Access control method, terminal equipment and readable storage medium

Abstract

The invention provides an access control method, terminal equipment and a readable storage medium, the method is applied to the terminal equipment deployed with a real-time operating system (RTOS), and the terminal equipment comprises a first application, a storage application program interface (API) and a security environment module. In the method, a first application sends a first request to a storage API, the first request is used for requesting to access a secure environment module, the storage API verifies whether the first application has the authority to access the secure environment module, and when the first application has the authority to access the secure environment module, the first application accesses the secure environment module. In the application, in the terminal equipment deployed with the RTOS, a control method for the application to access the security environment module can be designed, the application without access authority can be prevented from accessing the security environment module, and the security of data in the security environment module is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of terminal security technology, and in particular, to an access control method, a terminal device, and a readable storage medium. Background Art

[0002] With the continuous development of communication technology, more and more applications are installed in terminal devices. In order to protect user privacy and information security, a trusted execution environment (TEE) can be created in the terminal device or hardware such as security chips can be set in the terminal device to deploy high-level and more reliable security protection for the terminal device.

[0003] Currently, in terminal devices deployed with a real-time operating system (RTOS), there is no design solution for access control of TEE and security chips, etc. Summary of the invention

[0004] The embodiments of the present application provide an access control method, a terminal device, and a readable storage medium, which are applied to the field of terminal technology. In a terminal device deployed with an RTOS, the embodiments of the present application design an access control method for security environment modules such as TEE and security chips, which can prevent applications without access rights from accessing the security environment modules, thereby improving the security of data in the security environment modules.

[0005] In the first aspect, the embodiment of the present application provides an access control method, which is applied to a terminal device deployed with a real-time operating system RTOS. The execution subject of the access control method can be the terminal device or a chip in the terminal device. The following description takes the terminal device as an example. The terminal device includes a first application, a storage application program interface API, and a security environment module, and the security environment module can provide a secure operating environment for the terminal device.

[0006] In some embodiments, the security environment module can be implemented in hardware, software, or a combination of hardware and software. Exemplarily, the security environment module includes: a trusted execution environment TEE, and / or security hardware, the security hardware being any of the following: a security chip, an embedded security chip, or a security processor.

[0007] In this method, the first application can request access to the security environment module. The first application can send a first request to the storage API, and the first request is used to request access to the security environment module. In the prior art, in a terminal device deployed with an RTOS, there is no design scheme for access control of TEE and security chips, etc. For example, all applications can access the security environment module, which will cause data security issues in the security environment module.

[0008] In an embodiment of the present application, the storage API may verify whether the first application has permission to access the security environment module in response to the first request. When the first application has permission to access the security environment module, the first application accesses the security environment module. When the first application does not have permission to access the security environment module, the storage API may prohibit the first application from accessing the security environment module. Exemplarily, the storage API may feedback a verification failure message to the first application, and the verification failure message is used to indicate that the first application does not have permission to access the security environment module.

[0009] In a possible implementation manner, the first application accessing the security environment module includes: the first application storing data or reading data in the security environment module, or the first application accessing a trusted application TA in the security environment module.

[0010] In some embodiments, the storage API may be an interface called by an application to access a secure environment module. In some embodiments, the storage API may be, for example, a TF-M interface, a psa_ps_create interface, or a psa_ps_set interface, etc. The embodiments of the present application do not limit this.

[0011] In an embodiment of the present application, in a terminal device deployed with an RTOS, the storage interface can perform permission verification on applications that access the security environment module, and when the application has permission to access the security environment module, the application is allowed to access the security environment module; when the application does not have permission to access the security environment module, the application is not allowed to access the security environment module. In an embodiment of the present application, access control to the security environment module can be implemented, which can prevent applications that do not have access permissions from accessing the security environment module, thereby improving the security of data in the security environment module.

[0012] In a possible implementation, the storage API is configured with a mapping relationship between applications and permissions, and the mapping relationship includes the first application and the permissions possessed by the first application. In some embodiments, the permissions possessed by the application can be configured before the terminal device leaves the factory. In some embodiments, the terminal device can download a configuration file when it is first started, and the configuration file can include the permissions possessed by the application. This embodiment of the application does not limit this.

[0013] The storage API may query the mapping relationship in response to the first request to verify whether the first application has permission to access the security environment module.

[0014] In one possible scenario, when the first application accesses the security environment module to store data in the security environment module, the first request is specifically used to request to store data in the security environment module. In this scenario, the first request includes an identifier of the first application and the first data to be stored by the first application.

[0015] The following describes the process of storing data in a secure environment for the first application:

[0016] Method 1: Generate a key by using a storage API and encrypt the first data.

[0017] The storage API can generate a first key in response to the first request, and use the first key to encrypt the first data to obtain a first ciphertext. In the embodiment of the present application, because the first application requests to store the first data in the security environment module, compared with the method in which the security environment module directly stores plain text (such as the first data), the method in which the security environment module stores ciphertext has higher security. Therefore, in the embodiment of the present application, the method in which the storage API generates a key and encrypts the first data can improve the data security in the security environment module.

[0018] After the storage API obtains the first ciphertext, it can send a first indication to the security environment module, and the first indication includes the identifier of the first application and the first ciphertext. In some embodiments, after the storage API obtains the first ciphertext, it can directly send the identifier of the first application and the first ciphertext to the security environment module. The security environment module stores the identifier of the first application and the first ciphertext in correspondence.

[0019] The first application can store multiple types of data in the security environment module. In order to distinguish different types of data, the security environment module can store the identifier of the first data. For example, taking the first data as the unlock password 123, the identifier of the first data can be "unlock password".

[0020] In some embodiments, in order to ensure the security of the identifier of the first data, the storage API may also use the first key to encrypt the identifier of the first data to obtain a second ciphertext.

[0021] In some embodiments, the storage API can generate a third key, and use the third key to encrypt the identifier of the first data to obtain a second ciphertext. The third key is different from the first key. In an embodiment of the present application, the storage API can encrypt the first data and the identifier of the first data with different encryption keys, which can avoid the reproduction of the key and further improve the security of the first data and the identifier of the first data in a secure environment.

[0022] In the case where the storage API obtains the second ciphertext, in some embodiments, the first indication specifically includes the identifier of the first application, the first ciphertext, and the second ciphertext. Alternatively, in some embodiments, the storage API may directly send the identifier of the first application, the first ciphertext, and the second ciphertext to the security environment module. Accordingly, the security environment module stores the identifier of the first application, the first ciphertext, and the second ciphertext accordingly.

[0023] In the embodiment of the present application, in the scenario where the application needs to store data in the security environment module, the storage interface can obtain the identification of the application, and the identification of the application can facilitate the security environment module to identify the data of different applications. In addition, the storage interface can also generate a key to encrypt the application data and the identification of the data, so as to ensure the security of the data.

[0024] In a possible implementation, different applications having access to the secure environment module can request to store data in the secure environment module. Exemplarily, the terminal device further includes a second application, and the second application can request to store data in the secure environment module.

[0025] The second application sends a second request to the storage API, the second request is used to request access to the security environment module, and the second request includes an identifier of the second application and second data to be stored by the second application. The storage API verifies whether the second application has permission to access the security environment module. When the second application has permission to access the security environment module, the storage API can generate a second key and use the second key to encrypt the second data to obtain a third ciphertext. The second key is different from the first key.

[0026] The storage API sends a second indication to the security environment module, wherein the second indication includes the identifier of the second application and the third ciphertext. In some embodiments, the storage API may directly send the identifier of the second application and the third ciphertext to the security environment module. Accordingly, the security environment module stores the identifier of the first application and the third ciphertext in correspondence.

[0027] Similarly, in some embodiments, in order to ensure the security of the identifier of the second data, the storage API may also use the second key to encrypt the identifier of the second data to obtain a fourth ciphertext.

[0028] In some embodiments, the storage API may generate a fourth key, and use the fourth key to encrypt the identifier of the second data to obtain a fourth ciphertext, wherein the fourth key is different from the second key.

