function) of the function library is loaded and called by the system, the mbedtls_rsa_import function communicates with SE and informs SE of the storage number ec cc 10 20 20 20 20 20 01 20 20 20 02 of the server certificate, and before SE can extract the corresponding server certificate according to the received storage number, when the mbedtls_rsa_private function (the tenth function) is loaded and called by the system, the mbedtls_rsa_private function communicates with the SE and informs SE of the storage number f8 f0 f4 4d 82 06 fe 8e 25 62 51 a2 8c 0d 83 da 81 e3 2f 1e56 d7 a4 of the device-side RSA private key b0 0f 8d 06 09 64 ed 3d 9c 9c 35 31 8b 6e 81 33 b4 e1 f6 89 c3 3b 8dbf bb is given to SE, so that SE can obtain the device-side RSA private key according to the obtained storage number.

[0136] After the mbedtls_rsa_private function gives the storage number of the device-side RSA private key to the SE, when the mbedtls_rsa_check_privkey function (the eleventh function) is loaded and called by the system, the mbedtls_rsa_check_privkey function communicates with the SE and sends the instruction 41 f9 dd 76 57 20 8e 2a 36 9c 9d 0d92 eb 40 3b 91 1a d3 e6 47 87 02 87 b4 b8 to the SE, instructing the SE to verify the integrity of the device-side RSA private key.

[0137] Based on the instruction of the mbedtls_rsa_check_privkey function, the SE obtains the corresponding device-side RSA private key through the storage number of the device-side RSA private key communicated by the mbedtls_rsa_private function, and verifies the integrity of the device-side RSA private key.

[0138] After SE passes the integrity check of the device-side RSA private key, when the mbedtls_rsa_public function (the twelfth function) is loaded and called by the system, the mbedtls_rsa_public function communicates with the SE and sends the second signature information received by the tls_recv interface to the SE so that the SE can verify and decrypt the second signature information.

[0139] When the mbedtls_rsa_check_pub_priv function (the thirteenth function) is loaded and called by the system, the mbedtls_rsa_check_pub_priv function communicates with the SE and sends instructions to the SE: 01 3b f9 d2 0b 7803 70 4b 78 43 70 8b 78 83 70 60 46 70 47 80 ea 01 0c 1c f0 98 2a 5e aa 59 5b81 a1 f1 1f ae 97 b3 4d 73 46 e3 13 fd f2 08 c5 92 2d a1 ed de d4 29 e7 29 8148 d8 23 17 dc 54 e2 f8 6f bf 39 12 94 98 dd e6 17 0b 29 3b e5 db fd ed 1a 1905 67 45 b5 6b c8 29 fe f2 1b b2 11 c6 eb f4 43 c6 eb e4 43 9a e4 4f 8c 82 bb32 32 94 57 07 d1 7c 90 8c ba 41 86 68 9b 52 c6 e8 20 4f 3a 45 9b 65 14 e8 05db 8c 3d 6e 19 4f d1 89 87 bf 38 12 99 05 ab 8c dc 0d 3d fc 89 8a 9c 54 56 cba2 c4 9b 6e a1 35 94 a5 d8 53 ad 11 ec 58 b6 a5 15 8d 37 35 a5 1d 55 8f 01 da4c f7 63 51 c2 b1 86 1f c3 10 3f ab 9b bd 6d d0 e2 33 0b 77 8e 3f fc 86 51 f56d b4 b3 2e 6c b5 71 5c 93 9d 8b 63 23 b9 fa 6b 69 06 c4 67 7e 12 ce 5a 9d fb8c 9b 1a 50 34 11 8d 12 e0 56 45 a3 f84e b7 d2 b9 31acce18 d6 a4 bb 88 67ad 35 06 37 94 70 e7 af 23 fd b9 b0 68 4e d1 c0 71 79 20 43 82 c0 7c e2 be 8e34 ca ac 68 8e e3 ce b5 56 e4 30 4e 32 4b c9 6d84 39 ff 70 e3 19 11 d0 ca e55a 5b d5 ba 38 36 c1 b7 aa ec 13 eb 68 15 be 91 99 19 6e 3a 5e 06 b7 92 8e 568c 27 db 29 bf b4 06 45 54 2c 4ff9a9d9f1598a 6988cf 100a 3f 28 84 7d 91 63 ae46 96 1a f1 de ce 85 05 67 1d 6b d08c 521b c645c89a 5493c8 1b 72 c5 ee 86 678c e7 1f 0c bf 38 c2 e9 d7 ae a6 74 59 ee f0 d7 8c e4 45 0603 6f 08 bf, instructs SE to verify and decrypt the second signature information communicated by the mbedtls_rsa_public function according to the device-side RSA private key, and informs the system of the successful verification and decryption result.

