Method and terminal for using custom key library in Android system
By initializing the security provider class in the Android system and generating the keystore operation object, combined with the certificate management service, the use of the custom keystore to communicate with the Android system without changing the underlying code, solving the problem of large workload and adapting to changes in the system version in the existing technology.
Patent Information
- Application Number
- CN202411493419.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-24
- Publication Date
- 2025-03-14
AI Technical Summary
The existing technology needs to change the underlying Android native KeyStore code when using custom keystores in Android systems, resulting in a large amount of work and needs to adapt to changes in the Android system version, especially after Android 12, you need to learn a new language to customize KeyStore2.
By adding the pre-built security provider class to the security container during the system initialization process, using Android applications to call the security provider class to obtain the keystore operation object, create a new keystore, and generate and store the private key through the certificate management service to achieve communication with the custom TA.
Without changing the native code of the Android system, you can directly use the cooperation of the keystore operation object and certificate management service to achieve access to the secure environment, reducing the development complexity and workload, and adapting to changes in the Android system version.
Smart Images
Figure CN119628826A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computers, and in particular to a method and a terminal for obtaining a custom key. Background Art
[0002] Commercial device products based on the Android system. When customizing the Android system, you need to download certificates and private keys and store them in the developer's own secure environment TA (applications in the trusted execution environment TEE). The application layer needs to use certificates and private keys to encrypt and decrypt or verify signatures. In this case, if you can directly communicate with the custom TA through the Android native KeyStore interface (a tool for securely storing keys, certificates, and other confidential data), and then encrypt and decrypt data and verify signatures, it is a relatively simple solution. However, implementing this solution requires changes to the underlying Android native KeyStore code, which increases the workload and complexity.
[0003] Moreover, with the rapid update of Android system versions, the implementation of the Android keystore system will also change according to different system versions. For example, before Android12, KeyStore was used to communicate with the keymaster TA in a secure environment. Starting from Android12, Android officially added KeyStore2 as a key daemon to communicate with the keymaster TA, and the implementation languages used by KeyStore and KeyStore2 are different. In the prior art, the underlying KeyStore code of Android is directly modified, and the alias passed in by the application layer is judged to determine whether to go to the custom TA or directly go through the native channel of the Android system. However, after Android added KeyStore2, KeyStore2 needs to be customized. Since the underlying code needs to be changed, a new language needs to be re-learned to change the KeyStore2 code.
[0004] From this, it can be seen that the existing technology directly modifies the AndroidKeyStore native code. When the Android system makes logical modifications to the key store system, the modified code logic also needs to be modified, which increases the workload; when Android officially adds a new set of KeyStore2 to implement key storage and operation, it is necessary to re-learn the logic of KeyStore2, which is time-consuming and labor-intensive, and increases the workload greatly; when KeyStore2 is added in a brand-new language after Android12, developers also need to learn a new language, which is time-consuming and labor-intensive, and the development cycle cannot be determined. Summary of the invention
[0005] The technical problem to be solved by the present invention is to provide a method and a terminal for using a custom key library in an Android system, so as to realize the use of the custom key library without changing the native code of the Android system.
[0006] In order to solve the above technical problems, a technical solution adopted by the present invention is: A method for using a custom keystore in an Android system, comprising the steps of: During system initialization, pre-built security provider classes are added to the security container; Calling the security provider class through the Android application to obtain a keystore operation object, and using the keystore operation object to create a new keystore; When the Android application uses the key store operation object to obtain a private key, the private key is generated by a certificate management service and stored in the key store; the certificate management service is used to communicate with a secure environment.
[0007] In order to solve the above technical problems, another technical solution adopted by the present invention is: A terminal using a custom key library in an Android system comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: During system initialization, pre-built security provider classes are added to the security container; Calling the security provider class through the Android application to obtain a keystore operation object, and using the keystore operation object to create a new keystore; When the Android application uses the key store operation object to obtain a private key, the private key is generated by a certificate management service and stored in the key store; the certificate management service is used to communicate with a secure environment.