[0029] In the case where the storage API obtains the fourth ciphertext, in some embodiments, the second indication specifically includes the identifier of the first application, the first ciphertext, and the fourth ciphertext. Alternatively, in some embodiments, the storage API may directly send the identifier of the first application, the first ciphertext, and the fourth ciphertext to the security environment module. Accordingly, the security environment module stores the identifier of the first application, the first ciphertext, and the fourth ciphertext accordingly.

[0030] In an embodiment of the present application, the keys generated by the storage interface may be different for different applications, so that the security environment module can distinguish the identifiers of data of different applications based on the identifiers of the encrypted data, so that when the identifiers of data of different applications are the same, the security environment module can also distinguish the data of different applications.

[0031] It should be understood that the method of generating key encrypted data by storing API in method 1 can be applicable to the following scenarios: the security environment module includes: trusted execution environment TEE, and / or security hardware, the security hardware is any of the following: security chip, embedded security chip or security processor.

[0032] Method 2: When the security environment is a trusted execution environment (TEE), TEE can generate keys and encrypt data. Compared with the storage API, the security environment module is more secure. Therefore, compared with method 1, the method of generating keys and encrypting data by TEE in method 2 is more secure.

[0033] In this manner, the storage API may send a first indication to the security environment module in response to a first request from a first application, wherein the first indication includes an identifier of the first application and the first data. In some embodiments, the storage API may directly send the identifier of the first application and the first data to the security environment module in response to a first request from the first application.

[0034] The security environment module may generate a first key, and use the first key to encrypt the first data to obtain a first ciphertext. The security environment module may store the identifier of the first application and the first ciphertext in correspondence.

[0035] In some embodiments, in order to ensure the security of the identifier of the first data, the security environment module uses the first key to encrypt the identifier of the first data to obtain a second ciphertext.

[0036] In some embodiments, the security environment module generates a third key, and uses the third key to encrypt the identifier of the first data to obtain a second ciphertext, and the third key is different from the first key. In an embodiment of the present application, the security environment module can encrypt the first data and the identifier of the first data with different encryption keys, which can avoid the reproduction of the key and further improve the security of the first data and the identifier of the first data in the security environment.

[0037] In this embodiment, the security environment module may store the identifier of the first application, the first ciphertext, and the second ciphertext in correspondence.

[0038] In a possible implementation, different applications having access to the secure environment module can request to store data in the secure environment module. Exemplarily, the terminal device further includes a second application, and the second application can request to store data in the secure environment module.

[0039] Wherein, the second application may send a second request to the storage API, the second request being used to request access to the security environment module, the second request including the identifier of the second application and the second data to be stored by the second application. The storage API verifies whether the second application has permission to access the security environment module. Wherein, when the second application has permission to access the security environment module, the storage API sends a second indication to the security environment module, the second indication including the identifier of the second application and the second data. In some embodiments, when the second application has permission to access the security environment module, the storage API may directly send the identifier of the second application and the second data to the security environment module.

[0040] The security environment module may generate a second key and use the second key to encrypt the second data to obtain a third ciphertext, wherein the second key is different from the first key. The security environment module stores the identifier of the second application and the third ciphertext in correspondence.

[0041] Similarly, in some embodiments, in order to ensure the security of the identifier of the second data, the security environment module may also use the second key to encrypt the identifier of the second data to obtain a fourth ciphertext.

[0042] In some embodiments, the security environment module may generate a fourth key, and use the fourth key to encrypt the identifier of the second data to obtain a fourth ciphertext, wherein the fourth key is different from the second key.

[0043] When the security environment module obtains the fourth ciphertext, the security environment module stores the identifier of the first application, the first ciphertext, and the fourth ciphertext in correspondence.

[0044] In an embodiment of the present application, the secret keys generated by the security environment module may be different for different applications, so that the security environment module can distinguish the identifiers of data of different applications based on the identifiers of the encrypted data, so that when the identifiers of data of different applications are the same, the security environment module can also distinguish the data of different applications.

[0045] After the first application stores the first data in the security environment module, the first application can read the first data from the security environment module. Similarly, after the second application stores the second data in the security environment module, the second application can read the second data from the security environment module. The following describes the process of the first application reading the first data from the security environment module. The second application can refer to the relevant description of the first application:

[0046] Method 1: The storage API generates a key and encrypts the data.

[0047] In mode 1, when the first application reads the first data from the security environment module, the first application sends a third request to the storage API, and the third request is used to request the first data. In some embodiments, the third request includes an identifier of the first application. In some embodiments, the third request may include an identifier of the first data.

[0048] In response to the third request, the storage API may send a third indication to the security environment module, wherein the third indication includes the identifier of the first application. In response to the third indication, the security environment module may send a first ciphertext to the storage API according to the identifier of the first application.

[0049] In some embodiments, a first key may be stored in the storage API, so that the storage API uses the first key to decrypt the first ciphertext to obtain the first data, and the storage API sends the first data to the first application.

[0050] Method 2: The security environment module generates keys and encrypts data.

[0051] In the second mode, when the first application reads the first data from the security environment module, the first application may send a third request to the storage API, and the third request is used to request the first data. In some embodiments, the third request includes an identifier of the first application. In some embodiments, the third request may include an identifier of the first data.

[0052] In response to the third request, the storage API may send a third indication to the security environment module, wherein the third indication includes the identification of the first application. In some embodiments, the security environment module may store a first key, so that in response to the third indication, the security environment module may use the first key to decrypt the first ciphertext according to the identification of the first application to obtain the first data. The security environment module sends the first data to the storage API, and the storage API sends the first data to the first application.

[0053] In an embodiment of the present application, using method one or method two, the first application can read correct data from the security environment module, even if the first data of the first application and the second data of the second application are the same, because the security environment module can store the data and the application identifier, as well as the data identifier in correspondence when storing the first data and the second data, the security environment module can distinguish the data of different applications. Therefore, even if the first data of the first application and the second data of the second application are the same, the security environment module can distinguish the data of different applications and then feedback the correct data to the application.

[0054] In a second aspect, an embodiment of the present application provides a terminal device, which may also be referred to as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc. The terminal device may be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc.

[0055] The terminal device comprises: a processor and a memory; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory, so that the terminal device executes the method of the first aspect.

[0056] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the method of the first aspect is implemented.

[0057] In a fourth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes the method of the first aspect.

[0058] In a fifth aspect, an embodiment of the present application provides a chip, the chip including a processor, the processor being used to call a computer program in a memory to execute the method described in the first aspect.

[0059] It should be understood that the second to fifth aspects of the present application correspond to the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0061] Figure 2 Another schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0062] Figure 3 A schematic diagram of storing and reading data in a secure environment module for an application;

[0063] Figure 4 A flowchart of an embodiment of an access control method provided in an embodiment of the present application;

[0064] Figure 5 A flowchart of another embodiment of the access control method provided in the embodiment of the present application;

[0065] Figure 6 A flowchart of another embodiment of the access control method provided in the embodiment of the present application;

[0066] Figure 7 A flowchart of another embodiment of the access control method provided in the embodiment of the present application;

[0067] Figure 8 A flowchart of another embodiment of the access control method provided in the embodiment of the present application;

[0068] Fig. 9 A flowchart of another embodiment of the access control method provided in the embodiment of the present application;

[0069] Fig.10A flowchart of another embodiment of the access control method provided in the embodiment of the present application;

[0070] Fig.11 Another schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0071] Fig.12 A schematic diagram of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] In the description of the embodiments of the present application, the terms used in the following embodiments are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and the appended claims of the present application, the singular expressions "a", "said", "above", "the" and "this" are intended to also include such expressions as "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the following embodiments of the present application, "at least one", "one or more" refer to one or more (including two). The term "and / or" is used to describe the association relationship of associated objects, indicating that three relationships can exist; for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are a kind of "or" relationship.

[0073] References to "one embodiment" or "some embodiments" etc. described in this specification mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Thus, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways. The term "connection" includes direct connection and indirect connection, unless otherwise specified. "First" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated.

