Mobile phone TEE-based authentication code protection method and electronic equipment
By encrypting the storage of authentication codes in mobile phone TEE, the traditional SMS authentication verification method has solved the shortcomings in security and convenience, and the secure and fast authentication code protection of user identity authentication is achieved, preventing malicious attacks, and improving Security of user authentication.
Patent Information
- Application Number
- CN202411495123.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-24
- Publication Date
- 2025-01-10
AI Technical Summary
The traditional SMS authentication verification method has shortcomings in terms of security and convenience, and it is difficult to achieve the security and fast user identity authentication.
The authentication code protection method based on mobile phone TEE is adopted, and the authentication code is encrypted and stored in TEE through the interaction between SDK and TEE. The security of TEE is used to prevent malicious applications from obtaining authentication codes, and improve the security of user authentication.
Effectively prevent malicious attacks, improve the security of user authentication, ensure that the authentication code is not illegally obtained, and enhance the security and convenience of user identity authentication.
Smart Images
Figure CN119300032A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of Internet technology, and in particular relates to an authentication code protection method and electronic device based on mobile phone TEE. Background Art
[0002] With the explosive growth of mobile Internet applications, identity recognition of hundreds of millions of users, secure and reliable user authentication, and legal use of network resources have gradually become difficult problems to solve in the development of mobile Internet.
[0003] Traditional SMS authentication and verification methods have deficiencies in security and convenience. How to achieve user identity authentication both safely and quickly has become an urgent problem to be solved in the development of mobile Internet.
[0004] Based on the above problems, the authentication code protection method and electronic device based on mobile phone TEE of the present application are proposed. Summary of the invention
[0005] In order to solve the deficiencies of the prior art, the present application provides an authentication code protection method and electronic device based on mobile phone TEE, which solves the problem of low security in mobile phone user authentication in the prior art.
[0006] The technical effects to be achieved by this application are achieved through the following solutions: In a first aspect, the present application provides an authentication code protection method based on mobile phone TEE, the method comprising: The user initiates a pre-number request to the SDK backend server through the SDK; The SDK backend server receives the pre-number request through the queryCode interface, queries the corresponding authentication server address through the public network IP after verification, returns retUrl after the call is successful, and returns the retUrl to the SDK; After receiving the retUrl, the SDK requests the number authentication system to obtain the authentication code based on the retUrl; After obtaining the authentication code, the SDK interacts with the TEE, seals the authentication code into the TEE, obtains the encrypted authentication code from the TEE and sends the encrypted authentication code to the SDK backend server; The SDK backend server generates an accessCode based on the pcode received from the number authentication system, and returns the accessCode and the mobile phone number mask received from the number authentication system to the SDK; The SDK calls the TA interface to seal the accessCode into the TEE. After successfully sealing the accessCode, the SDK requests the application APP to pull up the authorization page to ask the user for authorization; After the user confirms the authorization, he / she requests the SDK to replace the number. The SDK calls the TA interface to obtain the accessCode from the TEE, and uses the accessCode to obtain the mobile phone number from the number authentication system; The application APP displays the login result to the user.
[0007] In some embodiments, the user initiates a pre-number request to the SDK backend server through the SDK, including: The user initiates a pre-number acquisition request to the application APP on the mobile phone; The application APP calls the SDK pre-number acquisition method; The SDK performs identity authentication with the TEE. After the TEE loads and authenticates the TA, the SDK establishes a secure connection with the TA. The SDK sends the pre-number request to the SDK background service.
[0008] In some embodiments, the obtaining the mobile phone number from the number authentication system using the accessCode includes: The SDK returns the accessCode to the application APP; The application APP sends the accesscode to the application APP server; The application APP server sends the accesscode to the SDK backend server; The SDK backend server obtains the pcode based on the accessCode; The SDK backend server sends the pcode to the number authentication system; The number authentication system obtains the corresponding mobile phone number based on the pcode and returns the mobile phone number to the SDK backend server; The SDK backend server returns the mobile phone number to the application APP server.
[0009] In some embodiments, before the application APP displays the login result to the user, it includes: The SDK backend server returns the login result to the application APP.
[0010] In some embodiments, sealing the authentication code into the TEE includes: The authentication code is encrypted using a sealed private key, and the encrypted authentication code is stored in the TEE, and the sealed private key is only known to the SDK.
