Account data interaction method based on trusted execution environment

Abstract

The embodiment of the present specification discloses a kind of account data interaction methods based on trusted execution environment, it is applied to the host terminal of installation target application, comprising: target application initiates account login request, and the request is transmitted to the trusted application in the trusted execution environment running;The trusted application obtains the application identity information of the target application, and sends the account login request after updating to account server with the application identity information;In the case where the application identity information is verified by the account server, the trusted application receives the token information sent by the account server, and the token information is passed to the target application;The target application performs account login based on the token information.Correspondingly, the present specification discloses account data interaction device based on trusted execution environment.

Description

Technical Field

[0001] This specification relates to a data interaction method, and more particularly to an account data interaction method based on a trusted execution environment. Background Technology

[0002] Currently, user authorization login services can serve the web-based user authorization module through common communication protocols. However, on mobile devices, the account management server faces certain security risks when adapting to the protocols used on the web to support user login services. The general process for obtaining account login is as follows: the mobile merchant app sends an account login request to the account management server; the account management server confirms the request and returns token information; the merchant server then uses this token information for user authentication and login. However, the operator's presence in external merchant apps is merely a third-party software development kit, or a piece of code, lacking the ability to detect malicious attacks. In other words, attackers can steal token information (user authorization credentials) by deceiving the account management server without the user's knowledge, thereby logging into the victim's account on the attacker's own device and misappropriating the legitimate user's identity and benefits within the legitimate app.

[0003] Therefore, we hope to obtain a more reliable solution for obtaining user authorization, so that users can resist phishing attacks launched by malicious apps during the login process and avoid potential account theft risks. Summary of the Invention

[0004] One of the objectives of the embodiments in this specification is to provide an account data interaction method based on a Trusted Execution Environment (TEE). This method utilizes the TEE commonly found in mobile devices to strengthen the existing operator number retrieval and login services, which have security flaws. It requires that the identity of the target application must be verified, and the TEE provides security guarantees for the entire link, thereby effectively resisting phishing attacks launched by malicious apps and avoiding potential account theft risks.

[0005] Based on the above-mentioned objectives, this specification proposes an account data interaction method based on a trusted execution environment, applied to a host terminal with a target application installed. The host terminal includes a trusted execution environment, and the method includes:

[0006] The target application initiates an account login request and transmits the account login request to a trusted application, which runs in the trusted execution environment;

[0007] The trusted application obtains the application identity information of the target application and sends an updated account login request to the account server, wherein the updated account login request carries the application identity information;

[0008] If the account server verifies the application's identity information, the trusted application receives the token information sent by the account server and transmits the token information to the target application.

[0009] The target application performs account login based on the token information.

[0010] In the embodiments of this specification, the account login request is sent through a trusted application (TA) proxy, enabling the operator's backend account server to securely identify and verify the identity of the target application when performing number retrieval and login services, thereby detecting the malicious app's attack intent. Since the TEE provides hardware-layer protection, it ensures encrypted communication between the trusted application and the account server, providing security for the entire link, thereby effectively resisting phishing attacks launched by malicious apps and avoiding potential account theft risks.

[0011] Furthermore, the step of the trusted application obtaining the application identity information of the target application and sending an updated account login request to the account server includes:

[0012] The trusted application obtains the application identity information and application credentials of the target application, and sends an updated account login request to the account server. The updated account login request carries the application identity information and the application credentials. The account server verifies the application identity information according to the mapping relationship between the application identity information and the application credentials.

[0013] Furthermore, after the target application transmits the account login request to the trusted application, the method further includes:

[0014] The trusted application obtains the application identity information of the target application, and sends the updated account login request to the account server after signing it.

[0015] After the account server decrypts the signed account login request and verifies the application's identity information, the trusted application receives the token information sent by the account server and transmits the token information to the target application.

[0016] The target application performs account login based on the token information.

[0017] It should be noted that the Trusted Application (TA) in the Trusted Execution Environment (TEE) has a pre-configured key to support encrypted communication with the account server, ensuring the reliability of the communication environment.

[0018] Furthermore, if the account server verifies the application's identity information, the step of the trusted application receiving the token information sent by the account server and transmitting the token information to the target application includes:

[0019] If the account server verifies the application's identity information, the trusted application receives the encrypted token information sent by the account server.

[0020] After decrypting the encrypted token information, the token information is transmitted to the target application.