[0074] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0075] With the development of communication technology, terminal devices have higher requirements for the security of the business operating environment when processing business. In order to protect user privacy and information security, a rich execution environment (REE) and a trusted execution environment (TEE) can be set in the terminal device. Among them, REE can be called a normal execution environment, and the rich execution environment operating system (REE OS) and client application (CA) on a general-purpose processor can run in REE. TEE can be called a secure execution environment, which can run a trusted execution environment operating system (TEE OS). TEE can also provide CA with trusted security services (such as fingerprint matching services, password verification services, face matching services, secure payment services, etc.), which can be run in the form of trusted applications (TA) in TEE OS. In some embodiments, TEE can be an execution area constructed using a secure area of ​​a processor in a terminal device, and a trusted execution environment can provide a secure operating environment for the business.

[0076] In some embodiments, the terminal device can use TrustZone technology to establish TEE in the trust zone, so that the confidentiality and integrity of the code and data loaded in the TEE can be protected. In some embodiments, unlike the implementation of TEE based on TrustZone technology, virtualization is a technology that runs multiple operating systems on the same terminal device. The terminal device can establish TEE on a virtual machine so that TEE can provide a secure business operating environment for business execution. The construction method of TEE is not limited in the embodiments of this application.

[0077] In some embodiments, an operating system (OS) may be deployed in a terminal device, and an OS may include, for example, but is not limited to, an Android system, an IOS system, and a Windows operating system. In some embodiments, a real-time operating system (RTOS) may be deployed in a terminal device. Compared to an OS, an RTOS is an operating system for more professional applications (APPs), and these more professional applications require real-time response. The most significant difference between an OS and an RTOS is how they complete each business, wherein an OS focuses on performing as many calculations as possible in the shortest time, while an RTOS focuses on responding in the shortest time. In the embodiments of this application, an OS and an RTOS are not described in detail.

[0078] In some embodiments, APP can be understood as a client application CA, and an application program can be referred to as an application for short. The following embodiments are described by taking the terminal device including APP as an example.

[0079] In some embodiments, the access control method provided in the embodiments of the present application can be applied to terminal devices deployed with RTOS and TEE. Exemplarily, the terminal device may be a watch, a portable android device (PAD), a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device, a vehicle-mounted device or a wearable device, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in a smart home, etc. The form of the terminal device is not specifically limited in the embodiments of the present application. The following embodiments are described by taking a watch as an example.

[0080] Figure 1 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application. Figure 1 The software system of the terminal device can adopt a layered architecture, which can divide the software system of the terminal device into several layers, each layer has a clear role and division of labor, and the layers can communicate with each other through software interfaces. It should be understood that the embodiments of the present application do not limit the layering of the software structure of the terminal. Figure 1 The modules included in each layer are the modules involved in the embodiments of the present application. Figure 1The modules included in each layer do not constitute a limitation on the structure of the terminal device, and the level of module deployment (example description) does not constitute a limitation on the structure of the terminal device.

[0081] In some embodiments, the terminal device deployed with RTOS may include: an application-related layer and a system-related layer. In some embodiments, the application-related layer may be, for example, an application framework written in JavaScript (JS) language, which may be referred to as JS application framework.

[0082] In some embodiments, the application-related layers may include: an application layer, a runtime layer, and an application framework layer. In some embodiments, the application layer, the runtime layer, and the application framework layer may be written in JS language. Exemplarily, the application layer may be, for example, a JS application layer, the runtime layer may be, for example, a JS runtime layer, and the application framework layer may be, for example, a JS framework.

[0083] The application layer may include application packages. In some embodiments, the application layer may include application packages of third-party applications. Third-party applications may include, but are not limited to: social applications, sports and health applications, video applications, payment applications, and audio applications. It should be understood that Figure 1 In the example, the application layer includes APP1, APP2, ..., and APPN.

[0084] In some embodiments, the application in the application layer can run the application by calling an application programming interface (API) provided by the application framework layer.

[0085] The runtime layer is used to support the parsing and execution of application code.

[0086] The application framework layer can provide an API and a programming framework for the application of the application layer. In some embodiments, the application framework layer can include some predefined functions. Figure 1 As shown, the application framework layer may include: a user interface component adapter (UI component adapter) and an application program interface adapter (API adapter).

[0087] In some embodiments, the UI component adapter is used to assist applications in the application program layer to call UI-related components or tools in the system-related layer to assist the application in completing the drawing, rendering and display of the UI.

[0088] In some embodiments, an API adapter is used to assist an application in the application program layer to call an API in the system-related layer, so as to assist the application to access data in the system-related layer.

[0089] In some embodiments, the API adapter may include a storage module.

[0090] In some embodiments, the application-related layer may also include system applications, which may include but are not limited to: near field communication (NFC) applications, telephone (Tel) applications, audio (audio) applications, and setting applications, etc. Among them, NFC applications may be, for example, applications that use NFC communication, such as wallet applications, payment applications, etc. Exemplarily, the user can use the NFC of the terminal device to call the wallet application to complete the payment, which is more convenient than the method of paying by scanning the payment QR code.

[0091] In some embodiments, system applications may be included in the application layer. Figure 1 In the example, the system application does not belong to the application layer, runtime layer, and application framework layer, and exists independently in the application-related layers.

[0092] In some embodiments, the system-related layers may include: a system framework layer (OS framework) and a system kernel layer (OS kernel).

[0093] The system framework layer can provide system services, system interfaces, etc. for applications. Among them, applications can implement some specific functions by using system services. For example, if the system service can locate the system service, the application can use the positioning system service to obtain the current location of the terminal device. Among them, the application can call the system interface to access the data in the system-related layer. The data in the system-related layer may include, but is not limited to, data in TEE, data in REE, and data in the hard disk or chip of the terminal device.

[0094] Reference Figure 1 In some embodiments, the system framework layer may include: UI tools, ability management modules, and storage APIs, etc. In some embodiments, the storage API may be referred to as a storage interface.

[0095] Among them, an application can correspond to at least one application process, and an application process can support multiple abilities. Abilities have the ability to be called across application processes and within the same process. The ability management module is used to uniformly schedule and manage the abilities in the application and manage the life cycle changes of abilities.

[0096] In some embodiments, the application in the application layer can use the UI tools in the system framework layer through the UI component adapter to achieve UI drawing, rendering, and display.

[0097] In some embodiments, the application in the application layer can call the storage API through the storage module in the API adapter to access the TEE. The application accessing the TEE may include: the application accessing the TEE, the application accessing the TA in the TEE, the application storing data in the TEE, and the application reading data in the TEE.

[0098] In some embodiments, the storage API may be, for example, a TF-M interface, a psa_ps_create interface, or a psa_ps_set interface.

[0099] The system kernel layer may include hardware drivers to drive the hardware to work. For example, the system kernel layer includes: sensor driver, display driver, graphics processing unit driver (GPU driver) and chip driver, etc., which are not limited in the embodiments of the present application.

[0100] In some embodiments, the terminal device may include a TEE. At least one trusted application TA may be run in the TEE. Figure 1 , taking TA1 and TA2 as an example, TA1 may be an application for implementing secure payment, and TA2 may be an application for implementing face recognition.

[0101] In some embodiments, TEE may also include a protection service (PS). PS is used to store data. For example, PS can be used to store payment passwords of banking apps installed in the terminal device, login passwords of applications, and face data.

[0102] In the embodiment of the present application, the PS can also distinguish data of different applications when storing data, and encrypt and store the data of different applications. For details, please refer to the description in the following embodiment.

[0103] In some embodiments, the access control method provided in the embodiments of the present application can also be applied to a terminal device deployed with an RTOS and security hardware. In some embodiments, the security hardware can be, for example, a secure element (SE), an embedded security element (eSE), or a security processor.

[0104] Reference Figure 2 , the terminal device may include: application-related layer, system-related layer, and security hardware. Among them, the application-related layer and the system-related layer can refer to Figure 1 Description in .

[0105] In the embodiment of the present application, the terminal device can realize functions such as data security storage, encryption and decryption operations through security hardware. For example, the security hardware can be used to store data, for example, the security hardware can be used to store the payment password of the bank APP installed in the terminal device, the login password of the application, and face data, etc.