[0011] In some embodiments, the retUrl is an authentication service redirection link.
[0012] In some embodiments, the authentication server address has two types: 4G or 5G, where 4G is a regional authentication server and 5G is a header enhancement server.
[0013] In some embodiments, the pre-number request includes a request to verify login information.
[0014] In a second aspect, the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any one of the methods described above when executing the computer program.
[0015] In a third aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any of the methods described above.
[0016] The authentication code protection method and electronic device based on mobile phone TEE provided in the embodiment of the present application implement user authentication by using TEE, so that malicious applications cannot obtain the authentication code by illegal means, thereby implementing the protection of the authentication code, avoiding malicious attacks, and improving the security of user authentication. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] In order to more clearly illustrate the embodiments of the present application or the existing technical solutions, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0018] Figure 1 This is a flow chart of an authentication code protection method based on mobile phone TEE in one embodiment of the present application; Figure 2 This is a specific implementation diagram of the authentication code protection method based on mobile phone TEE in one embodiment of the present application; Figure 3 It is a schematic block diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION
[0019] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.
[0020] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present application should be understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in one or more embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.
[0021] In the related technology, the operator number authentication service is an important part of Internet authentication and login. In essence, it obtains the user's mobile phone number in the operator network and enables the connected application to obtain the user's mobile phone number through relevant processes. The user carries the specified parameters to access the number portal server. The portal server routes according to the user's public network address. If it fails, it returns an exception. If it succeeds, it redirects to the authentication server url. The authentication server returns the authentication code and automatically redirects to the retUrl specified by the merchant. At the same time, the authentication server files the authentication code and user number information to the number gateway. The merchant obtains the authentication code through the service deployed on retUrl, and uses the authentication code to query the number gateway for user number information. The number gateway returns the user number information.
[0022] At present, there are many attack methods against one-click login technologies based on protocols such as OpenID and OAuth, such as man-in-the-middle attack, reply attack, phishing, network eavesdropping, etc. The business process of operator number acquisition is similar, so it is also necessary to guard against related attacks.
[0023] In the "phishing" scenario, malicious applications obtain user tokens through illegal means to carry out attacks. The authorization server will forward the authorization code and access token to the address corresponding to retUrl. If the attacker forges the address corresponding to retUrl and induces the user to send a request, the authorization credential will be returned to the forged address by the attacker, thus carrying out the attack.
[0024] To prevent the risk of "phishing" attacks on this service, the operator's number acquisition platform has designed the following security strategies: 1. The authentication code generated by the number-taking platform contains the information of the user and the application, and only supports the user's use of the application to prevent the authentication code from being illegally used after being leaked; 2. When the user uses the authentication code to obtain a number, the application software adopts a common list-based filtering method to verify whether the user's IP is in the whitelist, and at the same time verify whether the user's signature information is correct to ensure legal calls.
[0025] This security policy can ensure the safe use of authentication codes. Based on these security policies, this paper adopts an enhanced authentication code protection strategy, which is mainly enhanced by using TEE.
[0026] Relevant mobile phone manufacturers have an area called TEE on the CPU of the mobile phone. The full name of TEE is Trusted Execution Environment, which is an area on the CPU of the mobile device. The function of this area is to provide a more secure space for the execution of data and code, and to ensure the confidentiality of data and code (no one can access the data) and integrity (no one can change the code and its behavior). Multiple trusted applications (Trusted Application (TA)) can run simultaneously in TEE. The GP (Global Platform) specification defines the isolation between TAs. The content encrypted by each TA is only allowed to be decrypted and accessed by the current TA. TEE is a good solution for storing and managing device encryption keys, which can be used to verify the integrity of the system.
[0027] To ensure the security of the authentication code, this application uses the TEE built into the mobile phone for security enhancement. At the hardware level, the authentication SDK provides the system with the ability to store authentication codes in TEE, achieving physical isolation of authentication codes; at the system software level, when initiating the number authentication, it will automatically detect whether the initiating environment is safe and reliable, and obtain the authentication code from TEE when initiating the number authentication. At the same time, the number authentication process only occurs between the user, application, and authentication service.
[0028] By using TEE, malicious applications cannot obtain the authentication code through illegal means, thereby achieving the protection of the authentication code and preventing malicious programs from using the authentication code to attack.
