Data security reinforcement method and device for 5g mobile terminal based on trusted computing

Abstract

The application relates to a 5G mobile terminal security reinforcement method and device based on trusted computing, a computer device, a storage medium and a computer program product. The method responds to a login request, and terminal and server perform bidirectional verification based on a server public key and a server private key to obtain a symmetric key required for this communication, so that the symmetric key required for each communication is different, that is, one-time pad, and forward security and backward security of the communication are ensured. In the process of bidirectional verification of the terminal and the server based on the server public key and the private key, verification of multiple information dimensions such as the verification code, the terminal identifier and the user information is performed, so that only the terminal sending the communication request can decrypt the communication key, two-way authentication of the terminal and the server is ensured, and communication between the terminal and the server is safer and more reliable.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and in particular to a data security reinforcement method and device for a 5G mobile terminal based on trusted computing, a computer device, a storage medium and a computer program product. BACKGROUND

[0002] At present, mobile intelligent terminals are mostly constructed based on SOC (System On Chip) chips. In order to reinforce the security of the mobile intelligent terminals by using trusted computing technology, a mobile trusted module (MTM) needs to be added to the mobile intelligent terminals to provide trusted services as a trusted root. In order to build a complete and reliable trust chain, it is necessary to ensure that each step from the MTM, the Bootloader, the system kernel to the third-party application is verified for integrity during the system startup process.

[0003] However, the MTM is a function rather than a hardware implementation, and researches have shown that the MTM increases the power consumption of the system and reduces the performance of the encryption function. Therefore, it is not an ideal choice to use the MTM as the trusted root of the embedded system. SUMMARY

[0004] Therefore, it is necessary to provide a data security reinforcement method and device for a 5G mobile terminal based on trusted computing, a computer device and a computer readable storage medium in view of the above technical problems.

[0005] In a first aspect, the present application provides a data security reinforcement method for a 5G mobile terminal based on trusted computing. The method comprises:

[0006] In response to a login request, user information is encrypted based on a server public key to obtain first request information, and the first request information is sent to a server. The server generates a verification code in response to the first request information, decrypts the first request information based on a server private key corresponding to the server public key to obtain user information, processes the user information and the verification code based on the server private key to obtain first signature information, and feeds back the first signature information to a terminal.

[0007] The first signature information fed back by the server is received.

[0008] The first signature information is verified using the server public key to obtain the verification code.

[0009] The username, the verification code and the terminal identifier are encrypted using the server public key to obtain second request information.

[0010] The second request information is sent to the service end, the service end responds to the second request information, the second request information is decrypted using the service end private key, a username, a verification code and a terminal identifier are obtained, if the received username and verification code are consistent with the stored ones, a symmetric key and a session code are generated, the symmetric key and the session code are encrypted using the terminal identifier to obtain second user verification information, the second user verification information is signed using the service end private key to obtain second signature information, and the second signature information is fed back to the terminal;

[0011] The second signature information returned by the service end is received, the second signature information is verified using the service end public key, second user verification information is extracted, and the second user verification information is decrypted using the terminal identifier to obtain a symmetric key.

[0012] Sensitive information is encrypted based on the symmetric key, and communication is performed with the service end.

[0013] In a second aspect, the application also provides a data security reinforcement device of a 5G mobile terminal based on trusted computing. The device comprises:

[0014] A sending module is configured to encrypt user information based on a service end public key to obtain first request information in response to a login request, and send the first request information to the service end, wherein the service end generates a verification code in response to the first request information, decrypts the first request information based on a service end private key corresponding to the service end public key to obtain user information, processes the user information and the verification code based on the service end private key to obtain first signature information, and feeds back the first signature information to the terminal.

[0015] A receiving module is configured to receive the first signature information fed back by the service end.

[0016] A verification code obtaining module is configured to verify the first signature information using the service end public key to obtain the verification code.

[0017] An encryption module is configured to encrypt a username, a verification code and a terminal identifier using a service end public key to obtain second request information.

[0018] The sending module is further configured to send the second request information to the service end, the service end responds to the second request information, the second request information is decrypted using the service end private key, a username, a verification code and a terminal identifier are obtained, if the received username and verification code are consistent with the stored ones, a symmetric key and a session code are generated, the symmetric key and the session code are encrypted using the terminal identifier to obtain second user verification information, the second user verification information is signed using the service end private key to obtain second signature information, and the second signature information is fed back to the terminal.

[0019] The key processing module is configured to receive the second signature information returned by the server, verify the second signature information using the server public key, extract second user verification information, and decrypt the second user verification information using the terminal identifier to obtain a symmetric key.

[0020] The communication module is configured to encrypt sensitive information based on the symmetric key and communicate with the server.

[0021] In a third aspect, the present application further provides a computer device. The computer device comprises a memory and a processor. The memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0022] In response to a login request, encrypt user information based on a server public key to obtain first request information, and send the first request information to the server. The server generates a verification code in response to the first request information, decrypts the first request information based on a server private key corresponding to the server public key to obtain user information, processes the user information and the verification code based on the server private key to obtain first signature information, and feeds back the first signature information to the terminal.

[0023] Receive the first signature information fed back by the server.

[0024] Verify the first signature information using the server public key to obtain the verification code.

[0025] Encrypt the username, the verification code, and the terminal identifier using the server public key to obtain second request information.

[0026] Send the second request information to the server. The server decrypts the second request information using the server private key to obtain the username, the verification code, and the terminal identifier, generates a symmetric key and a session code if the received username and the verification code are consistent with the stored ones, encrypts the symmetric key and the session code using the terminal identifier to obtain second user verification information, signs the second user verification information using the server private key to obtain second signature information, and feeds back the second signature information to the terminal.