[0106] In the embodiments of the present application, the security hardware may also be used to implement encrypted storage of data, and specific details may be referred to the description in the following embodiments.

[0107] Reference Figure 2 ,and Figure 1 The difference is that, because the terminal device is provided with security hardware, the system kernel layer may include a driver for the security hardware. Figure 1 When the security hardware is eSE, the driver of the security hardware can be SE driver.

[0108] comprehensive Figure 1 and Figure 2 , Figure 1 In the structure of the terminal device shown in FIG, the terminal device can create a secure operating environment TEE for the software. Figure 2 In the structure of the terminal device shown in , a hardware secure operating environment TEE can be deployed, but no matter what the structure is, the terminal device can provide a secure operating environment for the business. Figure 1 TEE in Figure 2 The secure hardware in is called a secure environment module.

[0109] Reference Figure 1 and Figure 2 , the terminal device may include: an application-related layer, a system-related layer, and a security environment module. In some embodiments, the security environment module may be TEE or security hardware (SE or eSE, etc.).

[0110] In some embodiments, the terminal device may include: an application-related layer, a system-related layer, a TEE, and secure hardware. In this example, the secure environment module in the terminal device may include the TEE and secure hardware. In this example, data may be stored in both the TEE and the secure hardware, and the process of the application accessing the TEE and the secure hardware may refer to the description in the following embodiments.

[0111] It should be understood that Figure 1 and Figure 2 REE is not shown in the figure, but it can be understood that the APP in the application layer can run in the REE.

[0112] Understandably, Figure 1 and Figure 2 The structure shown does not constitute a specific limitation on the terminal device. In other embodiments of the present application, the terminal device may include more or fewer components than shown in the figure, or combine some components, or separate some components, or arrange the components differently. Figure 1 and Figure 2 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0113] Before introducing the access control method provided by the embodiment of the present application, Figure 1 Taking the example, we first explain the access control methods and existing problems in current terminal devices:

[0114] Reference Figure 3 Taking the application storing and reading data in TEE as an example, currently, both APP1 and APP2 can call the storage API through the storage module to access TEE and store data in TEE. Taking the payment scenario as an example, the current access control methods in the terminal device can include:

[0115] Step 1: In response to the user setting the payment password of APP1, APP1 calls the storage API through the storage module to request TEE to store the payment password of APP1.

[0116] Step 2. TEE stores the payment password of APP1.

[0117] Step 3: In response to the user setting the payment password of APP2, APP2 calls the storage API through the storage module and requests TEE to store the payment password of APP2.

[0118] Step 4. TEE stores the payment password of APP2.

[0119] It should be understood that there is no order of precedence between “step 1 - step 2” and “step 3 - step 4”.

[0120] Step 5: In response to the user triggering the operation of obtaining the payment password of APP1, APP1 calls the storage API through the storage module to request the payment password of APP1 from TEE.

[0121] Step 6: In response to the user triggering the operation of obtaining the payment password of APP2, APP2 calls the storage API through the storage module to request the payment password of APP2 from TEE.

[0122] Currently, there are the following problems with access control of the security environment module:

[0123] Question 1: In terminal devices that deploy RTOS and secure environment modules, there is currently no specific access control solution for whether applications have permission to access the secure environment module, and whether applications have permission to access the TA in the secure environment module. Currently, all applications can access TEE, which will affect the data security in TEE.

[0124] Problem 2: When both APP1 and APP2 store data (such as payment passwords) in the security environment module, the current security environment module cannot isolate and distinguish the data of different applications. In this way, when APP1 accesses the security environment module to request APP1's payment password, the current security environment module cannot recognize APP1's identity, and because APP1's data and APP2's data are not isolated and distinguished, the security environment module will mistakenly feedback APP2's payment password to APP1, causing data leakage and APP1 payment failure.

[0125] Therefore, for terminal devices that deploy RTOS and security environment modules, there is an urgent need for a method for access control of the security environment module to ensure access security to the security environment module and data storage security in the security environment module.

[0126] The embodiment of the present application provides an access control method. On the one hand, the terminal device can verify the permissions of the application to verify whether the application has the permission to access the security environment module and the TA in the security environment module. On the other hand, when the application has the permission to access the security environment module and when the application needs to store data in the security environment module, the terminal device can encrypt and distinguish the data of different applications, and when the application requests data in the security environment module, the terminal device can identify the identity of the application and feedback the data of the application to the application, avoiding the problem of mistakenly feeding back the data of other applications to the application, which can ensure the data security in the security environment module and the security of the terminal device.

[0127] The access control method provided by the embodiment of the present application is described below in conjunction with specific embodiments. The following embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0128] Figure 4 A flowchart of an embodiment of the access control method provided in the present application. Figure 4 , the access control method provided in the embodiment of the present application may include:

[0129] S401: A first application sends a first request to a storage interface, where the first request is used to request access to a security environment module.

[0130] The first application may be a third-party application or a system application in the terminal device. When the first application is a system application, the system application may directly call the storage interface and send the first request to the storage interface. When the first application is a third-party application, the third-party application may call the storage interface through the storage module in the application framework layer and send the first request to the storage interface.

[0131] The first request is used to request access to the secure environment module. In some embodiments, accessing the secure environment module may include: the first application accessing the secure environment module to obtain data stored in the secure environment module, the first application accessing a TA in the secure environment module, and the first application requesting to store data in the secure environment module.

[0132] In some embodiments, the first application requests access to the security environment module to execute different services, and the information carried in the first request may be different.

[0133] Exemplarily, for example, the first application requests access to the security environment module and the service to be performed is access to TA2. The first application is, for example, an unlocking application, and the user can use face unlocking when unlocking the terminal device. Among them, the unlocking application can collect the user's face data. In order to verify whether the face data collected by the unlocking application can trigger unlocking the terminal device, the unlocking application can send a first request to the storage interface, and the first request is used to request access to TA2 in the security environment module to request TA2 to verify whether the face data can trigger unlocking the terminal device. Among them, TA2 is an application for implementing face recognition, and face data for unlocking can be stored in TA2. TA2 can verify the face data collected by the unlocking application by comparing the face data stored therein with the face data collected by the unlocking application. The embodiment of the present application does not elaborate on the verification process. In this example, the first request may include the user's face data collected by the unlocking application.

[0134] Exemplarily, for example, the business that the first application needs to perform when requesting access to the secure environment module is to store data. The first application is, for example, a payment application. After the user sets the password of the payment application, in order to ensure the security of the password, the payment application can send a first request to the storage interface. The first request is used to request access to the secure environment module so that the secure environment module can store the password of the payment application. The first request may include the password of the payment application.

[0135] Exemplary, for example, the business that the first application needs to perform when requesting access to the security environment module is to read the data stored in the security environment module. After the security environment module stores the password of the payment application, when the user subsequently uses the payment application to make a payment, the user can enter the payment password, and the payment application can send a first request to the storage interface, the first request is used to request access to the security environment module, and obtain the password of the payment application stored therein to verify whether the payment password entered by the user is correct. For example, after the payment application obtains the password of the payment application, it can compare the payment password entered by the user with the password of the payment application, and when the payment password entered by the user is the same as the password of the payment application, the payment is triggered. In this example, the first request can include an identifier of the first application so that the storage interface can determine the identity of the first application, and then feedback the data of the first application to the first application. Among them, the identifier of the first application can be information such as the package name, name, etc. of the first application that is used to uniquely distinguish the application.

[0136] In some embodiments, the data requested by the first application to be stored in the security environment module may include, but is not limited to: payment password, login password of the first application, face data, files, documents, multimedia data, etc., which are not limited in the embodiments of the present application. In some embodiments, the data requested by the first application to be read in the security environment module can refer to the description of "data requested by the first application to be stored in the security environment module".

[0137] In some embodiments, the first request may include an identifier of the first application. The identifier of the first application may be, for example, a package name or a name of the first application, or other information used to uniquely distinguish an application.

