Method and system for intelligent terminal to provide safe live broadcast business service through trusted area, and electronic equipment

Abstract

The invention discloses a method and a system for an intelligent terminal to provide a safe live broadcast service through a trusted area, and electronic equipment. The intelligent terminal provides the live broadcast service through the trusted area, and two processes of authenticating a live broadcast service platform by the intelligent terminal and verifying the intelligent terminal by the live broadcast service platform are needed; a hardware level of the intelligent terminal is divided into a safe area and a non-safe area, and a safe operation system is independently arranged in the safe area to form a trusted area of the intelligent terminal. And the intelligent terminal authenticates the live broadcast service platform, the live broadcast service platform verifies programs of the intelligent terminal, related data information storage and live broadcast business service are all operated in the trusted area of the intelligent terminal. According to the invention, the security area is arranged on the intelligent terminal providing the live broadcast business service, and a dual mutual trust mechanism that the live broadcast service platform trust the intelligent terminal and the intelligent terminal trust the live broadcast service platform is established, so that multiple security trust chains are formed, and the security of the live broadcast business service is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of streaming media and intelligent terminals, and in particular to a method, system and electronic device for an intelligent terminal to provide a secure live broadcast service through a trusted zone. Background Art

[0002] In the field of streaming media technology and smart terminal technology, loading applications on smart terminals, using applications to obtain live broadcast signals provided by service platforms, and providing live broadcast services to users are relatively mature technical fields. Before users obtain live broadcast services, security detection mechanisms such as user identity verification also ensure that users can enter legal live broadcast platforms as much as possible.

[0003] However, with the continuous development of technology, there are more and more ways for illegal actors to attack legitimate live broadcast applications from platforms and smart terminals, thereby stealing user information, disrupting user services, and even providing illegal live broadcast signals.

[0004] All kinds of smart terminals are in an open environment at the hardware and system levels, which makes the live broadcast service client loaded on the smart terminal vulnerable to various attacks. In particular, the live broadcast service on the vast majority of smart terminals is implemented through applications, which are in the application layer of the same operating system as other applications. External attackers can steal user information and destroy service integrity by forging cloud service platforms, refreshing local operating systems, and installing malicious programs in local operating systems. In more serious cases, they can replace legitimate live broadcast signal sources with illegal ones, which will have adverse social impacts.

[0005] Therefore, the means of installing malicious programs and destroying live broadcast applications have become increasingly rampant in recent years, resulting in adverse effects.

[0006] All kinds of smart terminals are in an open environment at the hardware and system levels, which makes the live broadcast service client loaded on the smart terminal vulnerable to various attacks. External attackers can steal user information and destroy service integrity by forging cloud service platforms, refreshing local operating systems, and installing malicious programs in local operating systems. In more serious cases, they can replace legitimate live broadcast signal sources with illegal ones, which will have adverse social impacts. Summary of the invention

[0007] The purpose of the present invention is to solve the problems of external attacks such as installation of malicious programs and destruction of live broadcast applications in the current live broadcast service. A dual mutual trust mechanism is proposed by establishing a security zone for smart terminals, combining the security zone with the live broadcast service platform to establish a smart terminal trust platform, and the platform trusts the smart terminal, so as to ensure the security of providing live broadcast service.

[0008] To achieve the above purpose, the technical solution provided by the present invention is:

[0009] A method for providing a secure live broadcast service via a trusted zone by an intelligent terminal, comprising: a live broadcast service platform and an intelligent terminal, wherein the live broadcast service platform is used to provide a live broadcast signal source for live broadcast service and provide service authentication information for an intelligent terminal for opening a live broadcast service, and the intelligent terminal is used to open a live broadcast service via the live broadcast service platform and receive the live broadcast service provided by the live broadcast service platform;

[0010] The provision of live broadcast service by smart terminals requires two processes: smart terminal authentication of the live broadcast service platform and live broadcast service platform verification of the smart terminal; the smart terminal is divided into a secure area and a non-secure area at the hardware level, and a secure operating system is independently set up in the secure area to constitute a trusted area of ​​the smart terminal. The smart terminal authentication of the live broadcast service platform and the live broadcast service platform verification of the smart terminal program and related data information storage as well as the live broadcast service are all run in the trusted area of ​​the smart terminal;

[0011] The process of smart terminal authentication of live broadcast service platform is as follows: a communication public key is preset in the smart terminal. After the smart terminal initiates a mutual trust request to the live broadcast service platform, the live broadcast service platform issues a trusted certificate to the smart terminal. The trusted certificate contains an encrypted platform certificate signature. After the smart terminal receives the trusted certificate, it completes the trust verification of the trusted certificate through the communication public key.