[0021] Furthermore, the trusted application obtains the account credentials corresponding to the host terminal and associates the token information with the account credentials.

[0022] Even if an attacker can forge a request from a trusted application and send it to the account server beforehand, they can still obtain the associated account credentials through the token information, thereby detecting the identity of the host terminal and avoiding potential phishing attacks. This process is atomic and cannot be interfered with or controlled by external parties, serving as a second dimension of security detection. The account credentials include the mobile device's SIM card information.

[0023] Furthermore, before the target application initiates an account login request, the method further includes:

[0024] The target application sends an initialization request to the account server;

[0025] Based on the account server's response to the initialization request, the target application receives account information sent by the account server;

[0026] Based on the target application's confirmation of the account information, an account login request is initiated.

[0027] Furthermore, the step of the target application performing account login based on the token information includes:

[0028] The target application sends the token information to the target application server, wherein the target application server requests an account from the account server based on the token information and performs account login based on the requested account.

[0029] Another objective of the embodiments of this specification is to provide an account data interaction device based on a Trusted Execution Environment (TEE). This device utilizes the TEE commonly found in mobile devices to strengthen the existing operator number retrieval and login services that have security flaws. It requires that the identity of the target application must be verified, and the TEE provides hardware-level protection, providing security guarantees for the entire link, thereby effectively resisting phishing attacks launched by malicious apps and avoiding potential account theft risks.

[0030] To achieve the above objectives, embodiments of this specification also provide an account data interaction device based on a trusted execution environment, which includes a normal execution environment module and a trusted execution environment module. The target application runs in the normal execution environment module, and the trusted application runs in the trusted execution environment module.

[0031] The general execution environment module is used to initiate an account login request corresponding to the target application and transmit the account login request to the trusted application;

[0032] The trusted execution environment module is used to obtain the application identity information of the target application and send an updated account login request to the account server, wherein the updated account login request carries the application identity information;

[0033] If the account server verifies the application's identity information, the trusted execution environment module receives the token information sent by the account server and transmits the token information to the normal execution environment module.

[0034] The normal execution environment module performs account login based on the token information.

[0035] Furthermore, the trusted execution environment module is also used to obtain the application identity information and application credentials of the target application, and send an updated account login request to the account server, wherein the updated account login request carries the application identity information and the application credentials, and the account server verifies the application identity information according to the mapping relationship between the application identity information and the application credentials.

[0036] Furthermore, the trusted execution environment module is also used to obtain the application identity information of the target application, and to sign the updated account login request before sending it to the account server;

[0037] After the account server decrypts the signed account login request and the application identity information is verified, the trusted execution environment module receives the token information sent by the account server and transmits the token information to the ordinary execution environment module.

[0038] The normal execution environment module performs account login based on the token information.

[0039] Furthermore, if the account server verifies the application's identity information, the trusted execution environment module receives the encrypted token information sent by the account server.

[0040] After decrypting the encrypted token information, the trusted execution environment module transmits the token information to the ordinary execution environment module.

[0041] Furthermore, the trusted execution environment module is also used to obtain the account credentials corresponding to the host terminal and associate the token information with the account credentials.

[0042] Furthermore, the general execution environment module is also used to initiate an initialization request to the account server;

[0043] Based on the account server's response to the initialization request, the normal execution environment module receives account information sent from the account server;

[0044] Based on the confirmation of the account information by the general execution environment module, an account login request is initiated.

[0045] Furthermore, the general execution environment module is also used to send the token information to the target application server, wherein the target application server requests an account from the account server based on the token information and performs account login based on the requested account.

[0046] Another object of the embodiments of this specification is to provide a computer-readable storage medium, characterized in that the storage medium stores a computer program, which, when executed by a processor, implements the method described in any of the above-described embodiments.

[0047] Another object of the embodiments of this specification is to provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the program to implement the method described in any one of the above-mentioned embodiments.

[0048] The account data interaction method based on a trusted execution environment described in the embodiments of this specification has the following characteristics:

[0049] Beneficial effects:

[0050] Sending account login requests through a Trusted Application (TA) proxy enables the account server to securely identify and verify the identity of the target application when providing login services, thereby detecting the malicious intent of the app. Since the TEE provides hardware-level protection, it ensures encrypted communication between the trusted application and the account server, providing security for the entire chain, thus effectively resisting phishing attacks launched by malicious apps and avoiding potential account theft risks.