[0138] In some embodiments, for a system application, there is no corresponding package name for the system application, so the process identifier corresponding to the system application can be used as the identifier of the system application. The process identifier can be information that uniquely distinguishes a process, such as a process identifier (PID) and a process number.

[0139] In some embodiments, the terminal device may use virtual machine technology to run the process corresponding to the application, where one virtual machine may correspond to at least one application, and the processes corresponding to the at least one application are the same, and the process identifiers are also the same, so in this embodiment, only the process identifiers cannot distinguish different applications. In this example, the package name or name of the first application may be used to distinguish different applications, and when there is no corresponding package name for the application, the name of the application may be used to distinguish different applications.

[0140] In summary, in some embodiments, in order to ensure that different applications can be distinguished in various scenarios, the identifier of the first application may be, for example, the name of the first application. Alternatively, the identifier of the first application may include the name of the first application and the process identifier corresponding to the first application. Alternatively, the identifier of the first application may include the package name of the first application and the process identifier corresponding to the first application. The embodiment of the present application does not limit the identifier of the first application, as long as different applications can be distinguished.

[0141] S402, the storage interface checks whether the first application has permission to access the security environment module. If yes, execute S403, if not, execute S404.

[0142] In some embodiments, the mapping relationship between applications and permissions can be pre-configured in the storage interface. Exemplarily, the mapping relationship may include: the identification of each application in the terminal device, and the permissions of each application. Among them, the permissions of each application may include: the permission to access the security environment module, and / or, the permission to access a certain TA in the security environment module. Among them, the permission to access the security environment module may include: the permission to store data in the security environment module and the permission to read data.

[0143] For example, taking the security environment module including TA1 and TA2 as an example, and taking the mapping relationship between applications and permissions in a table as an example, Table 1 shows the mapping relationship between applications and permissions in the storage interface:

[0144] Table 1

[0145]

[0146] Referring to Table 1, "yes" indicates that the application has access rights, and "no" indicates that the application does not have access rights. For example, taking APP1 as an example, APP1 has access rights to the security environment module and has access rights to TA1 in the security environment module, but does not have access rights to TA2 in the security environment module.

[0147] It should be understood that Table 1 is an example of a mapping relationship between applications and permissions, and the embodiment of the present application does not limit the form of the mapping relationship.

[0148] In an embodiment of the present application, the storage interface responds to the first request and can query the permission of the first application corresponding to the identifier of the first application in the mapping relationship according to the identifier of the first application in the first request to verify whether the first application has the permission to access the security environment module. Exemplarily, APP1 sends a first request to the storage interface, and the first request is used to request access to TA1 in the security environment module. The storage interface queries the mapping relationship and can determine that APP1 has the permission to access TA1 in the security environment module. Exemplarily, APP1 sends a first request to the storage interface, and the first request is used to request access to TA2 in the security environment module. The storage interface queries the mapping relationship and can determine that APP1 does not have the permission to access TA2 in the security environment module.

[0149] S403: The storage interface sends a first indication to the secure storage module, where the first indication is used to indicate that the first application is allowed to access the secure environment module.

[0150] When the first application has permission to access the security environment module, the storage interface can send a first indication to the security storage module, and the first indication is used to indicate that the first application is allowed to access the security environment module, so that the first application can access the security environment module to store or read data in the security environment module, or access the TA in the security environment module.

[0151] In some embodiments, for example, the first application requests to access the security environment module to execute a service to access TA2. The first indication may include the user's face data collected by the unlocking application, so that the security environment module can verify the face data.

[0152] Exemplarily, for example, the first application requests to access the security environment module and the service to be performed is to store data. The first indication may include an identifier of the first application and the first data to be stored.

[0153] Exemplarily, for example, if the first application requests to access the security environment module and the service to be performed is to read data, the first indication may include the identifier of the first application and the identifier of the data to be read. The identifier of the data to be read may be information such as the name of the first data, the storage location of the first data in the security environment, etc. Exemplarily, if the first data is a file, the name of the first data may be a file name. If the first data is the user's face data, the name of the first data may be "face data".

[0154] S404, the storage interface sends a verification failure message to the first application, where the verification failure message is used to indicate that the first application does not have permission to access the security environment module.

[0155] When the first application does not have permission to access the secure environment module, the storage interface may send a verification failure message to the first application. The verification failure message is used to indicate that the first application does not have permission to access the secure environment module. In some embodiments, the verification failure message is also used to indicate that the first application fails to call the storage interface.

[0156] In an embodiment of the present application, the storage interface can perform permission verification on applications that access the security environment module, and when the application has permission to access the security environment module, the application is allowed to access the security environment module, and when the application does not have permission to access the security environment module, the application is not allowed to access the security environment module. In an embodiment of the present application, access control of the security environment module can be implemented, which can prevent applications that do not have access permissions from accessing the security environment module, thereby improving the security of data in the security environment module.

[0157] The above embodiment describes a solution in which the storage interface can perform permission verification on applications accessing the security environment module. When the application has permission to access the security environment module, the current security environment module cannot distinguish the identity of the application and cannot store the application data in isolation, which may cause the problem of erroneous feedback of data from other applications to the application. An access control method is provided in the embodiment of the present application. The security environment module can distinguish the identities of different applications and store the data of different applications in isolation, so as to ensure that the correct data is fed back to the application when the application reads the data.

[0158] The following describes the process of storing and reading data in the security environment module. Figure 5 , the access control method provided in the embodiment of the present application may include:

[0159] S501, a first application sends a first request to a storage interface, where the first request is specifically used to request to store data in a secure environment module.

[0160] In some embodiments, the first request may include an identifier of the first application. In some embodiments, the first request may include an identifier of the first application and the first data to be stored. In some embodiments, the identifier of the first application and the first data may be sent separately or together, which is not limited in the embodiments of the present application.

[0161] Exemplarily, the first application is, for example, a payment application. After the user sets the password of the payment application, in order to ensure the security of the password, the payment application may send a first request to the storage interface. The first request is used to request access to the security environment module. Specifically, the first request is used to request that the password of the payment application be stored in the security environment module. Among them, the first request may include the identifier of the first application and the password of the payment application. Exemplarily, the identifier of the first application may include: the package name of the first application and the PID of the process corresponding to the first application (referred to as the PID of the first application), so that the first request may include: the package name of the first application, the PID of the first application, and the password of the payment application.

[0162] S502, the storage interface checks whether the first application has permission to access the security environment module. If yes, execute S503, if not, execute S507.

[0163] S502 may refer to the description in S402.

[0164] In some embodiments, S502 may be an optional step, and it is assumed that all applications have the permission to access the security environment module. In this example, S503 may be directly executed.

[0165] S503: The storage interface generates a first key, and uses the first key to encrypt first data to be stored by the first application to obtain a first ciphertext.

[0166] In the embodiment of the present application, there is no restriction on the way in which the storage interface generates the key, for example, the storage interface may generate the key by using a random number, a password, etc. The storage interface may use the first key to encrypt the first data to be stored by the first application to obtain the first ciphertext.

[0167] In an embodiment of the present application, the storage interface uses a first key to encrypt the first data, with the purpose of facilitating the storage of the first ciphertext corresponding to the first data in the security environment module. In this way, even when other applications have permission to access the security environment module, the data read from the first application is ciphertext, rather than directly reading the data of the first application, thereby ensuring data security.

[0168] S504: The storage interface encrypts the identifier of the first data using the first key to obtain a second ciphertext.

[0169] The identifier of the first data may be information such as the name of the first data, the storage location of the first data in a secure environment, etc., which is used to distinguish different data. For example, the first data may be the payment password "abc" of APP1, and the identifier of the first data may be "payment password". For example, the first data may be a file, and the identifier of the first data may be the file name.

[0170] In some embodiments, the storage interface may also generate a third key, and use the third key to encrypt the identifier of the first data to obtain the second ciphertext. The third key may be different from the first key. In other words, the secret key used by the storage interface to encrypt the first data and the identifier of the first data may be the same or different.