[0027] Receive the second signature information returned by the server, verify the second signature information using the server public key, extract second user verification information, and decrypt the second user verification information using the terminal identifier to obtain a symmetric key.

[0028] Encrypt sensitive information based on the symmetric key, and communicate with the server. In a fourth aspect, the present application also provides a computer readable storage medium. The computer readable storage medium has a computer program stored thereon, and the computer program is executed by a processor to implement the following steps:

[0029] In response to the login request, encrypt the user information based on the server public key to obtain first request information, and send the first request information to the server. The server generates a verification code in response to the first request information, decrypts the first request information based on the server private key corresponding to the server public key to obtain user information, processes the user information and the verification code based on the server private key to obtain first signature information, and feeds back the first signature information to the terminal.

[0030] Receive the first signature information fed back by the server.

[0031] Verify the first signature information using the server public key to obtain the verification code.

[0032] Encrypt the username, the verification code, and the terminal identifier using the server public key to obtain second request information.

[0033] Send the second request information to the server. The server decrypts the second request information using the server private key to obtain the username, the verification code, and the terminal identifier in response to the second request information. If the received username and the verification code are consistent with the stored ones, a symmetric key and a session code are generated, the symmetric key and the session code are encrypted using the terminal identifier to obtain second user verification information, the second user verification information is signed using the server private key to obtain second signature information, and the second signature information is fed back to the terminal.

[0034] Receive the second signature information returned by the server, verify the second signature information using the server public key, extract the second user verification information, and decrypt the second user verification information using the terminal identifier to obtain the symmetric key.

[0035] Encrypt sensitive information based on the symmetric key, and communicate with the server. In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program, and the computer program is executed by a processor to implement the following steps:

[0036] In response to the login request, the user information is encrypted based on the server public key to obtain first request information, and the first request information is sent to the server, the server generates a verification code in response to the first request information, decrypts the first request information based on the server private key corresponding to the server public key to obtain user information, processes the user information and the verification code based on the server private key to obtain first signature information, and feeds back the first signature information to the terminal;

[0037] The first signature information fed back by the server is received;

[0038] The first signature information is verified using the server public key to obtain the verification code;

[0039] The username, the verification code and the terminal identifier are encrypted using the server public key to obtain second request information;

[0040] The second request information is sent to the server, the server decrypts the second request information using the server private key to obtain the username, the verification code and the terminal identifier in response to the second request information, generates a symmetric key and a session code if the received username and the verification code are consistent with the stored ones, encrypts the symmetric key and the session code using the terminal identifier to obtain second user verification information, signs the second user verification information using the server private key to obtain second signature information, and feeds back the second signature information to the terminal;

[0041] The second signature information returned by the server is received, the second signature information is verified using the server public key, the second user verification information is extracted, and the symmetric key is obtained by decrypting the second user verification information using the terminal identifier;

[0042] The sensitive information is encrypted based on the symmetric key, and the server is communicated.

[0043] The above-mentioned data security reinforcement method, device, computer equipment and storage medium based on trusted computing of the 5G mobile terminal, in response to the login request, the terminal and the server perform bidirectional verification based on the server public key and the private key, obtain the symmetric key required for this communication, ensure that the symmetric key required for each communication is different, that is, one-time one-key, and ensure the forward security and backward security of the communication. In the process of bidirectional verification of the terminal and the server based on the server public key and the private key, the verification of multiple information dimensions such as the verification code, the terminal identifier and the user information makes only the terminal that sends the communication request can decrypt the communication key, ensures the bidirectional authentication of the terminal and the server, and makes the communication between the terminal and the server more secure and reliable. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1An application environment diagram of a 5G mobile terminal security reinforcement method based on trusted computing in an embodiment;

[0045] Figure 2 A flowchart of a 5G mobile terminal security reinforcement method based on trusted computing in an embodiment;

[0046] Figure 3 A flowchart of a 5G mobile terminal security reinforcement method based on trusted computing in an embodiment;

[0047] Figure 4 A diagram of terminal obtaining a verification code in an embodiment;

[0048] Figure 5 A diagram of authentication and key exchange in an embodiment;

[0049] Figure 6 A diagram of sensitive data key generation in an embodiment;

[0050] Figure 7 A flowchart of a 5G mobile terminal security reinforcement method based on trusted computing in another embodiment;

[0051] Figure 8 A flowchart of a 5G mobile terminal security reinforcement method based on trusted computing in an embodiment;

[0052] Figure 9 A diagram of a trusted mobile terminal system in an embodiment;

[0053] Figure 10 A diagram of a trusted software base integrity measurement mechanism in an embodiment;

[0054] Figure 11 A flowchart of a 5G mobile terminal security reinforcement method based on trusted computing in another embodiment;

[0055] Figure 12 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0056] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not used to limit the present application.

[0057] The 5G mobile terminal security reinforcement method based on trusted computing provided by the embodiments of the present application can be applied to, for example, Figure 1The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. The terminal 102 responds to the login request, encrypts the user information based on the server public key, obtains the first request information, and sends the first request information to the server. The server 104 generates a verification code in response to the first request information, decrypts the first request information based on the server private key corresponding to the server public key, obtains the user information, processes the user information and the verification code based on the server private key, obtains the first signature information, and feeds back the first signature information to the terminal 102. Receive the first signature information fed back by the server; use the server public key to verify the first signature information, obtain the verification code; use the server public key to encrypt the username, the verification code and the terminal identifier, obtain the second request information; send the second request information to the server, and the server responds to the second request information. Use the server private key to decrypt the second request information, obtain the username, the verification code and the terminal identifier, if the received username and the verification code are consistent with the stored ones, generate a symmetric key and a session code, encrypt the symmetric key and the session code using the terminal identifier, obtain the second user verification information, sign the second user verification information using the server private key, obtain the second signature information, and feed back the second signature information to the terminal; receive the second signature information returned by the server, use the server public key to verify the second signature information, extract the second user verification information, use the terminal identifier to decrypt the second user verification information, obtain the symmetric key; encrypt the sensitive information based on the symmetric key, and communicate with the server. Among them, the terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0058] Specifically, as shown in Figure 2 and Figure 3 , a flowchart of a 5G mobile terminal security reinforcement method based on trusted computing is provided. The method is applied to Figure 1 the application environment shown, comprising the following steps:

[0059] S202, in response to a login request, encrypt the user information based on the server public key, obtain the first request information, and send the first request information to the server. The server generates a verification code in response to the first request information, decrypts the first request information based on the server private key corresponding to the server public key, obtains the user information, processes the user information and the verification code based on the server private key, obtains the first signature information, and feeds back the first signature information to the terminal.

[0060] The service end stores a key pair, the key pair including a service end public key and a service end private key . The service end public key is a public part in the key pair, and the terminal stores the service end public key, which is stored in the secure area of the terminal device after being encrypted by the sensitive data key using a symmetric encryption algorithm. The service end private key is a non-public part, i.e., only the service end has the private key. The service end public key and the service end private key can be used to realize sensitive information communication between the terminal and the service end, and the sensitive information can include the key pair and sensitive information of the terminal itself, such as user data.

[0061] Specifically, as shown in Figure 4 , the user triggers an initial login request based on the terminal, performs initial login according to the distributed initial verification code, after successful login, obtains the service end public key stored by the terminal, encrypts user information (for example, a username) using the service end public key to obtain first request information , sends the first request information to the service end, and the service end generates a verification code of the terminal in response to the first request information . The first request information is decrypted using the service end private key corresponding to the service end public key , to obtain the user information . The verification code of the terminal is encrypted based on the username, and then signed using the service end private key to obtain first signature information , and the first signature information is sent to the terminal.

[0062] S204, receiving the first signature information fed back by the service end, verifying the first signature information using the service end public key, and obtaining the verification code.

[0063] The service end public key and the service end private key can be used for encryption and decryption operations, data encrypted using the service end public key can only be decrypted by the service end private key, and data signed using the service end private key can only be verified by the service end public key.

[0064] Specifically, after the terminal receives the first signature information fed back by the service end, the terminal verifies the first signature information using the service end public key, and obtains the username-encrypted verification code after verification. The username-encrypted verification code is decrypted to obtain the verification code.

[0065] In this embodiment, through the above steps, the service end can generate a verification code and return the verification code to the terminal in an encrypted manner, and the terminal can decrypt the encrypted verification code using the service end public key, so that the terminal safely obtains the verification code.

[0066] S206, encrypting the username, the verification code, and the terminal identifier using the service end public key to obtain second request information.

[0067] Specifically, the terminal identifier can be a universally unique identifier of the terminal device , using the server public key Username , verification code , and the terminal device's universal unique identifier .

[0068] S208, send a second request message to the server, the server responds to the second request message, uses the server private key to decrypt the second request message, obtains the user name, verification code and terminal identification, if the received user name and verification code are consistent with the stored ones, generates a symmetric key and session code, uses the terminal identification to encrypt the symmetric key and session code to obtain second user verification information, uses the server private key to sign the second user verification information, obtains second signature information, and feeds the second signature information back to the terminal.

[0069] Specifically, if Figure 5 As shown, the server receives the second request information Then, use the server private key corresponding to the server public key to decrypt the second request information and get the username , verification code and terminal identification, where the terminal identification can be a universal unique identification code of the terminal device . Server-side verification username and verification code Is it consistent with the stored information? If the information is consistent, the verification is successful. After the verification is successful, the server generates a symmetric key and session encoding , using the terminal's universal unique identifier Perform encryption operation to obtain the second user verification information , then use the server's private key to sign the second user verification information to obtain the second signature information , the second signature information Feedback to the terminal.

[0070] In this embodiment, the server verifies the second request information sent by the terminal, thereby authenticating the terminal. The server encrypts the symmetric key with a universally unique identifier (UUID) and then signs it with its own private key. This is because all terminals possess the server's public key, allowing other terminals to verify the signature and obtain the symmetric key. Such communication is insecure because simply downloading a single application allows the communication keys between other applications and the server to be intercepted. Therefore, the key must be encrypted with a UUID so that only the terminal issuing the communication request can decrypt the UUID and obtain the communication key. This means that the terminal must authenticate the server, and only after successful authentication can the communication key be decrypted. This ensures bidirectional authentication between the terminal and the server, guaranteeing the security of the communication key.

[0071] S210, receiving the second signature information returned by the server, verifying the second signature information using the server public key, extracting the second user verification information, decrypting the second user verification information using the terminal identifier, and obtaining a symmetric key.

[0072] Specifically, the terminal receives the second signature information , and use the server public key corresponding to the server private key to sign the second information Verify and obtain the second user verification information , using the terminal's universal unique identifier Verify information for the second user Decrypt and obtain the symmetric key and session encoding In this way, the terminal obtains the symmetric key generated by the server for subsequent communication between the terminal and the server. The acquisition of the symmetric key has undergone double verification, that is, the second signature information is first verified with the server public key corresponding to the server private key, and then the second user verification information is decrypted with the terminal's universal unique identification code, making the symmetric key reliable.

[0073] S212, encrypt the sensitive information based on the symmetric key and communicate with the server.

[0074] Specifically, when the terminal and the server communicate, a symmetric key is used Encrypt the transmitted sensitive information to obtain encrypted sensitive information , and encrypt sensitive information Send to the receiving end, the receiving end receives Then, use the symmetric key Decrypt and obtain the transmitted sensitive information. .