[0051] By obtaining the account credentials corresponding to the host terminal and associating them with token information, a second dimension of security detection is provided. Even if an attacker can forge a request from a trusted application and send it to the account server in advance, they can still obtain the associated account credentials through the token information, thereby detecting the identity of the host terminal and avoiding potential phishing attacks. Moreover, this process is an atomic operation and cannot be interfered with or controlled by external parties. Attached Figure Description

[0052] Figure 1 An exemplary diagram illustrates an application scenario of the account data interaction method based on a trusted execution environment described in one embodiment of this specification.

[0053] Figure 2 An exemplary schematic diagram of the steps in one implementation of the current number retrieval and login method is shown.

[0054] Figure 3 This illustration shows the steps an attacker takes to steal user information using the current login method.

[0055] Figure 4 The steps of the account data interaction method based on a trusted execution environment described in the embodiments of this specification are illustrated in one implementation.

[0056] Figure 5 The flowchart of the account data interaction method based on a trusted execution environment described in the embodiments of this specification is shown as an example in one implementation.

[0057] Figure 6 The diagram illustrates, exemplarily, a structural schematic of the account data interaction device based on a trusted execution environment as described in the embodiments of this specification under one implementation. Detailed Implementation

[0058] The account data interaction method and apparatus based on a trusted execution environment described in this specification will be further described in detail below with reference to the accompanying drawings and specific embodiments. However, this detailed description does not constitute a limitation on the embodiments of this specification.

[0059] Figure 1An exemplary diagram illustrates an application scenario of the account data interaction method based on a trusted execution environment described in one embodiment of this specification.

[0060] The embodiments in this specification can be applied to various types of application platforms with high account security requirements, such as platforms used to read highly confidential files or data, or platforms involving large transactions. On such platforms, there are also some high-risk operations. For example, on financial transaction platforms, changing payment passwords, changing the mobile phone number linked to an account, large-scale transactions, and modifying or removing self-service permissions are all operations that can have serious consequences for account security. Therefore, platforms have strict security controls on such operations.

[0061] like Figure 1 As shown, in some embodiments, the terminal can be a mobile device, with the host merchant app installed on the terminal as the target application. The user initiates a login operation through the terminal. The operator server is the account server in the operator's backend, storing the application information of the merchant app. After the user initiates a "one-click login" request, the merchant app sends an account login request to the account server and receives token information returned by the account server as user authorization credentials. The host merchant app then returns this token information to the merchant server. The merchant server uses this token information to verify the account login request with the account server, obtains the user account information, and completes the account login.

[0062] It should be noted that each block in the block diagrams or flowcharts, and combinations of blocks in the block diagrams or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions. Furthermore, the modules described in the embodiments of this specification can be implemented either in software or in hardware.

[0063] Currently, the "one-click login service using your mobile number" provided by operators is mainly based on the OAuth2.0 protocol. The original design goal of this protocol was to serve the user authorization number retrieval and login module on the web. However, on mobile devices, there are certain security risks in the process of operators adapting the OAuth2.0 protocol to support user login services.

[0064] Figure 2 An exemplary schematic diagram of the steps in one implementation of the current number retrieval and login method is shown.

[0065] like Figure 2As shown, the general process of current number retrieval and login is as follows: The merchant app, as the target application that the user wants to log in to, sends an initialization request to the account server on the operator's backend, receives the user's mobile phone number, performs a masking operation, and then the user initiates an authorization request. The target application sends an account login request to the account server, which contains the target application's application identity information, such as appid and application credentials appkey. Then, it receives the token information returned from the account server as the user's authorization credential and sends it to the merchant server. The merchant server, as the target application server, verifies the account login request with the account server based on this token information to obtain the current user's mobile phone number, and then uses this mobile phone number to authenticate the user and complete the user login.

[0066] However, the account server in the external target application exists only as a third-party software development kit, or a piece of code, and cannot accurately obtain the identity of the target application. Therefore, the account server on the operator's backend can only receive information from the initialization request initiated by the target application, but cannot perform security authentication of the target application's true identity, thus leading to account risk issues.

[0067] Figure 3 This illustration shows the steps an attacker takes to steal user information using the current login method.

[0068] like Figure 3 As shown, attackers can steal application identity information such as appid and appkey used by legitimate merchant apps. Without the user's knowledge, they can install a malicious app on the user's device and impersonate the legitimate merchant app to send an initialization request to the operator's backend account server, stealing the victim's token information, i.e., the user's authorization credential. Then, the attacker can use the legitimate merchant app on their own device to initiate a number retrieval and login request, injecting the stolen token information to obtain the victim's phone number. They can then authenticate and log in as the victim, stealing the identity and benefits of a normal user in the legitimate merchant app.