[0029] The main goal of TEE software architecture is to provide isolation and trust capabilities for TA. Applications can be implemented by running CA (Client App) program calls on the REE side. TEE is an independent processing environment with computing and storage functions that can provide security and integrity protection. Its basic idea is to allocate an isolated memory for sensitive data in the hardware. All sensitive data calculations are performed in this memory, and other parts of the hardware cannot access the information in this isolated memory except for authorized interfaces, so as to achieve the protection and calculation of sensitive data; REE (Rich Execution Environment) refers to the environment when the operating system is running. It can run general OS (Opreating System) such as Android and IOS. REE is an open environment that is vulnerable to attacks, such as the theft of sensitive data, theft of mobile payments, etc.; TA is the abbreviation of Trusted Application, and applications that usually run in the TEE environment are referred to as TA. It can be seen that TEE is a secure area on the central processor that can ensure that sensitive data is processed in an isolated and trusted environment, thereby protecting it from software attacks in REE. In addition, compared with other secure execution environments, TEE can protect the integrity and confidentiality of TA (Trusted Application) end-to-end, and can provide stronger processing power and larger memory space.
[0030] Various non-limiting implementations of the present application are described in detail below in conjunction with the accompanying drawings.
[0031] First, refer to Figure 1 , the authentication code protection method based on mobile phone TEE of the present application is described in detail. The present application provides an authentication code protection method based on mobile phone TEE, the method comprising: S1: The user initiates a pre-number request to the SDK backend server through the SDK; In some embodiments, the user initiates a pre-number request to the SDK backend server through the SDK, including: The user initiates a pre-number acquisition request to the application APP on the mobile phone; The application APP calls the SDK pre-number acquisition method; The SDK performs identity authentication with the TEE. After the TEE loads and authenticates the TA, the SDK establishes a secure connection with the TA. The SDK sends the pre-number request to the SDK background service.
[0032] S2: The SDK backend server receives the pre-number request through the queryCode interface, queries the corresponding authentication server address through the public network IP after verification, returns retUrl after the call is successful and returns the retUrl to the SDK; exemplarily, there are two types of authentication server addresses: 4G or 5G, where 4G is a regional authentication server and 5G is a header enhancement server, where the region can correspond to different provinces.
[0033] Specifically, the retUrl may be an authentication service redirection link.
[0034] S3: After receiving the retUrl, the SDK requests the number authentication system to obtain the authentication code based on the retUrl; S4: After obtaining the authentication code, the SDK interacts with the TEE, seals the authentication code into the TEE, obtains the encrypted authentication code from the TEE and sends the encrypted authentication code to the SDK backend server; Specifically, in some embodiments, sealing the authentication code into the TEE includes: The authentication code is encrypted using a sealed private key, and the encrypted authentication code is stored in the TEE, and the sealed private key is only known to the SDK.
[0035] S5: The SDK backend server generates an accessCode based on the pcode received from the number authentication system, and returns the accessCode and the mobile phone number mask received from the number authentication system to the SDK; S6: The SDK calls the TA interface to seal the accessCode into the TEE. After successfully sealing the accessCode, the SDK requests the application APP to pull up the authorization page to ask the user for authorization; S7: After the user confirms the authorization, he requests the SDK to replace the number; S8: The SDK calls the TA interface to obtain the accessCode from the TEE, and uses the accessCode to obtain the mobile phone number from the number authentication system; In some embodiments, the obtaining the mobile phone number from the number authentication system using the accessCode includes: The SDK returns the accessCode to the application APP; The application APP sends the accesscode to the application APP server; The application APP server sends the accesscode to the SDK backend server; The SDK backend server obtains the pcode based on the accessCode; The SDK backend server sends the pcode to the number authentication system; The number authentication system obtains the corresponding mobile phone number based on the pcode and returns the mobile phone number to the SDK backend server; The SDK backend server returns the mobile phone number to the application APP server.
[0036] S9: The application APP displays the login result to the user.
[0037] In some embodiments, before the application APP displays the login result to the user, it includes: The SDK backend server returns the login result to the application APP.
[0038] This method uses TEE to implement user authentication, making it impossible for malicious applications to obtain authentication codes through illegal means, thereby protecting the authentication codes, avoiding malicious attacks, and improving the security of user authentication.