[0075] In the above-mentioned data security reinforcement method for 5G mobile terminals based on trusted computing, in response to a login request, the terminal and the server perform two-way verification based on the server's public key and private key to obtain the symmetric key required for this communication, ensuring that the symmetric key required for each communication is different, that is, one-time one-key, ensuring forward and backward security of the communication. During the two-way verification process between the terminal and the server based on the server's public key and private key, verification is performed on multiple information dimensions such as the verification code, the terminal's universal unique identification code, and user information, so that only the terminal that issued the communication request can decrypt and obtain the communication key, ensuring two-way authentication between the terminal and the server, making the communication between the terminal and the server more secure and reliable.

[0076] In another embodiment, in response to the login request, the user information is encrypted based on the service end public key to obtain first request information, and the first request information is sent to the service end, including: the username and the first timestamp are encrypted using the service end public key to generate the first request information; the first request information is sent to the service end, the service end generates a verification code and a second timestamp in response to the first request information, decrypts the first request information using the service end private key corresponding to the service end public key to obtain the first timestamp and the username, saves the username and the verification code, encrypts the verification code and the second timestamp using the username to obtain encrypted user verification information, signs the encrypted user verification information using the service end private key to obtain first signature information. The terminal receives the first signature information and verifies the timestamp thereof.

[0077] Specifically, the terminal performs initial login according to the distributed initial verification code, after successful login, accesses sensitive information stored in the secure area of the terminal to obtain the service end public key . The terminal encrypts the username and the first timestamp using the service end public key to generate the first request information .

[0078] The first request information is sent to the service end, the service end generates a verification code and a second timestamp in response to the first request information . The service end decrypts the first request information using the service end private key to obtain the username and the first timestamp . The username and the verification code are saved, and the verification code and the second timestamp are encrypted using the username to generate , and the first signature information is obtained by signing using the service end private key , and the first signature information is sent to the terminal.

[0079] After the terminal receives the first signature information , the first signature information is verified using the service end public key corresponding to the service end private key, and the username-encrypted verification code and the second timestamp are obtained after verification. The username-encrypted verification code and the second timestamp are decrypted to obtain the verification code and the second timestamp. The freshness of the timestamp is verified, and if the difference between the second timestamp and the first timestamp is less than a preset time value, the verification is successful, and the verification code is saved.

[0080] In this embodiment, the user name and first timestamp are encrypted using the server's public key. This encrypted data can only be decrypted using the server's private key. This ensures the security of data encrypted with the server's public key and prevents tampering during transmission. During the authentication process between the terminal and the server, a timestamp is added to the verification information to prevent replay attacks. This timestamp is then verified to ensure the timeliness of the information.

[0081] In one embodiment, a method for obtaining a server public key includes: accessing an encrypted server public key stored in a secure area of ​​a terminal, where the encrypted server public key is pre-generated based on a terminal key; calling a key generation service to generate a symmetric key based on a digital fingerprint of the terminal, and generating a sensitive data key based on the terminal symmetric key and a terminal identifier; decrypting the encrypted server public key based on the sensitive data key to obtain the server public key.

[0082] The digital fingerprint is a physical unclonable function (PUF), a one-way function determined by a specific physical system. It possesses two key properties: randomness and unclonability. This unclonability stems from the random uncertainty introduced during the physical device production process. The PUF uses the CPU's on-chip static random access memory (SRAM) as its physical medium. During the manufacturer's production phase, the terminal randomly selects a unique bit string S. This is stored in a specific area of ​​the SRAM using physical properties. S is retrieved from the SRAM PUF component only during each normal power-up and is securely cached in the key manager within the secure area.

[0083] The process of generating sensitive data keys is as follows: Figure 6 As shown, the system is powered on to start the SRAM and the bit string S is reorganized.

[0084] The bit string S is used as input and the key derivation function KDF (key derivation function) of the key manager of the trusted service is used to generate the key .

[0085] Utilizing the key XOR with the terminal identifier (the terminal identifier can be the universal unique identifier UUID of the terminal device) to generate the sensitive data key ,Right now .

[0086] Sensitive data key Encrypted using the symmetric encryption algorithm AES , stored in the secure area of ​​the terminal device. Therefore, when the terminal initially logs in, it logs in through the verification code distributed by the mobile phone. After the terminal logs in successfully, it accesses the sensitive information stored in the secure area of ​​the terminal. , call the sensitive data key generation process to generate sensitive data keys , to obtain the server public key .

[0087] In this embodiment, the PUF characteristics are used to provide trusted and secure storage for sensitive data, and the sensitive data key is obtained by calling the sensitive data key generation process , and the sensitive information is decrypted according to the sensitive data key , that is, the server public key encrypted by the sensitive data key is decrypted to obtain the server public key.

[0088] In one embodiment, the method for encrypting the server key includes: in response to a start instruction of the terminal, calling a key generation service to generate a terminal key based on a digital fingerprint of the terminal, generating a sensitive data key based on the terminal key and a terminal identifier; encrypting the server public key based on the sensitive data key to generate an encrypted server public key, and storing the encrypted server public key in a secure area of the terminal device.

[0089] Specifically, the encrypted server public key is symmetrically encrypted by the sensitive data key , to obtain , and the encrypted server public key is stored in the secure area of the terminal device.

[0090] In this embodiment, the server public key is encrypted by the sensitive data key, and the encrypted public key is stored in the secure area, ensuring the security of the encrypted server public key in the terminal and avoiding theft of the server public key.

[0091] In one embodiment, the server public key is used to encrypt the username, verification code and terminal identifier to obtain the second request information, including: generating a third timestamp, encrypting the username, verification code, terminal identifier and third timestamp using the server public key to generate the second request information.