[0171] In some embodiments, S504 is an optional step. In this example, when S504 is not executed, the storage interface can send a first indication to the security environment module, the first indication is used to indicate that the first application is allowed to access the security environment module, and the first indication includes a first ciphertext and an identifier of the first application. Accordingly, the security environment module can store the first ciphertext and the identifier of the first application in correspondence.

[0172] S505, the storage interface sends a first indication to the security environment module, where the first indication is used to indicate that the first application is allowed to access the security environment module, and the first indication includes a first ciphertext, a second ciphertext, and an identifier of the first application.

[0173] It should be understood that the purpose of the storage interface sending the identification of the first data to the security environment module is to facilitate the security environment module to identify different types of data of the application. In addition, the purpose of the storage interface encrypting the identification of the first data is to ensure the security of the identification of the first data.

[0174] S506, the security environment module stores the first ciphertext, the second ciphertext, and the identifier of the first application in correspondence.

[0175] In some embodiments, the PS in the security environment module may store the first ciphertext, the second ciphertext, and the identifier of the first application in a corresponding manner.

[0176] S507, the storage interface sends a verification failure message to the first application, where the verification failure message is used to indicate that the first application does not have permission to access the security environment module.

[0177] S507 may refer to the description in S404.

[0178] Similarly, when the second application needs to store data in a secure environment, refer to Figure 5 , you can also execute S508-S514:

[0179] S508: The second application sends a second request to the storage interface, where the second request is specifically used to request to store data in the secure environment module.

[0180] The second request may include an identifier of the second application and second data to be stored by the second application.

[0181] S509, the storage interface checks whether the second application has permission to access the security environment module. If yes, execute S510, if not, execute S514.

[0182] S510, the storage interface generates a second key, and uses the second key to encrypt second data to be stored by the second application to obtain a third ciphertext.

[0183] The second key is different from the first key. In the embodiment of the present application, the storage interface uses different keys to encrypt data of different applications to improve data security. Because if the storage interface uses the same key to encrypt data of different applications, after the key of one application is leaked, the data of other applications will also be leaked.

[0184] S511: The storage interface encrypts the identifier of the second data using the second key to obtain a fourth ciphertext.

[0185] Exemplarily, the second data may be, for example, the payment password “bcd” of APP2, and the identifier of the second data may be, for example, “payment password”.

[0186] In some embodiments, the storage interface may generate a fourth key and use the fourth key to encrypt the identifier of the second data to obtain a fourth ciphertext. The fourth key may be different from the second key. In other words, the secret key used by the storage interface to encrypt the second data and the identifier of the second data may be the same or different.

[0187] In the embodiment of the present application, the storage interface uses different secret keys to encrypt the identifiers of data of different applications in order to facilitate the security environment module to distinguish data with the same identifier of different applications. For example, the first application and the second application both store payment passwords in the security environment module, such as the payment password of APP1 is "abc", the payment password of APP2 is "bcd", and the identifiers of "abc" and "bcd" are both "payment passwords". The security environment module only relies on the mark of "payment password" and cannot accurately distinguish the applications to which "abc" and "bcd" belong. In this way, when APP1 requests to read the payment password of APP1 in the security environment, the security environment module cannot distinguish which payment password is the payment password of APP1.

[0188] In order to facilitate the security environment module to distinguish data with the same identifier of different applications, the storage interface can use different secret keys to encrypt the identifiers of data of different applications, so that even if the identifiers of data of different applications are the same, the ciphertext obtained by the encrypted identifiers of the data is different. For example, the ciphertext of the identifier "payment password" of the first data after being encrypted with the first key is "12345", and the ciphertext of the identifier "payment password" of the second data after being encrypted with the second key is "23456". Because the encrypted ciphertexts are different, the security environment module can distinguish the identifiers of data of different applications based on the identifiers of the encrypted data.

[0189] S512, the storage interface sends a second indication to the security environment module, where the second indication is used to indicate that the second application is allowed to access the security environment module, and the second indication includes a third ciphertext, a fourth ciphertext, and an identifier of the second application.

[0190] S513, the security environment module stores the third ciphertext, the fourth ciphertext, and the identifier of the second application in correspondence.

[0191] S514, the storage interface sends a verification failure message to the second application, where the verification failure message is used to indicate that the second application does not have permission to access the security environment module.

[0192] S508-S514 may refer to the description in S501-S507.

[0193] Combine the following Figure 1 , Figure 2 The structure of the terminal device shown in FIG. 1 illustrates the process of storing data in the secure environment module. Figure 6 , the process may include:

[0194] Step 1A: The application sends a first request to the storage interface, where the first request includes an identification of the application and first data.

[0195] It should be understood that Figure 6 The applications include: APP1, APP2, and telephone application as an example. Figure 6 Different lines are used to represent the process of different APPs storing data in the security environment module, and solid lines can be used to represent common steps. It should be understood that Figure 6 In the example, the security environment module is TEE.

[0196] Wherein, both APP1 and APP2 can call the storage interface through the storage module and send the first request to the storage interface. The phone application can directly call the storage interface and send the first request to the storage interface.

[0197] Step 2A: The storage interface verifies whether the application has permission to access the security environment module.

[0198] Step 3A: When the application has permission to access the security environment module, the storage interface generates a key, encrypts the first data and the identifier of the first data, and obtains ciphertext 1 and ciphertext 2.

[0199] Step 4A: The storage interface sends ciphertext 1, ciphertext 2, and an identification of the application to the security environment module.

[0200] In step 5A, the security environment module stores the ciphertext 1, the ciphertext 2, and the identification of the application in correspondence.

[0201] In the embodiment of the present application, the security environment module may be TEE or security hardware.

[0202] In an embodiment of the present application, in a scenario where an application requires data to be stored in a secure environment module, the storage interface can obtain an identification of the application, and the identification of the application can facilitate the secure environment module to identify data of different applications. In addition, the storage interface can also generate a key to encrypt the data of the application and the identification of the data, so that the security of the data can be guaranteed. In addition, for different applications, the secret key generated by the storage interface can be different, so that the secure environment module can distinguish the identification of the data of different applications based on the identification of the encrypted data, so that when the identification of the data of different applications is the same, the secure environment module can also distinguish the data of different applications.

[0203] After the application stores data in the secure environment module, the application can request to read the application data stored in the secure environment module. Figure 7 In the example of the first application reading the first data in the security environment module, the process of the second application reading the second data in the security environment module can refer to Figure 7 Description in .

[0204] Reference Figure 7 , the access control method provided in the embodiment of the present application may include:

[0205] S701: A first application sends a third request to a storage interface, where the third request is used to request to read first data.

[0206] In some embodiments, the third request includes an identifier of the first application and an identifier of the first data. The identifier of the first data may be, for example, a “payment password”.

[0207] In some embodiments, when the first application stores only one type of data in the security environment module, the third request may include the identifier of the first application. For example, if the first application is a payment application, and the payment application only stores the "payment password" in the security environment module, the third request may include the identifier of the first application. In this example, the security environment module may determine that the third request is for requesting the payment password based on the identifier of the first application.

[0208] For example, taking the payment scenario as an example, if the user sets password-free payment, when the user uses the first application to make a payment, the first application can request the payment password of the first application from the security environment module to make the payment. Alternatively, taking the payment scenario as an example, when the user uses the first application to make a payment, the first application can collect the payment password entered by the user. When the first application needs to verify the payment password entered by the user, the first application can request the payment password of the first application from the security environment module to verify whether the payment password entered by the user is correct.

[0209] S702: The storage interface checks whether the first application has permission to access the security environment module. If yes, execute S703.

[0210] In some embodiments, S702 is an optional step because when the first application requests to store the first data, the storage interface has verified that the first application has permission to access the security environment module. Therefore, when the first application sends a third request to the storage interface again, the storage interface can determine that it has verified that the first application has permission to access the security environment module based on the identifier of the first application in the third request, and there is no need to verify again.

[0211] It should be understood that Figure 7 The step of the first application having the permission to access the security environment module is shown in FIG. 5 , and the step of the first application not having the permission to access the security environment module is not shown. Please refer to the description in S507 .

[0212] S703: The storage interface sends a third indication to the security environment module. The third indication is used to indicate that the first application is allowed to access the security environment module. The third indication includes an identifier of the first application.