[0008] The beneficial effects of the present invention are as follows: during the system initialization process, a pre-built security provider class is added to a secure container, and an Android application calls the security provider class to obtain a keystore operation object and creates a new keystore. When obtaining a private key, the private key is generated by a certificate management service and stored in the keystore. The certificate management service communicates with the secure environment, thereby enabling access to a custom TA in the secure environment. There is no need to modify the keystore operation object itself, but rather the keystore operation object and the certificate management service are used in conjunction to directly access the secure environment. Improvements are made at the application level, avoiding modifications to the Android native code. BRIEF DESCRIPTION OF THE DRAWINGS
[0009] Figure 1A flowchart of the steps of using a custom key library in an Android system according to an embodiment of the present invention; Figure 2 This is an implementation architecture diagram of using a custom key library in an Android system according to an embodiment of the present invention; Figure 3 A timing diagram of a method for using a custom key library in an Android system according to an embodiment of the present invention; Figure 4 A schematic diagram of the structure of a terminal using a custom key library in an Android system according to an embodiment of the present invention; Description of labels: 1. A terminal using a custom key store in an Android system; 2. A processor; 3. A memory. DETAILED DESCRIPTION
[0010] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in combination with the implementation modes and the accompanying drawings.
[0011] Please refer to Figure 1 , a method for using a custom keystore in an Android system, comprising the steps of: During system initialization, pre-built security provider classes are added to the security container; Calling the security provider class through the Android application to obtain a keystore operation object, and using the keystore operation object to create a new keystore; When the Android application uses the key store operation object to obtain a private key, the private key is generated by a certificate management service and stored in the key store; the certificate management service is used to communicate with a secure environment.
[0012] From the above description, it can be seen that the beneficial effects of the present invention are: during the system initialization process, a pre-built security provider class is added to the security container, the Android application calls the security provider class to obtain the keystore operation object, and creates a new keystore. When obtaining the private key, the private key is generated by the certificate management service and stored in the keystore. The certificate management service communicates with the secure environment, so that the custom TA in the secure environment can be accessed, and there is no need to modify the keystore operation object itself. Instead, the keystore operation object and the certificate management service are directly used to cooperate to achieve access to the secure environment. Improvements are made at the application level, avoiding modifications to the Android native code.
[0013] Furthermore, the process of adding the pre-built security provider class to the security container during the system initialization process includes: Create a service provider interface class; Create a security provider class, use the name of the service provider interface class as the key value and the path where the service provider interface class is located as the value, and add them to the hash table maintained by the security provider class.
[0014] From the above description, it can be known that by storing the name and path of the service provider interface class in the hash table of the security provider class, the service provider interface class can be called as required to implement various functions required, such as the function of obtaining the key.
[0015] Further, the step of obtaining the keystore operation object by calling the security provider class through the Android application includes: The generation method of the keystore operation object is called by the Android application, the generation method receives a preset name, searches for a key value in the security provider class in the security container according to the preset name, and creates a keystore operation object according to the key value and the value corresponding to the key value.
[0016] As can be seen from the above description, by searching for a matching key value in the security container through a preset name, an object corresponding to the service provider interface class is created, and the method call therein can be implemented through a matching path.
[0017] Further, the certificate management service includes an external interface; The generating of a private key by the certificate management service and storing the private key in the key store comprises: The preset certificate number is sent to the service provider interface class through the key library operation object, so that the service provider interface class calls the external interface to export the certificate data corresponding to the certificate number, generates a private key based on the certificate data, and stores the private key in the key library.
[0018] From the above description, it can be seen that the keystore operation object sends the preset certificate number to the service provider interface class. In the case of multiple custom certificates, the private key of the certificate required by the application can be obtained for verification, avoiding confusion in the case of multiple custom certificates.
[0019] Furthermore, before the Android application calls the security provider class to obtain the key library operation object, the method further includes: Establishing a secure socket layer; The step of obtaining the keystore operation object by calling the security provider class through the Android application comprises: Create a credential manager and a server-side authentication manager; The identity credential manager and the server-side identity authentication manager are called in the secure socket layer to set access rights for the key library operation object.
[0020] From the above description, it can be seen that when establishing a security hierarchy, identity authentication is required during the operation of the key. Only after the identity authentication is passed can the key be obtained and the security environment be accessed, which further improves the security of the system.
[0021] A terminal using a custom key library in an Android system comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: During system initialization, pre-built security provider classes are added to the security container; Calling the security provider class through the Android application to obtain a keystore operation object, and using the keystore operation object to create a new keystore; When the Android application uses the key store operation object to obtain a private key, the private key is generated by a certificate management service and stored in the key store; the certificate management service is used to communicate with a secure environment.
[0022] The beneficial effects of the present invention are as follows: during the system initialization process, a pre-built security provider class is added to a secure container, and an Android application calls the security provider class to obtain a keystore operation object and creates a new keystore. When obtaining a private key, the private key is generated by a certificate management service and stored in the keystore. The certificate management service communicates with the secure environment, thereby enabling access to a custom TA in the secure environment. There is no need to modify the keystore operation object itself, but rather the keystore operation object and the certificate management service are used in conjunction to directly access the secure environment. Improvements are made at the application level, avoiding modifications to the Android native code.