[0069] Therefore, we hope to obtain a more reliable solution for user number retrieval and login. By utilizing the TEE commonly found in mobile devices, the operator's backend account server can securely verify the identity of the target application when the operator retrieves and logs in, and provide a high level of hardware protection for user information to resist phishing attacks launched by malicious apps and avoid potential account theft risks.

[0070] A Trusted Execution Environment (TEE) is an independent processing environment with computation and storage capabilities, providing security and integrity protection. It leverages a hardware-secure CPU to perform secure computation based on memory isolation, enabling privacy-preserving computation while maintaining computational efficiency. The basic idea is to allocate a separate, isolated memory block within the hardware for sensitive data requiring protection. All computations on this sensitive data are performed within this memory block, and no part of the hardware can access the information in this isolated memory except through authorized interfaces, thus achieving privacy-preserving computations on sensitive data. TEEs can provide robust security in complex and interconnected systems. Currently, most TEE applications target smartphones, where they can provide security services including privacy-preserving ticketing services, online transaction confirmation, mobile payments, media content protection, and cloud storage service authentication. Trusted Applications (TAs) are applications running within the TEE environment that communicate with the TEE through authorized interfaces.

[0071] Figure 4 The steps of the account data interaction method based on a trusted execution environment described in the embodiments of this specification are illustrated in one implementation.

[0072] like Figure 4 As shown in the embodiment of this specification, a Trusted Application (TA) within a TEE (Trusted Application Environment) is added between the merchant app and the operator's backend account server. This TA receives account login requests, reassembles them into requests containing the merchant app's identity information, and sends them to the account server for merchant app identity verification. By introducing the TEE environment, hardware-layer protection is provided for communication between the target application and the account server, thereby enhancing the confidentiality and reliability of the communication.

[0073] In one embodiment of this specification, an account data interaction method based on a trusted execution environment is proposed, which is applied to a host terminal with a target application installed, the host terminal including a trusted execution environment.

[0074] Figure 5 The flowchart of the account data interaction method based on a trusted execution environment described in the embodiments of this specification is shown as an example in one implementation.

[0075] like Figure 5 As shown, the method includes the following steps:

[0076] 100: The target application initiates an account login request and transmits the account login request to a trusted application, which runs in a trusted execution environment.

[0077] The account used for user login can be a mobile phone number, an email address, or other account formats determined by the account distribution provider. During the "one-click login service," the user agrees to authorization on the host terminal, and the target application server can obtain the account through the result of the target application's request and response. Using the pre-stored account information, the user can log in without entering a password.

[0078] By introducing a TEE environment, the target application no longer communicates directly with the account server. For example, instead of directly using the operator's third-party software development kit (SDK) to initiate account login requests, it sends requests through the Trusted Application (TA) proxy in the TEE.

[0079] In some embodiments, before the target application initiates an account login request, the following steps are also performed:

[0080] The target application sends an initialization request to the account server;

[0081] Based on the account server's response to the initialization request, the target application receives account information sent by the account server;

[0082] Based on the target application's confirmation of account information, an account login request is initiated.

[0083] During the initialization request, the application identity information of the target application, such as the appid and application credential appkey, can be initialized. The appid is a unique identifier for the target application issued by the carrier, representing the target application's identity. After the target application sends the initialization request to the account server, the account server receives the request and returns account information, which can be the user's mobile phone number. Additionally, the account can be masked to enhance the confidentiality and security of information transmission. Once the user confirms the account information through the target application and agrees to the authorization operation, the target application initiates an account login request to the Trusted Application (TA).

[0084] By leveraging the Trusted Application (TA) within the Trusted Execution Environment (TEE), the TA agent sends account login requests, enabling the operator's backend account server to obtain the true identity of the target application. The dual-encrypted communication between the TA, the target application, and the account server enhances the protection of the target application's identity information and the user's identity information, providing security for the entire chain and effectively mitigating potential account theft risks.

[0085] 110: The trusted application obtains the application identity information of the target application and sends an updated account login request to the account server. The updated account login request carries the application identity information.