[0140] Reference below Figure 2 , which shows a schematic diagram of the structure of an electronic device 400 suitable for implementing the embodiment of the present application. The electronic device may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 2 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0141] like Figure 2 As shown, the electronic device 400 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 are also stored. The processing device 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0142] Typically, the following devices may be connected to the I / O interface 405: an input device 406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 408 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 409. The communication device 409 may allow the electronic device 400 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 2 The electronic device 400 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0143] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 409, or installed from the storage device 408, or installed from the ROM 402. When the computer program is executed by the processing device 401, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0144] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0145] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0146] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains at least two Internet Protocol addresses; sends a node evaluation request including the at least two Internet Protocol addresses to a node evaluation device, wherein the node evaluation device selects an Internet Protocol address from the at least two Internet Protocol addresses and returns it; receives the Internet Protocol address returned by the node evaluation device; wherein the obtained Internet Protocol address indicates an edge node in a content distribution network.

[0147] Alternatively, the computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: receives a node evaluation request including at least two Internet Protocol addresses; selects an Internet Protocol address from the at least two Internet Protocol addresses; and returns the selected Internet Protocol address; wherein the received Internet Protocol address indicates an edge node in a content distribution network.

[0148] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0149] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0150] The units involved in the embodiments described in the present application may be implemented by software or hardware. The name of the unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0151] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

[0152] The terminal device provided in this application is applicable to any embodiment of the above-mentioned SE-based TLS two-way authentication method, which will not be repeated here.

[0153] The present application provides a computer-readable storage medium, which stores a computer program, and the computer program enables a computer to execute the SE-based TLS two-way authentication method shown in the above embodiment.

[0154] The computer-readable storage medium provided in the present application is applicable to any embodiment of the above-mentioned Bluetooth device connection method and will not be described in detail here.

[0155] Those skilled in the art will appreciate that each block in these structure diagrams and / or block diagrams and / or flow charts and combinations of blocks in these structure diagrams and / or block diagrams and / or flow charts can be implemented using computer program instructions. Those skilled in the art will appreciate that these computer program instructions can be provided to a general-purpose computer, a professional computer, or a processor of other programmable data processing methods to implement, thereby executing the scheme specified in the block or multiple blocks of the structure diagrams and / or block diagrams and / or flow charts disclosed in this application through the processor of the computer or other programmable data processing method.

[0156] The modules of the device of the present application may be integrated into one or deployed separately. The modules may be combined into one module or further divided into multiple sub-modules.

[0157] Those skilled in the art will appreciate that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes in the accompanying drawings are not necessarily required for implementing the present application.

[0158] Those skilled in the art can understand that the modules in the device in the embodiment can be distributed in the device in the embodiment according to the description of the embodiment, or can be changed accordingly and located in one or more devices different from the present embodiment. The modules in the above embodiment can be combined into one module, or can be further divided into multiple sub-modules.

[0159] The above serial numbers of this application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0160] The above disclosures are only a few specific embodiments of the present application, but the present application is not limited thereto, and any changes that can be conceived by those skilled in the art should fall within the protection scope of the present application.

