Electronic device and method of performing user authentication on the electronic device

Abstract

According to various embodiments, an electronic device includes: a memory; and at least one processor connected to the memory. The at least one processor may receive user credentials through a first authentication application running in the secure area, and perform a user authentication process in the first authentication application in the secure area based on the user credentials. When the user authentication procedure is successfully completed in the first authentication application within the secure area, the at least one processor may control the first authentication application in the secure area to issue an access token. The at least one processor may send an access token issued by the first authentication application in the secure area to the external electronic device through a second authentication application running in the non-secure area.

Description

Technical Field

[0001] The present disclosure relates to a method for performing user authentication in an electronic device. Background Art

[0002] With the development of digital technology, various types of electronic devices such as mobile communication terminals, smart phones, tablet personal computers (PCs), and wearable devices are widely used.

[0003] An electronic device can store various data to provide various user experiences. An electronic device can manage data of one or more applications, services and / or operating systems based on a database. For example, an electronic device can process data in a database based on executed applications, services and / or operating systems.

[0004] Electronic devices such as smart phones can process user authentication functions. For example, when an electronic device executes an application that can provide services after user authentication, it can process user authentication functions such as keyboard input, iris recognition, and fingerprint recognition. Summary of the invention

[0005] Technical issues

[0006] The present disclosure proposes a method for performing user authentication using a secure area in an electronic device.

[0007] Technical Solutions

[0008] According to various embodiments, means for solving the problem are not limited to the above-mentioned means, and those skilled in the art can clearly understand means for solving unmentioned problems from the specification and the accompanying drawings.

[0009] According to various embodiments, an electronic device includes a memory and at least one processor connected to the memory. The at least one processor is configured to: receive user credentials through a first authenticator application executed in a secure area, and control the execution of a user authentication process in the first authenticator application in the secure area based on the user credentials; when the user authentication process is successfully completed in the first authenticator application in the secure area, control the issuance of an access token in the first authenticator application in the secure area; and control the transmission of the access token issued in the first authenticator application in the secure area to an external electronic device through a second authenticator application executed in a non-secure area.

[0010] According to various embodiments, a method of operating an electronic device includes: obtaining user credentials corresponding to user input through a first authenticator application executed in a secure area; performing a user authentication process in the first authenticator application in the secure area based on the user credentials; issuing an access token in the first authenticator application in the secure area when the user authentication process is successfully completed in the first authenticator application in the secure area; and sending the access token issued in the first authenticator application in the secure area to an external electronic device through a second authenticator application executed in a non-secure area.

[0011] According to an embodiment, a computer-readable storage medium storing at least one instruction is provided. When the at least one instruction is executed by at least one processor, the electronic device is enabled to perform multiple operations. The multiple operations include: obtaining user credentials corresponding to user input through a first authenticator application executed in a secure area; performing a user authentication process in the first authenticator application in the secure area based on the user credentials; when the user authentication process is successfully completed in the first authenticator application in the secure area, issuing an access token in the first authenticator application in the secure area; and sending the access token issued in the first authenticator application in the secure area to an external electronic device through a second authenticator application executed in a non-secure area.

[0012] Beneficial Effects

[0013] Embodiments of the present disclosure may control the execution of secure user authentication using a secure area in an electronic device. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a block diagram illustrating an electronic device in a network environment according to an embodiment of the present disclosure.

[0015] Figure 2 is a block diagram illustrating a procedure according to an embodiment of the present disclosure.

[0016] Figure 3a An example of providing a login function in an electronic device according to an embodiment of the present disclosure is shown.

[0017] Figure 3b An example of providing a login function through passwordless authentication in an electronic device according to an embodiment of the present disclosure is shown.

[0018] Figure 4 is a diagram illustrating a user authentication method according to an embodiment of the present disclosure.

[0019] Figure 5 is a diagram illustrating a system according to an embodiment of the present disclosure.

[0020] Figure 6is a diagram showing a packaging structure of an authenticator application according to an embodiment of the present disclosure.

[0021] Figure 7 is a diagram showing an internal configuration of an electronic device in which a packaged authenticator application is executed according to an embodiment of the present disclosure.

[0022] Figure 8 is a diagram illustrating a data structure for credential user registration stored in an electronic device according to an embodiment of the present disclosure.

[0023] Fig. 9 is a diagram showing an example for describing a user authentication method on a device according to an embodiment of the present disclosure.