[0092] The terminal generates a third timestamp , encrypts the username, verification code, terminal identifier (such as a universally unique identifier) and third timestamp using the server public key to generate the second request information , and sends the second request information as a request to the server side.

[0093] When the server receives the second request information, it responds to the second request information, decrypts the second request information using the server private key to obtain the username, verification code and terminal identifier, and if the received username and verification code are consistent with the stored ones and the third timestamp is valid, a symmetric key and a session code are generated.

[0094] Specifically, the server uses the server private key to decrypt the second request information , to obtain the username, the verification code, the terminal identifier and the third timestamp , the freshness of the third timestamp is verified, if the difference between the third timestamp and the second timestamp is less than the preset time, the verification is successful, and the server generates a symmetric key and a session code.

[0095] In the embodiment, the second request information encrypted by using the server public key is received by the server, and then decrypted by using the server private key, so that the encrypted information can only be obtained by the server holding the private key, that is, the username, the verification code and the terminal identifier are securely sent to the server by using the server public key, so that the server can encrypt the communication data by using the terminal identifier. The server verifies the decrypted username and verification code to realize the verification of the terminal identity by the server. The third timestamp is further verified to ensure the timeliness of the communication data and resist replay attacks.

[0096] In one embodiment, the second signature information returned by the server is received, the second signature information is verified by using the server public key, the second user verification information is extracted, the second user verification information is decrypted by using the terminal identifier, and the symmetric key is obtained. The method comprises the following steps: receiving the signature information of the server, verifying the signature information by using the server public key, extracting the encrypted user verification information, decoding the encrypted user verification information, obtaining the symmetric key and the fourth timestamp; and if the fourth timestamp is valid, storing the symmetric key.

[0097] The second signature information is information signed by using the server private key on the second user verification information, that is . Specifically, the terminal receives the second signature information , verifies the second signature information by using the server private key corresponding to the server public key , obtains the second user verification information , decrypts the second user verification information by using the terminal identifier (the terminal identifier can be the universally unique identifier of the terminal), obtains the symmetric key , and if the fourth timestamp is valid, that is, the difference between the fourth timestamp and the third timestamp is within the preset range, the symmetric key is stored.

[0098] In this embodiment, the second signature information is verified by using the server public key corresponding to the server private key, the identity of the sender of the second signature information is verified, the second user verification information is decrypted by using the universally unique identifier of the terminal, the second user verification information cannot be decrypted by other terminals holding the server public key, it is ensured that the second user verification information can only be decrypted by the terminal sending the communication request, therefore, only the terminal sending the communication request can obtain the symmetric key. The time stamp is verified to ensure the timeliness of the communication, and the replay attack can be resisted.

[0099] In one embodiment, the sensitive information is encrypted based on the symmetric key, and the communication with the server includes: encrypting the sensitive information based on the symmetric key to obtain encrypted sensitive information; and sending the encrypted sensitive information to the server, and the server decrypts the encrypted sensitive information using the symmetric key to obtain the sensitive information.

[0100] Specifically, the sensitive information is encrypted by the symmetric key key to obtain encrypted sensitive information . The server decrypts the encrypted sensitive information using the symmetric key key to obtain the sensitive information .

[0101] In this embodiment, the sensitive information is encrypted by using the symmetric key, so that the sensitive information can be safely transmitted between the terminal and the server, and the sensitive information is effectively prevented from being misused.

[0102] In one embodiment, a data security reinforcement method of a 5G mobile terminal based on trusted computing includes: Figure 7 and Figure 8 .

[0103] S702, a trusted mobile terminal system is constructed.

[0104] The most characteristic of the Trustzone technology is the hardware isolation mechanism, which isolates the CPU core into a safe and normal area. The Trustzone safe area can provide an isolated execution environment for the whitelist system core module, has strong control ability on system memory and peripherals, and can monitor system behavior in real time. It improves the security of the system without affecting the original processor design as much as possible. The Trustzone technology is currently widely used in mobile embedded devices.

[0105] As shown in Figure 9As shown, the Trustzone hardware architecture includes two virtual processor cores: processor core 1 for processing the secure area, and processor core 2 for processing the normal area. The software resources and hardware resources of the secure area are isolated from the software resources and hardware resources of the normal area, and the components of the normal area cannot access the software and hardware resources of the secure area.

[0106] The switching between the secure area and the normal area is completed by a monitor mode, and a monitor of the monitor mode is equivalent to a security gateway of the secure area and the normal area, and ensures that the environment before the processor switching can be safely saved during the switching, and the environment after the switching can correctly restore the system operation. The secure area can directly enter the monitor mode by writing a program status register; and the normal area needs to enter the monitor mode by interrupting, externally interrupting or calling an SMC instruction. The process of the normal area can only obtain the service of the secure area, but cannot access the data of the secure area.

[0107] S704, an integrity measurement mechanism of a trusted software base is established.

[0108] The trust relationship of the trusted computing is extended from a local area to a trust chain transmission technology of the entire 5G mobile terminal system, which is a main technology for reinforcing the trusted security of the 5G mobile terminal, and can greatly improve the trustworthiness of the terminal system. The transmission of the trust chain can be divided into two main stages: the first stage starts from the power-on of the terminal to the completion of the loading of the operating system, and the second stage starts from the operation of the operating system and the operation of the application program. In the present application, in order to build a complete and reliable trust chain, it is necessary to execute the secure area Bootloader first after the power-on reset of the system, the secure area verifies the normal Bootloader, ensures that the code executed by the normal area is authorized and has not been tampered with, then the normal area Bootloader loads the operating system of the secure area, and finally loads the third-party application, to complete the start of the 5G terminal.