[0012] The process of the live broadcast service platform verifying the smart terminal is as follows: the live broadcast service platform provides business authentication information for the smart terminal. The live broadcast service platform also allocates an authentication key for authenticating the smart terminal. The smart terminal encrypts the business authentication information provided by the live broadcast service platform and the identity information of the smart terminal through the authentication key and sends them to the live broadcast service platform. The live broadcast service platform completes the security verification of the smart terminal through decryption and comparison.

[0013] To optimize the above technical solutions, the specific measures taken also include:

[0014] A secure area virtual CPU and a non-secure area virtual CPU are divided on the physical chip of the smart terminal, and hardware isolation is established by forming virtual CPU isolation; a secure storage area is designated for the physical memory of the smart terminal, and an independent instruction set and access mechanism are used, and the access mechanism is integrated into the secure operating system as a unique module.

[0015] The security zone is pre-installed with a platform mutual trust program for communication between smart terminals and live broadcast service platforms, a terminal authentication program for communicating with the live broadcast service platform and establishing mutual trust between the live broadcast service platform and the smart terminals, and a live broadcast service program for providing users with a live broadcast channel display page and providing live channel playback services; the live broadcast business services include live broadcast playback services and upgrading live broadcast playback programs, and the live broadcast playback services include providing live channel display pages and providing live channel playback services.

[0016] Furthermore, the smart terminal sends a request to establish mutual trust to the live broadcast service platform through the platform mutual trust program, and the live broadcast service platform returns the trusted certificate of the live broadcast service platform to the platform mutual trust program of the smart terminal, and the smart terminal reads the obtained trusted certificate through the platform mutual trust program; the trusted certificate contains first plaintext information representing the identity information of the live broadcast service platform, and the first plaintext information uses a hash function to form a first information summary and is encrypted by a first private key as the platform certificate signature of the live broadcast service platform.

[0017] Furthermore, a communication public key is pre-installed in the smart terminal as the first public key. After receiving the trusted certificate, the smart terminal completes the legitimacy authentication of the trusted certificate of the live broadcast service platform through the first public key; the smart terminal adopts the same hash function as the live broadcast service platform through the platform mutual trust program to obtain the information summary in the trusted certificate; the smart terminal uses the preset communication public key to decrypt the platform certificate signature in the trusted certificate obtained through the platform mutual trust program, and the smart terminal compares the result obtained by decrypting the communication public key with the information summary calculated by using the same hash function as the live broadcast service platform; after the smart terminal completes the trust verification of the trusted certificate, the platform legal verification storage bit reserved in the security zone records the legal verification result.

[0018] Furthermore, the business authentication information and authentication key are respectively used as the second public key and the second private key used by the live broadcast service platform to authenticate the legitimacy of the smart terminal. The smart terminal uses a hash function to form a second information summary of the business authentication information provided by the live broadcast service platform and the second plaintext information representing the identity information of the smart terminal and encrypts it with the second private key. The live broadcast service platform uses the second public key for trust verification.

[0019] Preferably, when the user starts the live broadcast service, the user first checks the Root identifier of the non-safe zone through the live broadcast service program. If the check result of the Root identifier of the non-safe zone is that it has been changed, it means that the operating system of the non-safe zone has been changed, and the smart terminal refuses to provide the live broadcast service; then the verification result of the record stored in the platform's legal verification storage bit is checked. If the verification result is legal, the next step is to proceed to the live broadcast service platform to verify the smart terminal. Otherwise, the live broadcast service is refused to be provided; the live broadcast service platform verifies the smart terminal and verifies the result of the live broadcast service platform verifying the smart terminal. If the verification passes, the live broadcast service program obtains the live broadcast signal source from the live broadcast service platform in accordance with the live broadcast service process to complete the live broadcast service, otherwise the live broadcast service is refused to be provided.

[0020] Preferably, the first plaintext information includes: the validity period of the certificate, the certificate serial number and the live broadcast service platform code that issues the certificate of this live broadcast service platform; the second plaintext information includes: the smart terminal identity and the smart terminal MAC address; the smart terminal is provided with a unique smart terminal identity, and the business authentication information serves as the user's unique identifier in the live broadcast service platform, and the business authentication information is identified by a group of numbers, letters or a combination of letters / numbers; the live broadcast service platform generates an authentication key for the smart terminal, and each authentication key is not repeated, and the authentication key is uniquely bound to the business authentication information of the live broadcast business platform and the smart terminal.