[0024] Fig.10 is a diagram showing another example for describing a user authentication method on a device according to an embodiment of the present disclosure.

[0025] Fig.11 is a flowchart illustrating the operation of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] Figure 1 is a block diagram illustrating an electronic device in a network environment according to an embodiment of the present disclosure.

[0027] refer to Figure 1 , the electronic device 101 in the network environment 100 may communicate with the electronic device 102 via the first network 198 (e.g., a short-range wireless communication network), or communicate with at least one of the electronic device 104 or the server 108 via the second network 199 (e.g., a long-range wireless communication network). According to an embodiment, the electronic device 101 may communicate with the electronic device 104 via the server 108. According to an embodiment, the electronic device 101 may include a processor 120, a memory 130, an input module 150, a sound output module 155, a display module 160, an audio module 170, a sensor module 176, an interface 177, a connection terminal 178, a haptic module 179, a camera module 180, a power management module 188, a battery 189, a communication module 190, a subscriber identification module (SIM) 196, or an antenna module 197. In some embodiments, at least one of the above components (e.g., the connection terminal 178) may be omitted from the electronic device 101, or one or more other components may be added to the electronic device 101. In some embodiments, some of the above-described components (eg, sensor module 176 , camera module 180 , or antenna module 197 ) may be implemented as a single component (eg, display module 160 ).

[0028] The processor 120 may run, for example, software (e.g., program 140) to control at least one other component (e.g., hardware component or software component) of the electronic device 101 coupled to the processor 120, and may perform various data processing or calculations. According to an embodiment, as at least a part of the data processing or calculation, the processor 120 may store a command or data received from another component (e.g., sensor module 176 or communication module 190) in the volatile memory 132, process the command or data stored in the volatile memory 132, and store the resulting data in the non-volatile memory 134. According to an embodiment, the processor 120 may include a main processor 121 (e.g., a central processing unit (CPU) or an application processor (AP)) or an auxiliary processor 123 (e.g., a graphics processing unit (GPU), a neural processing unit (NPU), an image signal processor (ISP), a sensor hub processor, or a communication processor (CP)) that may operate independently of the main processor 121 or in conjunction with the main processor 121. For example, when the electronic device 101 includes a main processor 121 and an auxiliary processor 123, the auxiliary processor 123 may be adapted to consume less power than the main processor 121, or adapted to be dedicated to a specific function. The auxiliary processor 123 may be implemented as a separate part from the main processor 121, or as a part of the main processor 121.

[0029] When the main processor 121 is in an inactive (e.g., sleep) state, the auxiliary processor 123 (rather than the main processor 121) may control at least some of the functions or states related to at least one component among the components of the electronic device 101 (e.g., the display module 160, the sensor module 176, or the communication module 190), or when the main processor 121 is in an active state (e.g., running an application), the auxiliary processor 123 may control at least some of the functions or states related to at least one component among the components of the electronic device 101 (e.g., the display module 160, the sensor module 176, or the communication module 190) together with the main processor 121. According to an embodiment, the auxiliary processor 123 (e.g., an image signal processor or a communication processor) may be implemented as a part of another component (e.g., a camera module 180 or a communication module 190) that is functionally related to the auxiliary processor 123. According to an embodiment, the auxiliary processor 123 (e.g., a neural processing unit) may include a hardware structure dedicated to artificial intelligence model processing. The artificial intelligence model may be generated through machine learning. For example, such learning may be performed by the electronic device 101 where the artificial intelligence is executed or via a separate server (e.g., server 108). The learning algorithm may include, but is not limited to, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, for example. The artificial intelligence model may include multiple artificial neural network layers. The artificial neural network may be a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), or a deep Q network or a combination of two or more thereof, but is not limited thereto. Additionally or alternatively, the artificial intelligence model may include a software structure in addition to a hardware structure.

[0030] The memory 130 may store various data used by at least one component of the electronic device 101 (e.g., the processor 120 or the sensor module 176). For example, the various data may include input data or output data of software (e.g., the program 140) and commands related thereto. The memory 130 may include a volatile memory 132 or a nonvolatile memory 134.

[0031] The program 140 may be stored as software in the memory 130 , and may include, for example, an operating system (OS) 142 , middleware 144 , or applications 146 .

[0032] The input module 150 may receive commands or data to be used by other components (e.g., the processor 120) of the electronic device 101 from outside the electronic device 101 (e.g., a user). The input module 150 may include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus).