[0039] According to the following Figure 2 Another embodiment of the present application is described in detail: This application uses TEE to run the authentication TA to achieve enhanced protection of the authentication code, such as Figure 2 The process shown is as follows: 1. The user initiates a pre-number request to an APP on the mobile phone; 2. The application APP calls the operator authentication SDK to pre-obtain the number method; 3. The SDK performs identity authentication with the mobile phone's TEE, TEE loads and authenticates TA (i.e. TEE&TA), and the SDK establishes a secure connection with TA; 4. The authentication SDK initiates a pre-number request to the SDK backend server, requesting the queryCode interface through an https connection; 5. The queryCode interface of the SDK backend server receives the request to verify the login information. After the verification is passed, the corresponding regional authentication server address (for example, the provincial authentication server address) is queried through the public network IP. After the call is successful, retUrl is returned to the authentication SDK, where retUrl is the authentication service redirection link; there are two types of authentication server addresses: 4G and 5G, where 4G is a regional authentication server and 5G is a header enhancement server; 6. After the SDK obtains retUrl, it requests the number authentication system to obtain the authentication code token based on retUrl; 7. After receiving the request, the number authentication system returns the authentication code (token) to the SDK; 8. The authentication service SDK requests the authentication TA interface and seals the token into the TEE. The sealing operation is essentially an encryption operation, which is performed using the private key used for sealing. The private key is unique to the authentication service SDK, TEE, and enclave, and no other entity knows the private key. 9. SDK obtains token through TA interface; 10. After obtaining the token, the SDK sends a request to the SDK backend server with the token; 11. The SDK backend server carries the token to request the number authentication system; 12. After the number authentication system obtains the token and confirms that it is correct, it returns the pcode and mobile phone number mask to the SDK backend server; 13. After the SDK backend server receives the token and confirms that it is correct, it generates an accessCode through the pcode; 14. The SDK backend server returns the phone number mask and accessCode to the SDK; 15. SDK calls TA interface to seal accessCode into TEE; 16. After successfully saving the accessCode, request the app to pull up the authorization page and ask the user to authorize; 17. The application APP displays the authorization page to the user; 18. After the user confirms the authorization, he / she requests the authentication SDK to replace the mobile phone number; 19. SDK accesses TA to obtain accessCode; 20. The SDK returns the accessCode to the app; 21. The application APP carries the access code to request the application APP server; 22. The APP server carries the access code to request the SDK backend server, that is, the access code is used to replace the mobile phone number; 23. The SDK backend server obtains the pcode through the accessCode; 24. The SDK backend server carries the pcode to request the number authentication system; 25. The number authentication system obtains the mobile phone number (i.e. the real mobile phone number) through pcode and returns the mobile phone number to the SDK backend server; 26. The SDK backend server returns the mobile phone number to the APP server, indicating that the replacement is successful and the real mobile phone number is returned; 27. The SDK backend server returns the login result to the application APP; 28. The application APP displays the one-click login result to the user.
[0040] The authentication code protection method based on mobile phone TEE of the present application adds the TEE of authentication TA into the authentication code authentication system, and utilizes the protection characteristics of TEE to protect the confidentiality and integrity of the application and data; the REE side cannot obtain the authentication code information, thus avoiding the possibility of illegally obtaining the authentication code and improving security.
[0041] It should be noted that the method of one or more embodiments of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of one or more embodiments of the present application, and the multiple devices will interact with each other to complete the described method.
[0042] It should be noted that the above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0043] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also discloses an electronic device; Specifically, Figure 3 The hardware structure diagram of an electronic device of an authentication code protection method based on mobile phone TEE provided in this embodiment is shown, and the device may include: a processor 410, a memory 420, an input / output interface 430, a communication interface 440 and a bus 450. Among them, the processor 410, the memory 420, the input / output interface 430 and the communication interface 440 realize communication connection with each other inside the device through the bus 450.
[0044] The processor 410 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.
[0045] The memory 420 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 420 may store an operating system and other application programs. When the technical solution provided in the embodiment of the present application is implemented by software or firmware, the relevant program code is stored in the memory 420 and is called and executed by the processor 410.
[0046] The input / output interface 430 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.
[0047] The communication interface 440 is used to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (for example, USB, network cable, etc.) or a wireless mode (for example, mobile network, WIFI, Bluetooth, etc.).