[0086] In the account login request sent by the target application, the Trusted Application (TA) extracts the application identity information to obtain a unique identifier for the target application. In iOS, the application identity information can be represented by a bundle ID; in Android, it can be represented by a combination of package name and package sign. The extracted application identity information is added to the login request to reassemble the account login request within the Trusted Execution Environment, ensuring that the request carries at least one unique application identity information identifier for the target application, and then the request is sent to the account server.

[0087] In some embodiments, after the target application transmits the account login request to the trusted application, it also performs the following steps:

[0088] The trusted application obtains the application identity information of the target application and sends the updated account login request to the account server after signing it.

[0089] After the account server decrypts the signed account login request and verifies the application's identity information, the trusted application receives the token information sent by the account server and transmits the token information to the target application.

[0090] The target application performs account login based on token information.

[0091] To protect the privacy and security of application identity information, and to ensure encryption of communication between the target application, the Trusted Application (TA), and the account server, a signature is added to the account login request carrying the application identity information using a pre-set key in the TA. This signature operation completes the reassembly of the account login request. It should be noted that this key is pre-set by the manufacturer and stored in the TA of the TEE system within the device before it leaves the factory; correspondingly, the operator also pre-sets a corresponding key in the account server for decryption.

[0092] Because the pre-installed key in the TEE is difficult to crack and extract, it provides hardware-level protection for communication between the target application, the Trusted Application (TA), and the account server, thus providing relatively reliable protection for the target application's identity information and corresponding token information.

[0093] In some embodiments, a trusted application obtains the application identity information and application credentials of a target application, and sends an updated account login request to an account server. The updated account login request carries the application identity information and application credentials, and the account server verifies the application identity information based on the mapping relationship between the application identity information and the application credentials.

[0094] When the account server receives the updated account login request, it first verifies the signature of the login request after it has been signed, based on the key pre-set by the operator, and then completes the corresponding decryption operation.

[0095] It's important to note that the merchant app and the operator pre-register their application information. The operator issues an appid to the merchant app to identify its identity and stores the association between this appid and the target application's identity information on the operator's side for subsequent verification of the merchant's identity. This association is reflected in the mapping relationship between the target application's appid and the application's identity information. After the account server decrypts the account login request, it extracts the target application's appid and the application's identity information carried in the request and verifies the association. If the verification is successful, the corresponding token information is sent to the trusted application as user authorization credentials. If the verification fails, the system can promptly detect malicious app attacks and terminate the process to prevent attackers from further stealing accounts.

[0096] Trusted Application (TA) can proactively obtain the target application's identity information, and this process is an atomic operation that cannot be interfered with. Once it starts, it will continue to run until the operation ends. Therefore, it is difficult for attackers to intervene to steal and change the target application's identity information, ensuring the security of the link in the process of the account server receiving login requests and verifying the application's identity.

[0097] 120: If the account server verifies the application's identity information, the trusted application receives the token information sent by the account server and transmits the token information to the target application.

[0098] In some embodiments, if the account server verifies the application's identity information, the trusted application receives the encrypted token information sent by the account server; after decrypting the encrypted token information, it transmits the token information to the target application.

[0099] The token information serves as a user authentication credential. The target application server can obtain the user's account information, including the user's mobile phone number, through this token information, thereby completing authentication and login. This process again utilizes the pre-set key in the Trusted Application (TA), thus providing a high-security communication environment for the token information, effectively avoiding the risk of attackers intercepting and stealing the token information, and ensuring the user's account security.

[0100] 130: The target application performs account login based on token information.

[0101] In some embodiments, the target application sends token information to the target application server, wherein the target application server requests an account from the account server based on the token information and performs account login based on the requested account.

[0102] The target application server receives the decrypted token information sent by the target application, verifies the corresponding account login request with the account server based on the token information, and after successful verification, receives the user account information from the account server, including the user's mobile phone number. The target application server authenticates the user based on the mobile phone number, completes user authorization, and logs into the user account.

[0103] In some embodiments, the trusted application obtains the account credentials corresponding to the host terminal and associates the token information with the account credentials.

[0104] Even if an attacker can forge a Trusted Application (TA) account login request on their own device and inject it into a malicious app to communicate with the account server in an attempt to steal token information to log in to the victim's account, the Trusted Application can still proactively obtain the account credentials corresponding to the host terminal for authentication, such as obtaining the phone's SIM card information. This process is also an atomic operation, so attackers cannot prevent or control the authentication process, making it easily detectable and avoiding potential phishing attacks, thus protecting the user's account and information security.