[0021] The present invention also provides a system for a smart terminal to provide a secure live broadcast service through a trusted zone, comprising:

[0022] The live broadcast service platform authentication module is used for the smart terminal to authenticate the live broadcast service platform. A communication public key is preset in the smart terminal. After the smart terminal initiates a mutual trust request to the live broadcast service platform, the live broadcast service platform issues a trusted certificate to the smart terminal. The trusted certificate contains an encrypted platform certificate signature. After the smart terminal receives the trusted certificate, it completes the trust verification of the trusted certificate through the communication public key.

[0023] The smart terminal verification module is used by the live broadcast service platform to verify the smart terminal. The live broadcast service platform provides business authentication information for the smart terminal. The live broadcast service platform is also allocated with an authentication key for authenticating the identity of the smart terminal. The smart terminal encrypts the business authentication information provided by the live broadcast service platform and the identity information of the smart terminal with the authentication key and sends them to the live broadcast service platform. The live broadcast service platform completes the security verification of the smart terminal through decryption and comparison.

[0024] The smart terminal trusted zone construction module is used to divide the hardware level of the smart terminal into a secure zone and a non-secure zone. A secure operating system is independently set up in the secure zone to form the smart terminal trusted zone. The smart terminal authenticates the live broadcast service platform and the live broadcast service platform verifies that the smart terminal's programs and related data information storage as well as the live broadcast business services are all running in the smart terminal trusted zone.

[0025] The present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for providing a secure live broadcast service through a trusted zone by a smart terminal as described above is implemented.

[0026] The present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the method for providing a secure live broadcast service by a smart terminal through a trusted zone as described above.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] The present invention sets up a security zone on the intelligent terminal providing the live broadcast service, and all the applications and data involved in the live broadcast service are run in the security zone to ensure the security of the applications and data;

[0029] The present invention establishes a dual mutual trust mechanism in which the live broadcast service platform trusts the intelligent terminal and the intelligent terminal trusts the live broadcast service platform, forming a multiple security trust chain. If any link fails to be trusted, the live broadcast service will be terminated immediately to ensure the security of the live broadcast service. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 : System architecture diagram of the intelligent terminal of the present invention providing secure live broadcast service through a trusted zone.

[0031] Figure 2 : Schematic diagram of the process of intelligent terminal authentication live broadcast service platform of the present invention.

[0032] Figure 3 : Schematic diagram of the process of the live broadcast service platform of the present invention verifying the intelligent terminal. DETAILED DESCRIPTION

[0033] The above contents of the present invention are further described in detail below in the form of embodiments, but this should not be understood as the scope of the above subject matter of the present invention being limited to the following embodiments, and all technologies realized based on the above contents of the present invention belong to the scope of the present invention.

[0034] The glossary and descriptions of the present invention are as follows:

[0035] Live signal source: a live TV channel signal that is officially authorized and provided by a TV station or relevant compliance organization.

[0036] Live broadcast service platform: A TV live broadcast channel service platform that is officially authorized and provided by a TV station or relevant compliance organization. Live broadcast service users are authenticated through the live broadcast service platform. Authenticated users can receive live broadcast signal sources and enjoy live broadcast channel services on smart terminals.

[0037] Smart terminal: refers to hardware devices that run smart operating systems and can be pre-installed or installed with client, including but not limited to televisions, set-top boxes, projectors, etc. The live broadcast client required for live broadcast service users to enjoy live broadcast channel services is installed on smart terminals.

[0038] Smart terminal trusted zone: refers to a secure operating system isolated from the conventional operating system provided for smart terminals based on the TEE mechanism. This isolated secure operating system is used to specifically process sensitive information to ensure user-oriented security services, including live broadcast clients, trusted zone verification programs, security certificates, etc.

[0039] The hash function and public key involved in the present invention can meet the scenarios required by the present invention as long as they comply with the relevant standards promulgated by the national cryptography management agency.