[0109] As shown in Figure 10 From the secure area Bootloader, the normal area Bootloader, the system kernel to the third-party application, each step is verified for integrity, one level at a time, one level at a time, to ensure that the hardware and software are in a trusted state, and the overall trust of the 5G mobile terminal is realized.

[0110] S706, in response to the login request, the user information and the first timestamp are encrypted based on the server public key to obtain first request information, and the first request information is sent to the server, the server generates a verification code and a second timestamp in response to the first request information, the first request information is decrypted based on the server private key corresponding to the server public key to obtain the user information and the first timestamp, the user information, the verification code and the second timestamp are processed based on the server private key to obtain first signature information, and the first signature information is fed back to the terminal.

[0111] S708, receiving the first signature information fed back by the server, verifying the first signature information using the public key of the server, obtaining the verification code and the second timestamp, verifying the second timestamp, and saving the verification code if the second timestamp is valid.

[0112] S710, generating a third timestamp, encrypting the username, the verification code, the terminal identifier and the third timestamp using the public key of the server to obtain second request information.

[0113] S712, sending the second request information to the server, the server responding to the second request information, decrypting the second request information using the private key of the server to obtain the username, the verification code, the terminal identifier and the third timestamp, generating a symmetric key, a session code and a fourth timestamp if the received username and the verification code are consistent with the stored ones and the third timestamp is valid, encrypting the symmetric key, the session code and the fourth timestamp using the terminal identifier to obtain second user verification information, signing the second user verification information using the private key of the server to obtain second signature information, and feeding back the second signature information to the terminal.

[0114] S714, receiving the second signature information returned by the server, verifying the second signature information using the public key of the server, extracting the second user verification information, decrypting the second user verification information using the terminal identifier to obtain the symmetric key and the fourth timestamp, and verifying the fourth timestamp, and saving the symmetric key if the fourth timestamp is valid.

[0115] S716, encrypting sensitive information based on the symmetric key and communicating with the server.

[0116] In this embodiment, the TCM trusted cryptographic module of the 5G terminal is realized based on the Trustzone technology, which guarantees the hardware security of the terminal from two aspects of constructing a trusted mobile terminal system and establishing a trusted software base integrity measurement mechanism. Based on the PUF characteristics, trusted and secure storage and communication of sensitive data are provided to guarantee the communication security between the terminal and the server.

[0117] Correspondingly, as shown in Figure 11 , a data security reinforcement method of a 5G mobile terminal based on trusted computing is also provided, which is applied to a server and includes the following steps:

[0118] S1102, receiving the first request information sent by the terminal, the first request information being obtained by encrypting the user information based on the public key of the server by the terminal in response to a login request; generating a verification code in response to the first request information;

[0119] S1104, decrypt the first request information based on the server private key corresponding to the server public key to obtain user information, process the user information and the verification code based on the server private key to obtain first signature information, and feed back the first signature information to the terminal; the terminal verifies the first signature information using the server public key, obtains the verification code, encrypts the username, the verification code and the terminal identifier using the server public key to obtain second request information, and sends the second request information to the server;

[0120] S1106, receiving the second request information sent by the terminal; in response to the second request information, decrypting the second request information using the server private key to obtain the username, the verification code and the terminal identifier;

[0121] S1108, if the received username and verification code are consistent with the stored ones, generating a symmetric key and a session code;

[0122] S1110, encrypting the symmetric key and the session code using the terminal identifier to obtain second user verification information, signing the second user verification information using the server private key to obtain second signature information, feeding back the second signature information to the terminal, verifying the second signature information using the server public key by the terminal, extracting the second user verification information, and decrypting the second user verification information using the terminal identifier to obtain the symmetric key;

[0123] S1112, encrypting the sensitive information based on the symmetric key and communicating with the server.

[0124] It should be understood that, although each step in the flowchart involved in the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in the above embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0125] Based on the same inventive concept, the present application also provides a secure reinforcement device for a 5G mobile terminal based on trusted computing. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in the following embodiment of a secure reinforcement device for a 5G mobile terminal based on trusted computing can be referred to the limitations of the secure reinforcement method for a 5G mobile terminal based on trusted computing in the above text, which will not be repeated here.

[0126] In one embodiment, a security reinforcement apparatus for a 5G mobile terminal based on trusted computing is provided, comprising: a sending module, a receiving module, a verification code obtaining module, an encryption module, a sending module, a key processing module, a communication module, wherein:

[0127] The sending module is configured to encrypt the user information based on the service end public key in response to the login request, obtain first request information, and send the first request information to the service end. The service end generates a verification code in response to the first request information, decrypts the first request information based on a service end private key corresponding to the service end public key to obtain the user information, processes the user information and the verification code based on the service end private key to obtain first signature information, and feeds back the first signature information to the terminal.

[0128] The receiving module is configured to receive the first signature information fed back by the service end.

[0129] The verification code obtaining module is configured to verify the first signature information using the service end public key to obtain the verification code.

[0130] The encryption module is configured to encrypt the username, the verification code, and the terminal identifier using the service end public key to obtain second request information.

[0131] The sending module is further configured to send the second request information to the service end. The service end decrypts the second request information using the service end private key in response to the second request information to obtain the username, the verification code, and the terminal identifier. If the received username and the verification code are consistent with the stored ones, a symmetric key and a session code are generated, the symmetric key and the session code are encrypted using the terminal identifier to obtain second user verification information, the second user verification information is signed using the service end private key to obtain second signature information, and the second signature information is fed back to the terminal.

[0132] The key processing module is configured to receive the second signature information returned by the service end, verify the second signature information using the service end public key, extract the second user verification information, and decrypt the second user verification information using the terminal identifier to obtain the symmetric key.