[0105] The account data interaction method based on a Trusted Execution Environment (TEE) described in this specification sends account login requests through a Trusted Application Proxy (TEP). This enables the account server to securely identify and verify the identity of the target application during account login services, thereby detecting the malicious intent of the app. Because the TEE provides hardware-level protection, it ensures encrypted communication between the trusted application and the account server, providing security for the entire chain and effectively resisting phishing attacks initiated by malicious apps, thus mitigating potential account theft risks. By obtaining the account credentials corresponding to the host terminal and associating them with token information, a second dimension of security detection is provided. Even if an attacker can forge a request from a trusted application and send it to the account server beforehand, they can still obtain the associated account credentials through the token information, thereby detecting the identity of the host terminal and avoiding potential phishing attacks.

[0106] In another embodiment of this specification, an account data interaction device based on a trusted execution environment is proposed, which includes a normal execution environment module 20 and a trusted execution environment module 22. The target application runs in the normal execution environment module 20, and the trusted application runs in the trusted execution environment module 22.

[0107] Figure 6 The diagram illustrates, exemplarily, a structural schematic of the account data interaction device based on a trusted execution environment as described in the embodiments of this specification under one implementation.

[0108] like Figure 6 As shown, the device performs the following steps:

[0109] The normal execution environment module 20 is used to initiate an account login request corresponding to the target application and transmit the account login request to the trusted application;

[0110] The Trusted Execution Environment module 22 is used to obtain the application identity information of the target application and send an updated account login request to the account server, wherein the updated account login request carries the application identity information;

[0111] If the account server verifies the application's identity information, the trusted execution environment module 22 receives the token information sent by the account server and transmits the token information to the ordinary execution environment module 20.

[0112] The normal execution environment module 20 executes account login based on token information.

[0113] In some embodiments, before the general execution environment module initiates an account login request corresponding to the target application, the following steps are also performed:

[0114] The normal execution environment module sends an initialization request to the account server;

[0115] Based on the account server's response to the initialization request, the normal execution environment module receives account information sent from the account server;

[0116] Based on the confirmation of account information by the normal execution environment module, an account login request is initiated.

[0117] The account used for user login can be a mobile phone number, an email address, or other account formats determined by the account distribution provider. During the "one-click login service," the user agrees to authorization on the host terminal, and the target application server can obtain the account through the result of the target application's request and response. Using the pre-stored account information, the user can log in without entering a password.

[0118] During the initialization request, the application identity information of the target application, such as the appid and application credential appkey, can be initialized. The appid is a unique identifier for the target application issued by the carrier, representing the target application's identity. After the ordinary execution environment module sends the initialization request to the account server, the account server receives the request and returns account information, which can be the user's mobile phone number. Additionally, the account can be masked to enhance the confidentiality and security of information transmission. Once the user confirms the account information through the target application and agrees to the authorization operation, the ordinary execution environment module initiates an account login request to the trusted application (TA).

[0119] By leveraging the Trusted Application (TA) within the Trusted Execution Environment (TEE), the TA proxy sends the account login request. This method enables the operator's backend account server to obtain the true identity of the target application. The dual-encrypted communication between the TA, the target application, and the account server enhances the protection of the target application's identity information and the user's identity information, providing security guarantees for the entire chain and effectively mitigating potential account theft risks. In some embodiments, after the ordinary execution environment module transmits the account login request to the TA, it also performs the following steps:

[0120] The Trusted Execution Environment module obtains the application identity information of the target application, and sends the updated account login request to the account server after signing it.

[0121] After the account server decrypts the signed account login request and the application identity information is verified, the trusted execution environment module receives the token information sent by the account server and passes the token information to the ordinary execution environment module.

[0122] The normal execution environment module performs account login based on token information.

[0123] In the account login request sent by the normal execution environment module, the trusted execution environment module extracts the application identity information to obtain the unique identifier of the target application. In iOS, the application identity information can be represented by the bundle ID; in Android, the application identity information can be represented by a combination of the package name and package sign. The extracted application identity information is added to the login request to reassemble the account login request within the trusted execution environment module, so that the request carries at least one application identity information that can uniquely identify the target application, and the request is sent to the account server.