[0040] The present invention provides a method for a smart terminal to provide a secure live broadcast service through a trusted zone, comprising: a live broadcast service platform and a smart terminal, wherein the live broadcast service platform is used to provide a live broadcast signal source to provide a live broadcast service and provide service authentication information to a smart terminal for opening a live broadcast service, and the smart terminal is used to open a live broadcast service through the live broadcast service platform and receive the live broadcast service provided by the live broadcast service platform;

[0041] The provision of live broadcast service by smart terminals requires two processes: smart terminal authentication of the live broadcast service platform and live broadcast service platform verification of the smart terminal. The smart terminal hardware level is divided into a secure area and a non-secure area. A secure operating system is independently set up in the secure area to form a trusted area for the smart terminal. The programs and related data information storage of the smart terminal authentication of the live broadcast service platform and the verification of the smart terminal by the live broadcast service platform, as well as the live broadcast service, are all run in the trusted area of ​​the smart terminal.

[0042] The process of smart terminal authentication of live broadcast service platform is as follows: a communication public key is preset in the smart terminal. After the smart terminal initiates a mutual trust request to the live broadcast service platform, the live broadcast service platform issues a trusted certificate to the smart terminal. The trusted certificate contains an encrypted platform certificate signature. After the smart terminal receives the trusted certificate, it completes the trust verification of the trusted certificate through the communication public key.

[0043] The process of the live broadcast service platform verifying the smart terminal is as follows: the live broadcast service platform provides business authentication information for the smart terminal. The live broadcast service platform also allocates an authentication key for authenticating the smart terminal. The smart terminal encrypts the business authentication information provided by the live broadcast service platform and the identity information of the smart terminal through the authentication key and sends them to the live broadcast service platform. The live broadcast service platform completes the security verification of the smart terminal through decryption and comparison.

[0044] The method for implementing the intelligent terminal of the present invention to provide a secure live broadcast service through a trusted zone is described in parts as follows:

[0045] (1) Smart terminals provide safe areas and non-safe areas.

[0046] The operating environment refers to two independent spaces, namely the security zone and the non-security zone, isolated from the software and hardware resources such as the CPU and memory of the smart terminal; all security services are executed in the security zone (such as certificate verification, live broadcast client, etc.), and sensitive data are stored in the security zone (such as communication keys, etc.), and the remaining operations are executed in the non-security zone (such as user operating system, various non-live broadcast clients, etc.), and the remaining non-sensitive data are stored in the non-security zone; the security zone has an independent operating system, which is also isolated from the operating system in the non-security zone; the service program executed in the security zone is called a security program in the present invention.

[0047] In the present invention, the security zones provided by various SoC chips, whether in a pure physical isolation mode or in a mode divided by CPU cores or time slices, can achieve the ultimate goal of the present invention.

[0048] In the present invention, channel display, user identity authentication and channel encoding and decoding are related to the ability of live channel playback service; certificate installation, certificate verification, certificate update, etc. are all executed in the form of security programs in the security zone of the smart terminal.

[0049] The specific implementation method is as follows:

[0050] The division of secure area and non-secure area is realized at the hardware level of smart terminals. Secure area virtual CPU and non-secure area virtual CPU are divided on the physical chip of smart terminals. Hardware isolation is established through isolation of virtual CPU. At the same time, secure area is also specified for physical memory to ensure physical isolation of storage space.

[0051] The operating systems of the secure zone and the non-secure zone are independent of each other. The operating system of the secure zone is installed on the virtual CPU of the secure zone, and the operating system of the non-secure zone is installed on the virtual CPU of the non-secure zone. The physical memory of the secure zone uses an independent instruction set and access mechanism, which is integrated into the operating system of the secure zone as a unique module. Programs running in the secure zone become secure programs, which can access the storage contents of the secure zone.

[0052] The smart terminal of the present invention needs to complete the following program and data configuration in the security zone when the smart device leaves the factory:

[0053] 1. Set up a storage bit in the secure area to mark whether the operating system in the non-secure area has been tampered with;

[0054] 2. Set up a storage location in the security zone to record the "authentication key" assigned by the live broadcast service platform to the smart terminal;

[0055] 3. Set up a storage location in the security zone to record the "business authentication information" assigned by the live broadcast service platform to the smart terminal;

[0056] 4. Set up a storage location in the security zone to record the "platform legality verification" information of whether the live broadcast service platform connected to the smart terminal is legal;

[0057] 5. Establish a storage location in the security zone to record the unique “intelligent terminal identity” of the intelligent terminal;

[0058] 6. Pre-install a "platform mutual trust program" in the security zone for communication between the smart terminal and the live broadcast service platform to confirm whether the currently connected live broadcast service platform is trustworthy;