[0133] The communication module is configured to encrypt sensitive information based on the symmetric key and communicate with the service end.

[0134] In another embodiment, the sending module is configured to encrypt the username and the first timestamp using the service end public key to generate first request information.

[0135] The first request information is sent to the server, the server generates a verification code and a second timestamp in response to the first request information, decrypts the first request information according to a server private key corresponding to the server public key to obtain the first timestamp and the username, stores the username and the verification code, encrypts the verification code and the second timestamp using the username to obtain encrypted user verification information, signs the encrypted user verification information using the server private key to obtain first signature information.

[0136] In another embodiment, the sending module is further configured to access an encrypted server public key stored in a secure area of the terminal, the encrypted server public key being generated in advance according to a terminal key; call a key generation service to generate a key based on a digital fingerprint of the terminal, generate a sensitive data key according to the terminal key and a terminal identifier; and decrypt the encrypted server public key according to the sensitive data key to obtain the server public key.

[0137] In another embodiment, the sending module is further configured to, in response to a start instruction of the terminal, call a key generation service to generate a terminal key based on a digital fingerprint of the terminal, generate a sensitive data key according to the terminal key and a terminal identifier; and encrypt the server public key according to the sensitive data key to generate an encrypted server public key, and store the encrypted server public key in a secure area of the terminal device.

[0138] In another embodiment, the encryption module is configured to, when the server receives the second request information, respond to the second request information, decrypt the second request information using the server private key to obtain the username, the verification code and the terminal identifier, and if the received username and verification code are consistent with the stored username and verification code, and the third timestamp is valid, generate a symmetric key and a session code.

[0139] In another embodiment, the key processing module is configured to receive a second signed message information of the server, verify the second signed message information using the server public key, extract encrypted second user verification information, decode the encrypted second user verification information to obtain a symmetric key and a fourth timestamp; and if the fourth timestamp is valid, store the symmetric key and the verification code.

[0140] In another embodiment, the communication module is configured to encrypt sensitive information based on the symmetric key to obtain encrypted sensitive information, and send the encrypted sensitive information to the server, and the server decrypts the encrypted sensitive information using the symmetric key to obtain the sensitive information.

[0141] Correspondingly, a data security reinforcement method and device of a 5G mobile terminal based on trusted computing are also provided, which are applied to a server and include a receiving module, a sending module, a receiving module, a decryption module, a receiving module, a key processing module, and a communication module.

[0142] The receiving module is configured to receive first request information sent by the terminal, the first request information being obtained by encrypting user information based on a service end public key in response to a login request.

[0143] The sending module is configured to decrypt the first request information based on a service end private key corresponding to the service end public key to obtain the user information, process the user information and the verification code based on the service end private key to obtain first signature information, and feed back the first signature information to the terminal.

[0144] The receiving module is configured to receive second request information sent by the terminal.

[0145] The decryption module is configured to decrypt the second request information based on the service end private key to obtain the username, the verification code, and the terminal identifier in response to the second request information.

[0146] The key processing module is configured to generate a symmetric key and session code if the received username and the verification code are consistent with the stored username and verification code, encrypt the symmetric key and the session code based on the terminal identifier to obtain second user verification information, sign the second user verification information based on the service end private key to obtain second signature information, feed back the second signature information to the terminal, verify the second signature information based on the service end public key by the terminal, extract the second user verification information, and decrypt the second user verification information based on the terminal identifier to obtain the symmetric key.

[0147] The communication module is configured to encrypt sensitive information based on the symmetric key and communicate with the service end.

[0148] The above-mentioned various modules in the security reinforcement device for controlling the 5G mobile terminal based on trusted computing can be realized by software, hardware, and combinations thereof, in whole or in part. The above-mentioned various modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the above-mentioned various modules.

[0149] In one embodiment, a computer device is provided, which can be a controller, and an internal structure diagram of the computer device can be as shown in Figure 12As shown in the figure. The computer device includes a processor, a memory, a communication interface and a display screen connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner. Wireless mode can be achieved through WIFI, mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by the processor to implement a 5G mobile terminal security reinforcement method based on trusted computing. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen.

[0150] Those skilled in the art can understand that, Figure 12 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0151] In one embodiment, a computer device is provided, including a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the steps of the data security reinforcement method of the 5G mobile terminal based on trusted computing in each of the above embodiments.

[0152] In one embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by the processor to implement the steps of the data security reinforcement method of the 5G mobile terminal based on trusted computing in each of the above embodiments.

[0153] In one embodiment, a computer program product is provided, including a computer program, and the computer program is executed by the processor to implement the steps of the data security reinforcement method of the 5G mobile terminal based on trusted computing in each of the above embodiments.

[0154] Those skilled in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above embodiments. Any reference to memory, database or other medium in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, etc., without being limited thereto.

[0155] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0156] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A data security reinforcement method for a 5G mobile terminal based on trusted computing, characterized by, The method comprises: In response to a login request, encrypting user information based on a service end public key to obtain first request information, and sending the first request information to the service end, wherein the service end generates a verification code in response to the first request information, decrypts the first request information based on a service end private key corresponding to the service end public key to obtain user information, processes the user information and the verification code based on the service end private key to obtain first signature information, and feeds back the first signature information to a terminal; Receiving the first signature information fed back by the service end; Verifying the first signature information using the service end public key to obtain the verification code; Encrypting a username, the verification code and a terminal identifier using the service end public key to obtain second request information; Sending the second request information to the service end, wherein the service end decrypts the second request information using the service end private key to obtain the username, the verification code and the terminal identifier, generates a symmetric key and session code if the received username and the verification code are consistent with the stored ones, encrypts the symmetric key and the session code using the terminal identifier to obtain second user verification information, signs the second user verification information using the service end private key to obtain second signature information, and feeds back the second signature information to the terminal; Receiving the second signature information returned by the service end, verifying the second signature information using the service end public key, extracting the second user verification information, and decrypting the second user verification information using the terminal identifier to obtain the symmetric key; Encrypting sensitive information based on the symmetric key and communicating with the service end.