[0124] To protect the privacy and security of application identity information, and to ensure encryption of communication between the ordinary execution environment module, the trusted execution environment module, and the account server, a pre-set key in the trusted execution environment module is used to add a signature to the account login request carrying the application identity information, thereby reassembling the account login request. It should be noted that this key is pre-set by the manufacturer and stored in the trusted application (TA) of the TEE system within the device before it leaves the factory; correspondingly, the operator also pre-sets a corresponding key in the account server for decryption.

[0125] Since the keys pre-installed in the TEE are difficult to crack and extract, hardware-level protection is provided for communication between the ordinary execution environment module, the trusted execution environment module, and the account server, thus ensuring relatively reliable protection of the target application's identity information and corresponding token information.

[0126] In some embodiments, the Trusted Execution Environment (TEX) module obtains the application identity information and application credentials of the target application, and sends an updated account login request to the account server. The updated account login request carries the application identity information and application credentials, and the account server verifies the application identity information according to the mapping relationship between the application identity information and the application credentials.

[0127] When the account server receives the updated account login request, it first verifies the signature of the login request after it has been signed, based on the key pre-set by the operator, and then completes the corresponding decryption operation.

[0128] It's important to note that the merchant app and the operator pre-register their application information. The operator issues an appid to the merchant app to identify its identity and stores the association between this appid and the target application's identity information on the operator's side for subsequent verification of the merchant's identity. This association is reflected in the mapping relationship between the target application's appid and the application's identity information. After the account server decrypts the account login request, it extracts the target application's appid and the application's identity information carried in the request and verifies the association. If the verification is successful, the corresponding token information is sent to the trusted execution environment module as user authorization credentials. If the verification fails, the system can promptly detect malicious app attacks and terminate the process to prevent attackers from further stealing accounts.

[0129] The Trusted Execution Environment (TEE) module can proactively obtain the target application's identity information. This process is an atomic operation that cannot be interfered with. Once it starts, it will continue to run until the operation ends. Therefore, it is difficult for attackers to intervene and steal or change the target application's identity information, ensuring the security of the link in the process of the account server receiving login requests and verifying the application's identity.

[0130] In some embodiments, if the account server verifies the application's identity information, the trusted execution environment module receives the encrypted token information sent by the account server; after decrypting the encrypted token information, it transmits the token information to the ordinary execution environment module.

[0131] The token information serves as a user authentication credential. The standard execution environment module can use this token information to obtain user account information, including the user's mobile phone number, thereby completing authentication and login. This process again utilizes the pre-installed key in the trusted execution environment module, providing a high-security communication environment for the token information. This effectively avoids the risk of attackers intercepting and stealing the token information, ensuring the security of the user's account.

[0132] In some embodiments, the general execution environment module sends token information to the target application server, wherein the target application server requests an account from the account server based on the token information and performs account login based on the requested account.

[0133] The target application server receives the decrypted token information sent by the normal execution environment module, verifies the corresponding account login request with the account server based on the token information, and after successful verification, receives the user account information from the account server, including the user's mobile phone number. The target application server authenticates the user based on the mobile phone number, completes user authorization, and logs into the user account.

[0134] In some embodiments, the Trusted Execution Environment module obtains the account credentials corresponding to the host terminal and associates the token information with the account credentials.

[0135] Even if an attacker can forge a user's account login request on their own device and inject it into a malicious app to communicate with the account server in an attempt to steal token information to log in to the victim's account, the Trusted Execution Environment (TEE) module can still proactively obtain the account credentials corresponding to the host terminal for authentication, such as obtaining the phone's SIM card information. This process is also an atomic operation, so attackers cannot prevent or control the authentication process, making it easily detectable and avoiding potential phishing attacks, thus protecting the user's account and information security.

[0136] In one embodiment of this specification, a computer-readable storage medium is also provided, characterized in that the storage medium stores a computer program that, when executed by a processor, implements the method described in any of the above-described embodiments.

[0137] In one embodiment of this specification, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the program to implement the method described in any one of the above descriptions.

[0138] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0139] It should be noted that the above examples are merely specific embodiments of the present invention, and the present invention is obviously not limited to the above embodiments, with many similar variations. All modifications that can be directly derived or conceived by those skilled in the art from the content disclosed in this invention should fall within the protection scope of this invention.

Claims

1. A method for account data interaction based on a trusted execution environment, applied to a host terminal with a target application installed, the host terminal including a trusted execution environment, the method comprising: The target application initiates an account login request and transmits the account login request to a trusted application, which runs in the trusted execution environment; The trusted application obtains the application identity information of the target application and sends an updated account login request to the account server, wherein the updated account login request carries the application identity information; If the account server verifies the application's identity information, the trusted application receives the token information sent by the account server and transmits the token information to the target application. The target application performs account login based on the token information.