[0059] 7. Pre-install a "terminal authentication program" in the security zone to communicate with the live broadcast service platform so that the live broadcast service platform and the smart terminal can establish mutual trust;

[0060] 8. Pre-install the "live broadcast service program" in the security zone, and users can provide live broadcast channel display pages and live broadcast channel playback services. (II) The live broadcast service platform provides users with business authentication information and authentication keys

[0061] In the present invention, when the live broadcast platform handles and opens the live broadcast service for the user, the live broadcast service platform provides the user with service authentication information, and simultaneously allocates an "authentication key" for the platform to authenticate the identity of the smart terminal, and binds this "authentication key" to the service authentication information; the "service authentication information" and "authentication key" are respectively used as the second public key and the second private key of the asymmetric encryption algorithm used by the live broadcast service platform to authenticate whether the service smart terminal is legal.

[0062] The specific implementation is as follows:

[0063] When handling business, live broadcast service users will obtain user business authentication information assigned by the platform. This user authentication information serves as the user's unique identifier in the live broadcast service platform, and can be identified by a set of numbers, letters, or a combination of letters / numbers.

[0064] When allocating business authentication information, the live broadcast business platform also completes the following actions:

[0065] Step 1: Synchronously generate an authentication key for the user; the authentication key is bound to the user's business authentication information on the live broadcast business platform; the platform does not allow authentication keys to be repeated or to be bound to multiple user business authentication information.

[0066] Step 2: Write the authentication key into the security zone of the smart terminal.

[0067] (III) Establishing a relationship of mutual trust between smart terminals and live broadcast service platforms

[0068] When the smart terminal leaves the factory, a communication public key is preset in the security zone according to the requirements of the live broadcast service platform; after the smart terminal starts to connect to the Internet, the "platform mutual trust program" in the security zone of the smart terminal initiates a mutual trust request to the live broadcast service platform; the live broadcast service platform issues a trusted certificate, and the platform certificate signature in the trusted certificate is encrypted using the first private key of the asymmetric algorithm. After the smart terminal receives the trusted certificate, it completes the trust verification of the trusted certificate of the live broadcast service platform through the communication public key preset in the security zone; for scenarios where the verification fails, the smart terminal refuses to establish a live broadcast connection with the platform.

[0069] The specific implementation method is as follows:

[0070] The live broadcast service platform provides a trusted certificate for smart terminals connected to the platform; the trusted certificate includes: the certificate's validity period, certificate serial number, platform code for issuing the live broadcast service platform certificate and other plain text information, as well as the signature of the live broadcast service platform certificate.

[0071] The signature of the live broadcast service platform certificate is generated by using a hash function to calculate the plaintext information summary, and then using the first private key independently managed by the live broadcast service platform to encrypt the first information summary formed by the first plaintext information. The resulting ciphertext is the signature of the live broadcast service platform certificate.

[0072] Step 1: The "Platform Mutual Trust Program" in the smart terminal security zone sends a request to the live broadcast service platform to establish mutual trust;

[0073] Step 2: The live broadcast service platform returns the live broadcast service platform certificate of the platform to the "Platform Mutual Trust Program" in the smart terminal security zone;

[0074] Step 3: The "Platform Mutual Trust Program" in the smart terminal security zone reads the acquired live broadcast service platform certificate and reads the first plaintext information therein;

[0075] Step 4: The "Platform Mutual Trust Program" in the smart terminal security zone uses the same hash function as the live broadcast service platform to calculate the information summary of the first plaintext information in the certificate;

[0076] Step 5: The "Platform Mutual Trust Program" in the security zone of the smart terminal uses the communication public key preset in the security zone at the factory to decrypt the signature contained in the obtained certificate, and compares the decrypted signature with the information digest calculated in step 4;

[0077] Step 6: If the comparison results are consistent, it means that the certificate is legal, that is, the smart terminal can believe that the live signal source provided by the live service platform is legal. At this time, the "Platform Mutual Trust Program" records "verification legality" in the "Platform Legal Verification" storage bit reserved in the security zone; only the legal live service platform that has been verified by the smart terminal can provide live service services for this smart terminal or upgrade the live broadcast program.