[0048] The bus 450 includes a path that transmits information between the various components of the device (eg, the processor 410 , the memory 420 , the input / output interface 430 , and the communication interface 440 ).
[0049] It should be noted that, although the above device only shows the processor 410, the memory 420, the input / output interface 430, the communication interface 440 and the bus 450, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiment of the present application, and does not necessarily include all the components shown in the figure.
[0050] The electronic device of the above embodiment is used to implement the corresponding authentication code protection method based on mobile phone TEE in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.
[0051] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, one or more embodiments of the present application also provide a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the authentication code protection method based on mobile phone TEE as described in any of the above embodiments.
[0052] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.
[0053] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the authentication code protection method based on mobile phone TEE as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.
[0054] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.
[0055] In addition, to simplify the description and discussion, and in order not to make one or more embodiments of the present application difficult to understand, the well-known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided figures. In addition, the device may be shown in the form of a block diagram to avoid making one or more embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which one or more embodiments of the present application will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that one or more embodiments of the present application can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.
[0056] Although the present application has been described in conjunction with specific embodiments of the present application, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.
[0057] One or more embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application should be included in the scope of protection of the present application.
Claims
1. An authentication code protection method based on mobile phone TEE, characterized in that: The method comprises: The user initiates a pre-number request to the SDK backend server through the SDK; The SDK backend server receives the pre-number request through the queryCode interface, queries the corresponding authentication server address through the public network IP after verification, returns retUrl after the call is successful, and returns the retUrl to the SDK; After receiving the retUrl, the SDK requests the number authentication system to obtain the authentication code based on the retUrl; After obtaining the authentication code, the SDK interacts with the TEE, seals the authentication code into the TEE, obtains the encrypted authentication code from the TEE and sends the encrypted authentication code to the SDK backend server; The SDK backend server generates an accessCode based on the pcode received from the number authentication system, and returns the accessCode and the mobile phone number mask received from the number authentication system to the SDK; The SDK calls the TA interface to seal the accessCode into the TEE. After successfully sealing the accessCode, the SDK requests the application APP to pull up the authorization page to ask the user for authorization; After the user confirms the authorization, he / she requests the SDK to replace the number. The SDK calls the TA interface to obtain the accessCode from the TEE, and uses the accessCode to obtain the mobile phone number from the number authentication system; The application APP displays the login result to the user.
2. The authentication code protection method based on mobile phone TEE as claimed in claim 1, characterized in that: The user initiates a pre-number request to the SDK backend server through the SDK, including: The user initiates a pre-number acquisition request to the application APP on the mobile phone; The application APP calls the SDK pre-number acquisition method; The SDK performs identity authentication with the TEE. After the TEE loads and authenticates the TA, the SDK establishes a secure connection with the TA. The SDK sends the pre-number request to the SDK background service.
3. The authentication code protection method based on mobile phone TEE as described in claim 1 or 2, characterized in that: The obtaining the mobile phone number from the number authentication system using the accessCode includes: The SDK returns the accessCode to the application APP; The application APP sends the accesscode to the application APP server; The application APP server sends the accesscode to the SDK backend server; The SDK backend server obtains the pcode based on the accessCode; The SDK backend server sends the pcode to the number authentication system; The number authentication system obtains the corresponding mobile phone number based on the pcode and returns the mobile phone number to the SDK backend server; The SDK backend server returns the mobile phone number to the application APP server.
4. The authentication code protection method based on mobile phone TEE as claimed in claim 3 is characterized in that: Before the application APP displays the login result to the user, it includes: The SDK backend server returns the login result to the application APP.
5. The authentication code protection method based on mobile phone TEE as claimed in claim 1, characterized in that: The step of sealing the authentication code into the TEE comprises: The authentication code is encrypted using a sealed private key, and the encrypted authentication code is stored in the TEE, and the sealed private key is only known to the SDK.
6. The authentication code protection method based on mobile phone TEE as claimed in claim 1, characterized in that: The retUrl is the authentication service redirection link.
7. The authentication code protection method based on mobile phone TEE as claimed in claim 1, characterized in that: There are two types of authentication server addresses: 4G or 5G, where 4G is a regional authentication server and 5G is a header enhancement server.
8. The authentication code protection method based on mobile phone TEE as claimed in claim 1, characterized in that: The pre-number acquisition request includes request verification login information.
9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the computer program.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method according to any one of claims 1 to 8.