[0023] Furthermore, the process of adding the pre-built security provider class to the security container during the system initialization process includes: Create a service provider interface class; Create a security provider class, use the name of the service provider interface class as the key value and the path where the service provider interface class is located as the value, and add them to the hash table maintained by the security provider class.
[0024] From the above description, it can be known that by storing the name and path of the service provider interface class in the hash table of the security provider class, the service provider interface class can be called as required to implement various functions required, such as the function of obtaining the key.
[0025] Further, the step of obtaining the keystore operation object by calling the security provider class through the Android application includes: The generation method of the keystore operation object is called by the Android application, the generation method receives a preset name, searches for a key value in the security provider class in the security container according to the preset name, and creates a keystore operation object according to the key value and the value corresponding to the key value.
[0026] As can be seen from the above description, by searching for a matching key value in the security container through a preset name, an object corresponding to the service provider interface class is created, and the method call therein can be implemented through a matching path.
[0027] Further, the certificate management service includes an external interface; The generating of a private key by the certificate management service and storing the private key in the key store comprises: The preset certificate number is sent to the service provider interface class through the key library operation object, so that the service provider interface class calls the external interface to export the certificate data corresponding to the certificate number, generates a private key based on the certificate data, and stores the private key in the key library.
[0028] From the above description, it can be seen that the keystore operation object sends the preset certificate number to the service provider interface class. In the case of multiple custom certificates, the private key of the certificate required by the application can be obtained for verification, avoiding confusion in the case of multiple custom certificates.
[0029] Furthermore, before the Android application calls the security provider class to obtain the key library operation object, the method further includes: Establishing a secure socket layer; The step of obtaining the keystore operation object by calling the security provider class through the Android application includes: Create a credential manager and a server-side authentication manager; The identity credential manager and the server-side identity authentication manager are called in the secure socket layer to set access rights for the key library operation object.
[0030] From the above description, it can be seen that when establishing a security hierarchy, identity authentication is required during the operation of the key. Only after the identity authentication is passed can the key be obtained and the security environment be accessed, which further improves the security of the system.
[0031] The method and terminal for using a custom key library in an Android system of the present invention can be applied to the scenario where a custom TA needs to be accessed in a secure environment. The following is an explanation of the specific implementation method. Please refer to Figure 1 , Embodiment 1 of the present invention is: A method for using a custom keystore in an Android system, specifically comprising: S01. Create a service provider interface class (CmsKeyStore class); In an optional implementation, the CmsKeyStore class inherits the KeyStoreSpi parent class in the Java security library (this class defines the service provider interface for the KeyStore class) and implements the abstract functions in the KeyStoreSpi class, such as the engineGetKey function (used to obtain a key), the engineGetCertificate function (used to return a certificate associated with a given name), etc. S02, creating a security provider class (CmsProvider class), taking the name of the service provider interface class as a key value and the path where the service provider interface class is located as a value, and adding them to a hash table maintained by the security provider class; In an optional implementation, the CmsProvider class inherits the Provider class of the Java security library (this class represents the "provider" of the Java Security API, where the provider implements part or all of Java Security). In its constructor, the CmsKeyStore class is added to the HashTable maintained by the CmsProvider class. Its Key value is the name used to identify the KeyStore object in the CmsKeyStore class, such as KeyStore.CMS, and its Value value is the path where the CmsKeyStore class is located, that is, the package name + class name; wherein the KeyStore object can be customized; S1. During system initialization, add the pre-built security provider class to the security container; In an optional implementation, at the initialization of the system process, the CmsProvider object is added to the Security security container, that is, Security.addProvider(new CmsProvider()); S2. Calling the security provider class through the Android application to obtain a key library operation object, including: Calling a generation method of a keystore operation object through the Android application, the generation method receiving a preset name, searching for a key value in the security provider class in the security container according to the preset name, and creating a keystore operation object according to the key value and a value corresponding to the key value; In an optional implementation, the generation method is KeyStore.getInstance("CMS"), where CMS is a preset name. In KeyStore (key store management), Security searches for a matching Provider object (CmsProvider class) in the security container through the CMS name, and then searches for the full class name (package name + class name) corresponding to