[0078] (IV) The live broadcast service platform completes the security verification of the smart terminal

[0079] When a smart terminal applies to the live broadcast service platform for live broadcast, the live broadcast platform must also verify whether the current smart terminal is legal; according to Section (II) "The live broadcast service platform provides users with business authentication information and authentication keys", the "terminal authentication program" in the smart terminal security zone uses the hash function to form a second information summary of the "business authentication information" and "smart terminal identity identification", "smart terminal MAC address" and other second plaintext information stored in the security zone, and uses the "authentication key" as the second private key for encryption. The live broadcast service platform uses the "business authentication information" as the second public key for decryption. If the comparison is consistent, the live broadcast service platform can trust the smart terminal.

[0080] The specific implementation is as follows:

[0081] Step 1: The "Terminal Authentication Program" of the smart terminal security zone is started;

[0082] Step 2: The "Terminal Authentication Program" in the security zone will guide the user to enter the service authentication information obtained. After the user completes the input, the security zone will record the user's service authentication information locally;

[0083] Step 3, the "terminal authentication program" in the security zone, forms a second information summary of the second plaintext information such as "business authentication information", "smart terminal identity" and "smart terminal MAC address" in the security zone through a hash function, uses the "authentication key" as the second private key for encryption, and sends the above second plaintext information and encrypted data to the live broadcast service platform;

[0084] Step 4: After receiving the plain text information and encrypted data sent by the "terminal authentication program", the live broadcast service platform uses a hash function to form a summary of the second plain text information such as "business authentication information" and "smart terminal identity identifier" and "smart terminal MAC address";

[0085] Step 5, the live broadcast service platform uses the "business authentication information" as the second public key to decrypt the encrypted data received from the "user authentication program";

[0086] Step 6: Compare the data obtained in step 5 with the data obtained in step 4. If the comparison is consistent, the live broadcast service platform can trust the current smart terminal and provide it with live broadcast business services, otherwise it will directly refuse the service.

[0087] Only legal smart terminals that have been verified by the live broadcast service platform can be provided with live broadcast services or remotely upgraded with live broadcast programs.

[0088] (V) Smart terminals provide secure live broadcast services

[0089] Before providing live broadcast services, the smart terminal checks whether the operating system in the non-safe zone has been unofficially modified (i.e., whether it has been rooted). If so, the security of the machine cannot be guaranteed, and the live broadcast service will be rejected until the non-safe zone is restored to the officially modified operating system; check whether the live broadcast service platform currently providing live broadcast services is trustworthy (i.e., whether it has a compliance certificate), and reject the service if it is not trustworthy; when the live broadcast service platform is trusted and a request for obtaining a live broadcast signal source is initiated, the live broadcast service platform will verify whether the smart terminal initiating the request is trustworthy, and provide the live broadcast signal source if it is trustworthy. All the programs and data involved in the above operations are performed in the smart terminal security zone.

[0090] The specific implementation method is as follows:

[0091] Step 1: Preset the "live broadcast service program" in the user operation safety zone;

[0092] Step 2: The live broadcast service program checks the Root ID of the non-secure zone. If the ID is "changed", it means that the operating system of the non-secure zone has been changed. In this case, the live broadcast service is refused. Otherwise, the program proceeds to step 3.

[0093] Step 3, the live broadcast service program checks the local "platform legal verification" storage bit in the security zone to check whether its record is "verified legal". If so, proceed to step 4. Otherwise, refuse to provide live broadcast service;

[0094] Step 4. The live broadcast service program follows the "live broadcast service platform completes the security verification of the smart terminal" process to complete the identity trust verification of the smart terminal by the live broadcast service platform. If the trust verification passes, it proceeds to step 5, otherwise it refuses to provide live broadcast service.

[0095] Step 5: The live broadcast service program obtains the live broadcast signal source from the live broadcast service platform according to the business process and completes the live broadcast business service.

[0096] The present invention also provides a system for a smart terminal to provide a secure live broadcast service through a trusted zone, including:

[0097] The live broadcast service platform authentication module is used for the smart terminal to authenticate the live broadcast service platform. A communication public key is preset in the smart terminal. After the smart terminal initiates a mutual trust request to the live broadcast service platform, the live broadcast service platform issues a trusted certificate to the smart terminal. The trusted certificate contains an encrypted platform certificate signature. After the smart terminal receives the trusted certificate, it completes the trust verification of the trusted certificate through the communication public key.