Claims

1. A TLS two-way authentication method based on SE, characterized in that: Applicable to a terminal device including a system and a security chip SE, wherein the system is configured with an mbedtls function library, including: The system loads and calls the function library, and the functions in the function library communicate with the SE and send corresponding instructions to the SE; When the fifth function of the function library is loaded and called by the system, the fifth function communicates with the SE and sends the TLS handshake data to the SE for signature processing; When the sixth function of the function library is loaded and called by the system, the sixth function communicates with the SE, instructs the SE to perform encryption and signature processing on the TLS handshake data according to the extracted server public key to obtain encrypted TLS handshake data, and the SE saves the encrypted TLS handshake data as the first data; When the first interface of the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server and sends the first data to the server; When the second interface of the function library is loaded and called by the system, the second interface calls the communication interface to communicate with the server, and receives a second notification message returned by the server indicating that the signature verification of the first data is successful; When the twelfth function of the function library is loaded and called by the system, the twelfth function communicates with the SE and sends the signature information and the ciphertext containing the communication symmetric key carried in the second notification message to the SE; When the thirteenth function of the function library is loaded and called by the system, the thirteenth function communicates with the SE, instructing the SE to verify the signature information according to the acquired device-side private key, and decrypt the ciphertext containing the communication symmetric key to obtain the decryption information; When the fourteenth function of the function library is loaded and called by the system, the fourteenth function communicates with the SE to obtain the communication symmetric key from the decryption information; When the user-defined key sending function is loaded and called by the system, the acquired communication symmetric key is sent to the SE, so that the system completes the communication handshake processing according to the communication symmetric key.

2. The method according to claim 1, characterized in that Before instructing the SE to perform encryption and signature processing on the TLS handshake data according to the extracted server public key to obtain the encrypted TLS handshake data, the method further includes: When the second function of the function library is loaded and called by the system, the second function communicates with the SE and sends the storage number of the server certificate to the SE; When the third function of the function library is loaded and called by the system, the third function communicates with the SE to instruct the SE to extract the server public key from the stored server certificate according to the storage number; When the fourth function of the function library is loaded and called by the system, the fourth function communicates with the SE and receives a first notification message sent by the SE indicating that the server public key has been extracted.

3. The method according to claim 1, characterized in that The sending the first data to the server comprises: When the seventh function of the function library is loaded and called by the system, the seventh function communicates with the SE to receive the first data output by the SE; When the eighth function of the function library is loaded and called by the system, the eighth function sets a padding character for the first data to obtain the padded data, and stores the padded data as the second data; When the ninth function of the function library is loaded and called by the system, the ninth function obtains the data length of the second data; When the first interface of the function library is loaded and called by the system, the first interface calls the communication interface to communicate with the server, and sends the second data to the server according to the data length of the second data.

4. The method according to claim 1, characterized in that Before instructing the SE to verify and decrypt the signature information according to the acquired device-side private key, the method further includes: When the tenth function of the function library is loaded and called by the system, the tenth function communicates with the SE and sends the storage number of the device-side RSA private key to the SE, so that the SE obtains the device-side RSA private key according to the storage number of the device-side RSA private key and stores it; When the eleventh function of the function library is loaded and called by the system, the eleventh function communicates with the SE to instruct the SE to verify the integrity of the stored device-side private key.

5. The method according to claim 4, characterized in that The instructing the SE to verify and decrypt the signature information according to the acquired device-side RSA private key includes: The SE uses the server public key to verify the signature information and uses the device private key to decrypt the signature information.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: When the first function of the function library is loaded and called by the system, the first function communicates with the SE to instruct the SE to perform initialization processing so that the SE enters the RSA encryption algorithm state.

7. The method according to any one of claims 1 to 5, characterized in that The method further comprises: When the fifteenth function of the function library is loaded and called by the system, the fifteenth function communicates with the SE to instruct the SE to exit the RSA encryption algorithm state so that the SE releases resource data related to the communication handshake processing.

8. A terminal device, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the SE-based TLS bidirectional authentication method described in any one of claims 1 to 7 by calling the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, which, when executed on a computer, enables the computer to execute the SE-based TLS two-way authentication method described in any one of claims 1 to 7.

Images