[0213] S704: The security environment module sends a first ciphertext to the storage interface.

[0214] In an embodiment of the present application, because the security environment module stores the first ciphertext, the second ciphertext and the identifier of the first application accordingly, the security environment module can respond to the third indication and determine the first ciphertext and the second ciphertext corresponding to the identifier of the first application according to the identifier of the first application in the third indication, and send the first ciphertext to the storage interface.

[0215] In some embodiments, S704 may be replaced by: the security environment module sends the first ciphertext and the second ciphertext to the storage interface.

[0216] S705: The storage interface decrypts the first ciphertext according to the first key to obtain first data.

[0217] In some embodiments, the storage interface may store a key for each application. For example, the storage interface may store an identification of the application, a first key for encrypting the first data, and a first key or a second key for encrypting the identification of the first data.

[0218] After receiving the first ciphertext from the security environment module, the storage interface can decrypt the first ciphertext according to the first secret key used to encrypt the first data to obtain the first data. In the embodiment of the present application, there is no restriction on the encryption algorithm and decryption algorithm used by the storage interface. Exemplarily, the storage interface can use a symmetric key algorithm for encryption and decryption.

[0219] In some embodiments, the storage interface may also use an asymmetric key algorithm to encrypt and decrypt the first data and the identifier of the first data. This embodiment of the present application does not elaborate on this process.

[0220] In some embodiments, S705 may be replaced by: the storage interface decrypts the first ciphertext and the second ciphertext respectively according to the first key to obtain the first data and the identifier of the first data.

[0221] S706: The storage interface sends first data to the first application.

[0222] In this way, the first application can accurately read the first data of the first application from the security environment module.

[0223] In some embodiments, S706 may be replaced by: the storage interface sends the first data and an identifier of the first data to the first application.

[0224] In an embodiment of the present application, because when an application stores data in a secure environment module, the storage interface can obtain the identification of the application and generate a key to encrypt the data of the application, the secure environment module can store the identification of the application and the encrypted application data accordingly. Therefore, when the application reads data from the secure environment, the secure environment module can feedback the correct data to the application based on the identification of the application.

[0225] In some embodiments, when the security environment module includes TEE and the application requests TEE to store the application's data, TEE can generate keys and encrypt the application's data, and TEE can store keys. Because TEE has higher security, the method of generating keys by TEE and encrypting application data has higher security than the method of generating keys by the storage interface in the above embodiment.

[0226] Reference Figure 8 , the access control method provided in the embodiment of the present application may include:

[0227] S801, a first application sends a first request to a storage interface, where the first request is specifically used to request to store data in a secure environment module.

[0228] S802, the storage interface checks whether the first application has permission to access the security environment module. If yes, execute S803, if not, execute S807.

[0229] S803, the storage interface sends a first indication to the TEE, where the first indication is used to indicate that the first application is allowed to access the security environment module, and the first indication includes an identifier of the first application and first data to be stored by the first application.

[0230] S804, TEE generates a first key, and uses the first key to encrypt first data to be stored by the first application to obtain a first ciphertext.

[0231] S805, TEE uses the first key to encrypt the identifier of the first data to obtain a second ciphertext.

[0232] In some embodiments, S805 is an optional step. When S805 is not performed, the TEE may store the first ciphertext and the identifier of the first application in correspondence.

[0233] S806, TEE stores the first ciphertext, the second ciphertext, and the identifier of the first application in correspondence.

[0234] S807, the storage interface sends a verification failure message to the first application, where the verification failure message is used to indicate that the first application does not have permission to access the security environment module.

[0235] S801-S807 may refer to the description in S501-S507. Figure 5 The difference is that in the embodiment of the present application, the first key is generated by TEE, and the first data and the identifier of the first data are respectively encrypted using the first key.

[0236] Similarly, when the second application needs to store data in a secure environment, refer to Figure 8 , you can also execute S808-S814:

[0237] S808, the second application sends a second request to the storage interface, where the second request is specifically used to request to store data in the secure environment module.

[0238] S809, the storage interface checks whether the second application has permission to access the security environment module. If yes, execute S810, if not, execute S814.

[0239] S810, the storage interface sends a second indication to the TEE, where the second indication is used to indicate that the second application is allowed to access the security environment module, and the second indication includes an identifier of the second application and second data to be stored by the second application.

[0240] S811, TEE generates a second key, and uses the second key to encrypt the second data to be stored by the second application to obtain a third ciphertext.

[0241] S812, TEE uses the second key to encrypt the identifier of the second data to obtain a fourth ciphertext.

[0242] S813, TEE stores the third ciphertext, the fourth ciphertext, and the identifier of the second application correspondingly.

[0243] S814, the storage interface sends a verification failure message to the second application, where the verification failure message is used to indicate that the second application does not have permission to access the security environment module.

[0244] S808 - S814 may refer to the description in S508 - S514 .

[0245] Combine the following Figure 1 , Figure 2 The structure of the terminal device shown in FIG. 1 illustrates the process of storing data in the secure environment module. Fig. 9 , the process may include:

[0246] Step 1B: The application sends a first request to the storage interface, where the first request includes an identification of the application and first data.

[0247] Step 2B: The storage interface verifies whether the application has permission to access the security environment module.

[0248] Step 3B: When the application has permission to access the secure environment module, the storage interface sends a first indication to the TEE, where the first indication includes an identification of the application and first data.

[0249] In step 4B, TEE generates a key and uses the key to encrypt the first data and the identifier of the first data respectively, to obtain ciphertext 1 and ciphertext 2.

[0250] In step 5B, TEE stores ciphertext 1, ciphertext 2, and the application identifier in correspondence.

[0251] In an embodiment of the present application, in a scenario where an application needs to store data in a TEE, the storage interface can obtain the identification of the application, and the identification of the application can facilitate TEE to identify the data of different applications. In addition, TEE can also generate a key to encrypt the application data and the identification of the data, so as to ensure the security of the data. In addition, for different applications, the secret key generated by TEE can be different, which makes it easier for TEE to distinguish the identification of data of different applications based on the identification of the encrypted data, so that when the identification of the data of different applications is the same, TEE can also distinguish the data of different applications.

[0252] After an application stores data in the TEE, the application can request to read the application data stored in the TEE. Fig.10 In the example of the first application reading the first data in the TEE, the process of the second application reading the second data in the TEE can refer to Fig.10 Description in .

[0253] Reference Fig.10 , the access control method provided in the embodiment of the present application may include:

[0254] S1001, a first application sends a third request to a storage interface, where the third request is used to request to read first data.

[0255] S1002: The storage interface checks whether the first application has permission to access the security environment module. If yes, execute S1003.

[0256] In some embodiments, S1002 is an optional step.

[0257] S1003, the storage interface sends a third indication to the TEE, where the third indication is used to indicate that the first application is allowed to access the security environment module, and the third indication includes an identifier of the first application.

[0258] S1004: TEE determines a first ciphertext corresponding to the first application according to the identifier of the first application.

[0259] In some embodiments, S1004 may be replaced by: TEE determines, based on an identifier of the first application, a first ciphertext and a second ciphertext corresponding to the first application.

[0260] S1005, TEE decrypts the first ciphertext according to the first key to obtain the first data.

[0261] In some embodiments, S1005 may be replaced by: the storage interface decrypts the first ciphertext and the second ciphertext respectively according to the first key to obtain the first data and the identifier of the first data.

[0262] S1006, TEE sends first data to the storage interface.

[0263] In some embodiments, S1006 may be replaced by: the TEE sends the first data and an identifier of the first data to the storage interface.

[0264] S1007: The storage interface sends first data to the first application.

[0265] In some embodiments, S1007 may be replaced by: the storage interface sends the first data and an identifier of the first data to the first application.

[0266] In the embodiment of the present application, because when the application stores data in the TEE, the TEE can obtain the application's identification and generate a key to encrypt the application's data, the TEE can store the application's identification and the encrypted application's data accordingly. Therefore, when the application reads data from the TEE, the TEE can feedback the correct data to the application based on the application's identification.