[0098] The smart terminal verification module is used by the live broadcast service platform to verify the smart terminal. The live broadcast service platform provides business authentication information for the smart terminal. The live broadcast service platform is also allocated with an authentication key for authenticating the identity of the smart terminal. The smart terminal encrypts the business authentication information provided by the live broadcast service platform and the identity information of the smart terminal with the authentication key and sends them to the live broadcast service platform. The live broadcast service platform completes the security verification of the smart terminal through decryption and comparison.

[0099] The smart terminal trusted zone construction module is used to divide the hardware level of the smart terminal into a secure zone and a non-secure zone. A secure operating system is independently set up in the secure zone to form the smart terminal trusted zone. The smart terminal authenticates the live broadcast service platform and the live broadcast service platform verifies that the smart terminal's programs and related data information storage as well as the live broadcast business services are all running in the smart terminal trusted zone.

[0100] The present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for providing a secure live broadcast service through a trusted zone by a smart terminal as described above is implemented.

[0101] The present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the above method for a smart terminal to provide a secure live broadcast service through a trusted zone.

[0102] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of computer storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0103] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any technician familiar with the profession, without departing from the scope of the technical solution of the present invention, according to the technical essence of the present invention, any simple modification, equivalent replacement and improvement made to the above embodiment still falls within the protection scope of the technical solution of the present invention.

Claims

1. A method for a smart terminal to provide a secure live broadcast service through a trusted zone, characterized in that: include: A live broadcast service platform and a smart terminal, wherein the live broadcast service platform is used to provide a live broadcast signal source for live broadcast service and provide service authentication information for smart terminals that handle and activate live broadcast service, and the smart terminal is used to handle and activate live broadcast service through the live broadcast service platform and receive live broadcast service provided by the live broadcast service platform; The smart terminal providing live broadcast service needs to go through two processes: smart terminal authentication live broadcast service platform and live broadcast service platform verification of smart terminal; A secure area and a non-secure area are divided at the hardware level of the smart terminal. A secure operating system is independently set up in the secure area to form a trusted area of ​​the smart terminal. The smart terminal authenticates the live broadcast service platform and the live broadcast service platform verifies that the program and related data information storage of the smart terminal and the live broadcast service are all running in the trusted area of ​​the smart terminal; The process of smart terminal authentication of live broadcast service platform is as follows: a communication public key is preset in the smart terminal. After the smart terminal initiates a mutual trust request to the live broadcast service platform, the live broadcast service platform issues a trusted certificate to the smart terminal. The trusted certificate contains an encrypted platform certificate signature. After the smart terminal receives the trusted certificate, it completes the trust verification of the trusted certificate through the communication public key. The process of the live broadcast service platform verifying the smart terminal is as follows: the live broadcast service platform provides business authentication information for the smart terminal. The live broadcast service platform also allocates an authentication key for authenticating the smart terminal. The smart terminal encrypts the business authentication information provided by the live broadcast service platform and the identity information of the smart terminal through the authentication key and sends them to the live broadcast service platform. The live broadcast service platform completes the security verification of the smart terminal through decryption and comparison.

2. The method for providing a secure live broadcast service via a trusted zone by an intelligent terminal according to claim 1, characterized in that: A secure area virtual CPU and a non-secure area virtual CPU are divided on the physical chip of the smart terminal, and hardware isolation is established by forming virtual CPU isolation; a secure storage area is designated for the physical memory of the smart terminal, and an independent instruction set and access mechanism are used, and the access mechanism is integrated into the secure operating system as a unique module.

3. The method for providing a secure live broadcast service via a trusted zone by an intelligent terminal according to claim 1, characterized in that: The security zone is pre-installed with a platform mutual trust program for communication between smart terminals and live broadcast service platforms, a terminal authentication program for communicating with the live broadcast service platform and establishing mutual trust between the live broadcast service platform and the smart terminals, and a live broadcast service program for providing users with a live broadcast channel display page and providing live channel playback services; the live broadcast business services include live broadcast playback services and upgrading live broadcast playback programs, and the live broadcast playback services include providing live channel display pages and providing live channel playback services.

4. The method for providing a secure live broadcast service via a trusted zone by an intelligent terminal according to claim 3, characterized in that: The smart terminal sends a request to establish mutual trust to the live broadcast service platform through the platform mutual trust program, and the live broadcast service platform returns the trusted certificate of the live broadcast service platform to the platform mutual trust program of the smart terminal, and the smart terminal reads the obtained trusted certificate through the platform mutual trust program; The trusted certificate contains first plaintext information representing the identity information of the live broadcast service platform. The first plaintext information uses a hash function to form a first information summary and is encrypted by a first private key as a platform certificate signature of the live broadcast service platform.