CmsKeyStore from the Provider object through KeyStore.CMS. The CmsKeyStore object is created through some related operations of the Java class, which is the key store operation object keysStore. S3, using the keystore operation object to create a new keystore; In an optional implementation, use keyStore.load(null) to create a new and empty keystore, then add the required keys and certificates to it through other means for the application to obtain; Thus, through steps S1-S4, a set of customized Provider (security provider) services are implemented according to the unified interface provided by the Java JCA framework (Java Cryptographic Architecture); when the application needs to access the customized TA, the corresponding keystore operation object can be created according to the preset name, and the customized TA can be accessed through the keystore operation object; S4. When the Android application uses the key store operation object to obtain a private key, the private key is generated by a certificate management service and stored in the key store; the certificate management service is used to communicate with a secure environment; In an optional implementation, the certificate management service (CMS) includes an external interface, such as an export certificate interface; when other modules call the external interface, the certificate management service will call the real certificate management service process through Binder cross-process communication and establish communication with the TEE environment, so as to enable data transmission and access to the TA in the TEE environment; The generating of a private key by the certificate management service and storing the private key in the key store comprises: Sending a preset certificate number to the service provider interface class through the key store operation object, so that the service provider interface class calls the external interface to export the certificate data corresponding to the certificate number, generates a private key according to the certificate data, and stores the private key in the key store; In an optional implementation, in the engineGetKey function implemented by the above CmsKeyStore, the certificate is exported through the export certificate interface provided by CMS, and then the private key is constructed through the certificate data and returned; In an optional implementation, the Android application can call the engineGetKey function through the obtained keyStore object through keyStore.getKey("Test11", null), and then obtain the certificate private key object corresponding to Test11. Test11 is the certificate number saved in the custom TA by other means, that is, according to the certificate number, it can be matched to which custom TA is stored, so as to obtain it through engineGetKey; After obtaining the private key, you can use it in the Android application to sign, decrypt, and authenticate data; That is, in step S4, the process of communicating with the TA in the secure environment (TEE) through the certificate management service (Cert Manager Service, CMS) is described; In an optional implementation, before step S2, the following steps are also included: S201. Establish a Secure Socket Layer (SSL); In an optional implementation, an SSLContext instance sslContext is obtained through SSLContext.getInstance("TLS"); the SSLContext.getInstance() method returns an SSLContext object that implements the specified secure socket protocol, and here returns an SSLContext object that implements TLS (Transport Layer Security Protocol); After step S2, the method further includes: S202, creating an identity credential manager and a server-side identity authentication manager; In an optional implementation, an identity credential manager kmf is obtained through KeyManagerFactory.getInstance("X509"); wherein X509 specifies a key manager algorithm, and different key manager algorithms can be numbered in advance and different key manager algorithms can be called by calling different numbers; after the framework reads the number internally, it will select the implementation class of the key manager algorithm corresponding to X509; Call kmf.init(cmcKeyStore, null) to set the access rights of KeyStore; the KeyManagerFactory.getInstance() method returns a KeyManagerFactory object, which acts as the factory of the key manager; pass the custom cmcKeyStore into the KeyManagerFactory. The KeyManager obtained through the KeyManagerFactory factory is an interface class, which contains methods for obtaining specific types of key materials on the server or client side. Its implementation class is the algorithm selected by KeyManagerFactory.getInstance("X509"). All certificates and keys obtained within the subsequent framework will be obtained through the custom cmcKeyStore.
[0032] In an optional implementation, a server-side authentication manager tmf is obtained through TrustManagerFactory.getInstance("X509"), and tmf.init(cmcKeyStore) is called to set the access rights of KeyStore; S203, calling the identity credential manager and the server identity authentication manager in the secure socket layer to set access rights for the key library operation object; In an optional implementation, sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null) is called to initialize the SSL context. At this time, identity authentication and other operations are performed internally in SSL, and then a secure connection is created through createSocket. The terminal and the PC (server) establish a connection, and the terminal and the PC perform SSL two-way authentication. The JCA framework uses the parameters initialized by init to obtain the certificate or key in the custom KeyStore framework. In an optional implementation, the SSL framework obtains the certificate information in the custom TA through the CmsKeystore object stored in the KeyManager; In an optional implementation, it also includes setting a password in the custom TA, and when accessing the TA, it is also necessary to verify whether the password for accessing the TA is correct; in the system, only authorized users or applications can access the CMS certificate management service, such as SE policies, etc.; and after the private key is exported, it needs to be protected by an encryption algorithm or needs to be transmitted in a secure channel.