[0267] It should be noted that the data involved in this application (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0268] Fig.11 Another structural diagram of a terminal device provided in an embodiment of the present application. Among them, the terminal device 1100 may include: a processor 1101, a communication module 1102, a memory 1103 and a display screen 1104. Among them, the processor 1101 may be a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The processor may include an application processor and a baseband processor. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present application. The processor may also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The communication module 1102 may be a transceiver, a transceiver circuit, and the like.

[0269] In some embodiments, the terminal device 1100 may further include security hardware 1105. For example Fig.11 In the example, the security hardware 1105 is an eSE chip.

[0270] The processor 1101, the communication module 1102, the memory 1103, the display screen 1104, etc. may be connected together, for example, via a bus.

[0271] The present application also provides a chip system (eg, a system on a chip (SoC)), such as Fig.12As shown, the chip system includes at least one processor 1201 and at least one interface circuit 1202. The processor 1201 and the interface circuit 1202 can be interconnected via lines. For example, the interface circuit 1202 can be used to receive signals from other devices (such as a memory of a terminal device). For another example, the interface circuit 1202 can be used to send signals to other devices (such as a processor 1201 or a camera of a terminal device). Exemplarily, the interface circuit 1202 can read instructions stored in the memory and send the instructions to the processor 1201. When the instruction is executed by the processor 1201, the terminal device can execute the various steps in the above embodiments. Of course, the chip system may also include other discrete devices, which are not specifically limited in the embodiments of the present application.

[0272] Some other embodiments of the present application provide an access control device, which can be applied to the above terminal device. The device is used to execute each function or step executed by the terminal device in the above method embodiment.

[0273] An embodiment of the present application also provides a computer-readable storage medium, which includes computer instructions. When the computer instructions are executed on the above-mentioned terminal device, the terminal device executes each function or step executed by the terminal device in the above-mentioned method embodiment.

[0274] The present application also provides a computer program product, which, when executed on a computer, enables the computer to execute the functions or steps executed by the terminal device in the above method embodiment. For example, the computer may be the above terminal device.

[0275] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0276] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0277] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0278] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0279] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0280] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

[0281] The term "plurality" in this article refers to two or more than two. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the previous and next associated objects are in an "or" relationship; in the formula, the character " / " indicates that the previous and next associated objects are in a "division" relationship. In addition, it should be understood that in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0282] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0283] It can be understood that in the embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

Claims

1. An access control method, characterized in that: Applied to a terminal device deployed with a real-time operating system RTOS, the terminal device includes a first application, a storage application program interface API, and a security environment module, the method includes: The first application sends a first request to the storage API, where the first request is used to request access to the security environment module; The storage API verifies whether the first application has permission to access the security environment module; When the first application has the permission to access the security environment module, the first application accesses the security environment module.

2. The method according to claim 1, characterized in that The storage API is configured with a mapping relationship between applications and permissions, wherein the mapping relationship includes the first application and the permissions possessed by the first application; The storage API verifies whether the first application has permission to access the security environment module, including: The storage API queries the mapping relationship to verify whether the first application has permission to access the security environment module.

3. The method according to claim 1 or 2, characterized in that: The first application accessing the security environment module includes: the first application storing data or reading data in the security environment module, or the first application accessing a trusted application TA in the security environment module.

4. The method according to any one of claims 1 to 3, characterized in that When the first application accesses the security environment module to store data in the security environment module for the first application, the first request includes an identifier of the first application and first data to be stored by the first application.

5. The method according to claim 4, characterized in that The first application accesses the security environment module, including: The storage API generates a first key, and uses the first key to encrypt the first data to obtain a first ciphertext; The storage API sends a first indication to the security environment module, where the first indication includes an identifier of the first application and the first ciphertext; The security environment module stores the identifier of the first application and the first ciphertext in correspondence.

6. The method according to claim 5, characterized in that The method further comprises: The storage API encrypts the identifier of the first data using the first key to obtain a second ciphertext.

7. The method according to claim 5, characterized in that The method further comprises: The storage API generates a third key, and uses the third key to encrypt the identifier of the first data to obtain a second ciphertext, wherein the third key is different from the first key.

8. The method according to claim 6 or 7, characterized in that: The first indication specifically includes an identifier of the first application, the first ciphertext, and the second ciphertext; The security environment module stores the identifier of the first application and the first ciphertext in correspondence, including: The security environment module stores the identifier of the first application, the first ciphertext, and the second ciphertext in correspondence.

9. The method according to any one of claims 5 to 8, characterized in that: The terminal device further includes a second application, and the method further includes: The second application sends a second request to the storage API, where the second request is used to request access to the security environment module, and the second request includes an identifier of the second application and second data to be stored by the second application; The storage API verifies whether the second application has permission to access the security environment module; When the second application has permission to access the security environment module, the storage API generates a second key, and uses the second key to encrypt the second data to obtain a third ciphertext, where the second key is different from the first key; The storage API sends a second indication to the security environment module, where the second indication includes an identifier of the second application and the third ciphertext; The security environment module stores the identifier of the first application and the third ciphertext in correspondence.

10. The method according to any one of claims 5 to 9, characterized in that: The method further comprises: The first application sends a third request to the storage API, where the third request is used to request the first data and includes an identifier of the first application; The storage API sends a third indication to the security environment module, where the third indication includes an identifier of the first application; The security environment module sends a first ciphertext to the storage API according to the identifier of the first application; The storage API decrypts the first ciphertext using the first key to obtain the first data; The storage API sends the first data to the first application.

11. The method according to any one of claims 1 to 10, characterized in that The security environment module includes: a trusted execution environment TEE, and / or security hardware, where the security hardware is any of the following: a security chip, an embedded security chip or a security processor.

12. The method according to claim 4, characterized in that The security environment is a trusted execution environment TEE, and the first application accesses the security environment module, including: The storage API sends a first indication to the security environment module, where the first indication includes an identifier of the first application and the first data; The security environment module generates a first key, and uses the first key to encrypt the first data to obtain a first ciphertext; The security environment module stores the identifier of the first application and the first ciphertext in correspondence.

13. The method according to claim 12, characterized in that The method further comprises: The security environment module encrypts the identifier of the first data using the first key to obtain a second ciphertext.

14. The method according to claim 12, characterized in that The method further comprises: The security environment module generates a third key, and uses the third key to encrypt the identifier of the first data to obtain a second ciphertext, wherein the third key is different from the first key.

15. The method according to claim 13 or 14, characterized in that The security environment module stores the identifier of the first application and the first ciphertext in correspondence, including: The security environment module stores the identifier of the first application, the first ciphertext, and the second ciphertext in correspondence.

16. The method according to any one of claims 12 to 15, characterized in that: The terminal device further includes a second application, and the method further includes: The second application sends a second request to the storage API, where the second request is used to request access to the security environment module, and the second request includes an identifier of the second application and second data to be stored by the second application; The storage API verifies whether the second application has permission to access the security environment module; When the second application has permission to access the security environment module, the storage API sends a second indication to the security environment module, where the second indication includes an identifier of the second application and the second data; The security environment module generates a second key, and uses the second key to encrypt the second data to obtain a third ciphertext, where the second key is different from the first key; The security environment module stores the identifier of the second application and the third ciphertext in correspondence.

17. The method according to any one of claims 12 to 16, characterized in that: The method further comprises: The first application sends a third request to the storage API, where the third request is used to request the first data and includes an identifier of the first application; The storage API sends a third indication to the security environment module, where the third indication includes an identifier of the first application; The security environment module decrypts the first ciphertext using the first key according to the identifier of the first application to obtain the first data; The security environment module sends the first data to the storage API; The storage API sends the first data to the first application.

18. A terminal device, characterized in that: The terminal device comprises a processor, and the processor is used to call a computer program in a memory to execute the method according to any one of claims 1 to 17.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a terminal device, the terminal device executes the method according to any one of claims 1 to 17.

20. A chip, characterized in that: The chip includes a processor, and the processor is used to call a computer program in a memory to execute the method according to any one of claims 1-17.

Images