5. The method for providing a secure live broadcast service via a trusted zone by an intelligent terminal according to claim 4, characterized in that: The smart terminal is pre-installed with a communication public key as the first public key. After receiving the trusted certificate, the smart terminal completes the legitimacy authentication of the trusted certificate of the live broadcast service platform through the first public key; the smart terminal uses the same hash function as the live broadcast service platform to calculate the information summary in the trusted certificate through the platform mutual trust program; The smart terminal uses the preset communication public key to decrypt the platform certificate signature in the trusted certificate through the platform mutual trust program. The smart terminal compares the result of decrypting the communication public key with the information summary calculated by using the same hash function as the live broadcast service platform. After the smart terminal completes the trust verification of the trusted certificate, the platform legal verification storage bit reserved in the security zone records the legal verification result.

6. The method for providing a secure live broadcast service by a smart terminal through a trusted zone according to claim 5, characterized in that: The business authentication information and authentication key are respectively used as the second public key and the second private key used by the live broadcast service platform to authenticate the legitimacy of the smart terminal. The smart terminal uses a hash function to form a second information summary of the business authentication information provided by the live broadcast service platform and the second plaintext information representing the identity information of the smart terminal and encrypts it with the second private key. The live broadcast service platform uses the second public key for trust verification.

7. The method for providing a secure live broadcast service by a smart terminal through a trusted zone according to claim 6, characterized in that: When the user starts the live broadcast service, the live broadcast service program first checks the Root ID of the non-secure zone. If the Root ID of the non-secure zone is changed, it means that the operating system of the non-secure zone has been changed, and the smart terminal refuses to provide the live broadcast service. Then the verification result of the storage record in the platform legal verification storage bit is checked. If the verification result is legal, the live broadcast service platform verifies the smart terminal. Otherwise, the live broadcast service is refused. The live broadcast service platform verifies the smart terminal and verifies the result of the smart terminal verification. If the verification passes, the live broadcast service program obtains the live broadcast signal source from the live broadcast service platform according to the live broadcast business process and completes the live broadcast business service. Otherwise, the live broadcast business service will be refused.

8. The method for providing a secure live broadcast service by a smart terminal through a trusted zone according to claim 6, characterized in that: The first plaintext information includes: the validity period of the certificate, the certificate serial number and the live broadcast service platform code that issued the live broadcast service platform certificate; the second plaintext information includes: the smart terminal identity and the smart terminal MAC address; the smart terminal is provided with a unique smart terminal identity, and the business authentication information is used as the unique identifier of the user in the live broadcast service platform, and the business authentication information is identified by a group of numbers, letters or a combination of letters / numbers; the live broadcast service platform generates an authentication key for the smart terminal, and each authentication key is not repeated with each other, and the authentication key is uniquely bound to the business authentication information of the live broadcast business platform and the smart terminal.

9. A system for providing secure live broadcast service via a trusted zone by an intelligent terminal, characterized in that: include: The live broadcast service platform authentication module is used for the smart terminal to authenticate the live broadcast service platform. A communication public key is preset in the smart terminal. After the smart terminal initiates a mutual trust request to the live broadcast service platform, the live broadcast service platform issues a trusted certificate to the smart terminal. The trusted certificate contains an encrypted platform certificate signature. After the smart terminal receives the trusted certificate, it completes the trust verification of the trusted certificate through the communication public key. The smart terminal verification module is used by the live broadcast service platform to verify the smart terminal. The live broadcast service platform provides business authentication information for the smart terminal. The live broadcast service platform is also allocated with an authentication key for authenticating the identity of the smart terminal. The smart terminal encrypts the business authentication information provided by the live broadcast service platform and the identity information of the smart terminal with the authentication key and sends them to the live broadcast service platform. The live broadcast service platform completes the security verification of the smart terminal through decryption and comparison. The smart terminal trusted zone construction module is used to divide the hardware level of the smart terminal into a secure zone and a non-secure zone. A secure operating system is independently set up in the secure zone to form the smart terminal trusted zone. The smart terminal authenticates the live broadcast service platform and the live broadcast service platform verifies that the smart terminal's programs and related data information storage as well as the live broadcast business services are all running in the smart terminal trusted zone.

10. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for providing a secure live broadcast service through a trusted zone by a smart terminal as described in any one of claims 1 to 8 is implemented.

Images