2. The account data interaction method based on a trusted execution environment as described in claim 1, wherein the step of the trusted application obtaining the application identity information of the target application and sending an updated account login request to the account server includes: The trusted application obtains the application identity information and application credentials of the target application, and sends an updated account login request to the account server. The updated account login request carries the application identity information and the application credentials. The account server verifies the application identity information according to the mapping relationship between the application identity information and the application credentials.

3. The account data interaction method based on a trusted execution environment as described in claim 1, wherein after the target application transmits the account login request to the trusted application, the method further includes: The trusted application obtains the application identity information of the target application, and sends the updated account login request to the account server after signing it. After the account server decrypts the signed account login request and verifies the application's identity information, the trusted application receives the token information sent by the account server and transmits the token information to the target application. The target application performs account login based on the token information.

4. The account data interaction method based on a trusted execution environment as described in claim 1, wherein, when the account server verifies the application's identity information, the trusted application receives token information sent by the account server and transmits the token information to the target application, the step of which includes: If the account server verifies the application's identity information, the trusted application receives the encrypted token information sent by the account server. After decrypting the encrypted token information, the token information is transmitted to the target application.

5. The account data interaction method based on a trusted execution environment as described in claim 1, further comprising: The trusted application obtains the account credentials corresponding to the host terminal and associates the token information with the account credentials.

6. The account data interaction method based on a trusted execution environment as described in claim 1, wherein before the target application initiates an account login request, the method further includes: The target application sends an initialization request to the account server; Based on the account server's response to the initialization request, the target application receives account information sent by the account server; Based on the target application's confirmation of the account information, an account login request is initiated.

7. The account data interaction method based on a trusted execution environment as described in claim 1, wherein the step of the target application performing account login based on the token information includes: The target application sends the token information to the target application server, wherein the target application server requests an account from the account server based on the token information and performs account login based on the requested account.

8. An account data interaction device based on a trusted execution environment, comprising a normal execution environment module and a trusted execution environment module, wherein a target application runs in the normal execution environment module, and the trusted application runs in the trusted execution environment module. The general execution environment module is used to initiate an account login request corresponding to the target application and transmit the account login request to the trusted application; The trusted execution environment module is used to obtain the application identity information of the target application and send an updated account login request to the account server. The updated account login request carries the application's identity information; If the account server verifies the application's identity information, the trusted execution environment module receives the token information sent by the account server and transmits the token information to the normal execution environment module. The normal execution environment module performs account login based on the token information.

9. The account data interaction device based on a trusted execution environment as described in claim 8, The trusted execution environment module is further configured to obtain the application identity information and application credentials of the target application, and send an updated account login request to the account server, wherein... The updated account login request carries the application identity information and the application credentials. The account server verifies the application identity information based on the mapping relationship between the application identity information and the application credentials.

10. The account data interaction device based on a trusted execution environment as described in claim 8. The trusted execution environment module is also used to obtain the application identity information of the target application, and to sign the updated account login request before sending it to the account server; After the account server decrypts the signed account login request and the application identity information is verified, the trusted execution environment module receives the token information sent by the account server and transmits the token information to the ordinary execution environment module. The normal execution environment module performs account login based on the token information.

11. The account data interaction device based on a trusted execution environment as described in claim 8, If the account server verifies the application's identity information, the trusted execution environment module receives the encrypted token information sent by the account server. After decrypting the encrypted token information, the trusted execution environment module transmits the token information to the ordinary execution environment module.

12. The account data interaction device based on a trusted execution environment as described in claim 8, The trusted execution environment module is also used to obtain the account credentials corresponding to the host terminal and associate the token information with the account credentials.

13. The account data interaction device based on a trusted execution environment as described in claim 8, The general execution environment module is also used to send an initialization request to the account server; Based on the account server's response to the initialization request, the normal execution environment module receives account information sent from the account server; Based on the confirmation of the account information by the general execution environment module, an account login request is initiated.

14. The account data interaction device based on a trusted execution environment as described in claim 8, The general execution environment module is also used to send the token information to the target application server, wherein... The target application server requests an account from the account server based on the token information and performs account login based on the requested account.

15. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1-7.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method described in any one of claims 1-7.

Images