[0033] Please refer to Figure 4 , Embodiment 2 of the present invention is: A terminal 1 using a custom key library in an Android system includes a processor 2, a memory 3, and a computer program stored in the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, each step in the first embodiment is implemented.
[0034] In summary, the present invention provides a method and terminal for using a custom key store in an Android system. In the Android application layer, a key store operation object is created by utilizing the Android native security provider class and service provider interface class. The key store operation object establishes a key store for a certificate management service to obtain and store keys. The certificate management service is used to communicate with a TA in a secure environment, and the specific TA to be accessed is determined by the certificate number, thereby eliminating the need to directly modify the underlying code and, therefore, eliminating the need to rewrite the corresponding code when the Android system is updated. When other services store data in a custom TA, they can be directly obtained through the Android native key store operation object, without providing a specific interface for the upper-layer application, thereby reducing the amount of subsequent interface maintenance.
[0035] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A method for using a custom keystore in an Android system, characterized in that: Includes steps: During system initialization, pre-built security provider classes are added to the security container; Calling the security provider class through the Android application to obtain a keystore operation object, and using the keystore operation object to create a new keystore; When the Android application uses the key store operation object to obtain a private key, the private key is generated by a certificate management service and stored in the key store; the certificate management service is used to communicate with a secure environment.
2. A method for using a custom keystore in an Android system according to claim 1, characterized in that: The system initialization process includes: Create a service provider interface class; Create a security provider class, use the name of the service provider interface class as the key value and the path where the service provider interface class is located as the value, and add them to the hash table maintained by the security provider class.
3. A method for using a custom keystore in an Android system according to claim 2, characterized in that: The step of obtaining the keystore operation object by calling the security provider class through the Android application includes: The generation method of the keystore operation object is called by the Android application, the generation method receives a preset name, searches for a key value in the security provider class in the security container according to the preset name, and creates a keystore operation object according to the key value and the value corresponding to the key value.
4. A method for using a custom keystore in an Android system according to claim 2, characterized in that: The certificate management service includes an external interface; The generating of a private key by the certificate management service and storing the private key in the key store comprises: The preset certificate number is sent to the service provider interface class through the key library operation object, so that the service provider interface class calls the external interface to export the certificate data corresponding to the certificate number, generates a private key based on the certificate data, and stores the private key in the key library.
5. A method for using a custom keystore in an Android system according to claim 1, characterized in that: Before the Android application calls the security provider class to obtain the key library operation object, the method further includes: Establishing a secure socket layer; The step of obtaining the keystore operation object by calling the security provider class through the Android application includes: Create a credential manager and a server-side authentication manager; The identity credential manager and the server-side identity authentication manager are called in the secure socket layer to set access rights for the key library operation object.
6. A terminal using a custom key library in an Android system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: During system initialization, pre-built security provider classes are added to the security container; Calling the security provider class through the Android application to obtain a keystore operation object, and using the keystore operation object to create a new keystore; When the Android application uses the key store operation object to obtain a private key, the private key is generated by a certificate management service and stored in the key store; the certificate management service is used to communicate with a secure environment.
7. A terminal using a custom key library in an Android system according to claim 6, characterized in that: The system initialization process includes: Create a service provider interface class; Create a security provider class, use the name of the service provider interface class as the key value and the path where the service provider interface class is located as the value, and add them to the hash table maintained by the security provider class.
8. A terminal using a custom key library in an Android system according to claim 7, characterized in that: The step of obtaining the keystore operation object by calling the security provider class through the Android application includes: The generation method of the keystore operation object is called by the Android application, the generation method receives a preset name, searches for a key value in the security provider class in the security container according to the preset name, and creates a keystore operation object according to the key value and the value corresponding to the key value.
9. A terminal using a custom key library in an Android system according to claim 7, characterized in that: The certificate management service includes an external interface; The generating of a private key by the certificate management service and storing the private key in the key store comprises: The preset certificate number is sent to the service provider interface class through the key library operation object, so that the service provider interface class calls the external interface to export the certificate data corresponding to the certificate number, generates a private key based on the certificate data, and stores the private key in the key library.
10. A terminal using a custom key library in an Android system according to claim 6, characterized in that: Before the Android application calls the security provider class to obtain the key library operation object, the method further includes: Establishing a secure socket layer; The step of obtaining the keystore operation object by calling the security provider class through the Android application includes: Create a credential manager and a server-side authentication manager; The identity credential manager and the server-side identity authentication manager are called in the secure socket layer to set access rights for the key library operation object.