2. The method of claim 1, wherein, The method comprises: Encrypting a username and a first timestamp using the service end public key to generate first request information; Sending the first request information to the service end, wherein the service end generates a verification code and a second timestamp in response to the first request information, decrypts the first request information based on a service end private key corresponding to the service end public key to obtain the first timestamp and the username, stores the username and the verification code, encrypts the verification code and the second timestamp using the username to obtain encrypted user verification information, and signs the encrypted user verification information using the service end private key to obtain first signature information.

3. The method according to claim 1 or 2, characterized in that The method comprises: Accessing an encrypted service end public key stored in a secure area of the terminal, wherein the encrypted service end public key is generated in advance based on a terminal key; Calling a key generation service to generate a terminal key based on a digital fingerprint of the terminal, and generating a sensitive data key based on the terminal key and a terminal identifier; Decrypting the encrypted service end public key based on the sensitive data key to obtain a service end public key.

4. The method of claim 3, wherein, The method further comprises: In response to a start instruction of the terminal, calling a key generation service to generate a terminal key based on a digital fingerprint of the terminal, and generating a sensitive data key based on the terminal key and a terminal identifier; Encrypt the service end public key according to the sensitive data key to generate an encrypted service end public key, and store the encrypted service end public key in a secure area of the terminal.

5. The method of claim 1, wherein, The username, the verification code and the terminal identifier are encrypted using the service end public key to obtain second request information, including: A third timestamp is generated, and the username, the verification code, the terminal identifier and the third timestamp are encrypted using the service end public key to generate second request information; When the service end receives the second request information, the second request information is responded to, the second request information is decrypted using the service end private key to obtain the username, the verification code and the terminal identifier, and if the received username and the verification code are consistent with the stored ones and the third timestamp is valid, a symmetric key and a session code are generated.

6. The method of claim 2, wherein, The second signature information returned by the receiving service end is verified using the service end public key, second user verification information is extracted, the second user verification information is decrypted using the terminal identifier, and a symmetric key is obtained, including: The second signature information returned by the receiving service end is verified using the service end public key, second user verification information is extracted, the second user verification information is decrypted using the terminal identifier, and a symmetric key and a fourth timestamp are obtained; If the fourth timestamp is valid, the symmetric key is stored.

7. The method of claim 1, wherein, The sensitive information is encrypted based on the symmetric key, and the service end is communicated, including: The sensitive information is encrypted based on the symmetric key to obtain encrypted sensitive information; The encrypted sensitive information is sent to the service end, and the service end decrypts the encrypted sensitive information using the symmetric key to obtain the sensitive information.

8. A data security hardening method for a 5G mobile terminal based on trusted computing, characterized by, The method includes: Receiving first request information sent by a terminal, the first request information being obtained by the terminal based on a service end public key encrypting user information in response to a login request; Generating a verification code in response to the first request information; Decrypting the first request information based on a service end private key corresponding to the service end public key to obtain user information, processing the user information and the verification code based on the service end private key to obtain first signature information, and feeding back the first signature information to the terminal; the first signature information is verified by the terminal using the service end public key to obtain the verification code, the username, the verification code and the terminal identifier are encrypted using the service end public key to obtain second request information, and the second request information is sent to the service end; Receiving the second request information sent by the terminal; In response to the second request information, the second request information is decrypted using the service end private key to obtain the username, the verification code and the terminal identifier; If the received username and the verification code are consistent with the stored ones, a symmetric key and a session code are generated; The terminal identifier is used to encrypt the symmetric key and session code, to obtain second user authentication information, the second user authentication information is signed by using the service end private key, to obtain second signature information, the second signature information is fed back to the terminal, the second signature information is verified by using the service end public key by the terminal, second user authentication information is extracted, the second user authentication information is decrypted by using the terminal identifier, to obtain the symmetric key, the sensitive information is encrypted based on the symmetric key, and the service end is communicated. 9.A data security hardening apparatus for a 5G mobile terminal based on trusted computing, the apparatus comprising: The device comprises: The sending module is used for encrypting the user information based on the service end public key in response to the login request, obtaining first request information, and sending the first request information to the service end, the service end generates a verification code in response to the first request information, decrypts the first request information based on the service end private key corresponding to the service end public key to obtain user information, processes the user information and the verification code based on the service end private key to obtain first signature information, and feeds back the first signature information to the terminal; The receiving module is used for receiving the first signature information fed back by the service end; The verification code acquisition module is used for verifying the first signature information by using the service end public key, and acquiring the verification code; The encryption module is used for encrypting the username, the verification code and the terminal identifier by using the service end public key, to obtain second request information; The sending module is further used for sending the second request information to the service end, the service end decrypts the second request information by using the service end private key in response to the second request information, to obtain the username, the verification code and the terminal identifier, if the received username and the verification code are consistent with the stored ones, a symmetric key and session code are generated, the symmetric key and the session code are encrypted by using the terminal identifier, to obtain second user authentication information, the second user authentication information is signed by using the service end private key, to obtain second signature information, and the second signature information is fed back to the terminal; The key processing module is used for receiving the second signature information returned by the service end, verifying the second signature information by using the service end public key, extracting second user authentication information, and decrypting the second user authentication information by using the terminal identifier to obtain the symmetric key; The communication module is used for encrypting the sensitive information based on the symmetric key, and communicating with the service end. 10.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-9. The processor executes the computer program to realize the steps of the method in any one of claims 1 to 8.

Images