[0033] The sound output module 155 can output sound signals to the outside of the electronic device 101. The sound output module 155 may include, for example, a speaker or a receiver. The speaker can be used for general purposes such as playing multimedia or playing records. The receiver can be used to receive incoming calls. Depending on the embodiment, the receiver can be implemented as a part of the speaker or as a part of the speaker.

[0034] The display module 160 can visually provide information to the outside of the electronic device 101 (e.g., a user). The display module 160 may include, for example, a display, a holographic device, or a projector, and a control circuit for controlling a corresponding one of the display, the holographic device, and the projector. According to an embodiment, the display module 160 may include a touch sensor adapted to detect a touch or a pressure sensor adapted to measure the strength of a force caused by a touch.

[0035] The audio module 170 can convert sound into an electrical signal, and vice versa. According to an embodiment, the audio module 170 can obtain sound via the input module 150, or output sound via the sound output module 155 or an earphone of an external electronic device (e.g., electronic device 102) directly (e.g., wired) coupled to the electronic device 101 or wirelessly coupled.

[0036] The sensor module 176 may detect an operating state (e.g., power or temperature) of the electronic device 101 or an environmental state (e.g., a user's state) outside the electronic device 101, and then generate an electrical signal or data value corresponding to the detected state. According to an embodiment, the sensor module 176 may include, for example, a gesture sensor, a gyro sensor, an atmospheric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an infrared (IR) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illumination sensor.

[0037] The interface 177 may support one or more specific protocols to be used to directly (e.g., wired) or wirelessly couple the electronic device 101 to an external electronic device (e.g., the electronic device 102). According to an embodiment, the interface 177 may include, for example, a high-definition multimedia interface (HDMI), a universal serial bus (USB) interface, a secure digital (SD) card interface, or an audio interface.

[0038] The connection end 178 may include a connector, via which the electronic device 101 may be physically connected to an external electronic device (eg, the electronic device 102). According to an embodiment, the connection end 178 may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (eg, a headphone connector).

[0039] The haptic module 179 may convert the electric signal into mechanical stimulation (eg, vibration or motion) or electric stimulation that can be recognized by the user via his sense of touch or kinesthetic sense. According to an embodiment, the haptic module 179 may include, for example, a motor, a piezoelectric element, or an electric stimulator.

[0040] The camera module 180 may capture still images or moving images. According to an embodiment, the camera module 180 may include one or more lenses, an image sensor, an image signal processor, or a flash.

[0041] The power management module 188 may manage power supplied to the electronic device 101. According to an embodiment, the power management module 188 may be implemented as, for example, at least a part of a power management integrated circuit (PMIC).

[0042] The battery 189 may power at least one component of the electronic device 101. According to an embodiment, the battery 189 may include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

[0043] The communication module 190 may support establishing a direct (e.g., wired) communication channel or a wireless communication channel between the electronic device 101 and an external electronic device (e.g., electronic device 102, electronic device 104, or server 108), and perform communication via the established communication channel. The communication module 190 may include one or more communication processors capable of operating independently from the processor 120 (e.g., an application processor (AP)), and support direct (e.g., wired) communication or wireless communication. According to an embodiment, the communication module 190 may include a wireless communication module 192 (e.g., a cellular communication module, a short-range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module 194 (e.g., a local area network (LAN) communication module or a power line communication (PLC) module). A corresponding one of these communication modules may communicate via a first network 198 (e.g., a short-range communication network such as Bluetooth TM The wireless communication module 192 may communicate with an external electronic device via a wireless communication network (e.g., a wireless Fidelity (Wi-Fi) Direct connection, or an Infrared Data Association (IrDA)) or a second network 199 (e.g., a long-distance communication network such as a traditional cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or a wide area network (WAN))). These various types of communication modules may be implemented as a single component (e.g., a single chip), or may be implemented as multiple components (e.g., multiple chips) separated from each other. The wireless communication module 192 may identify and authenticate the electronic device 101 in a communication network (such as a first network 198 or a second network 199) using subscriber information (e.g., an International Mobile Subscriber Identity (IMSI)) stored in the subscriber identification module 196.

[0044] The wireless communication module 192 can support 5G networks after 4G networks and next-generation communication technologies (e.g., new radio (NR) access technology). NR access technology can support enhanced mobile broadband (eMBB), massive machine type communication (mMTC), or ultra-reliable low-latency communication (URLLC). The wireless communication module 192 can support high-frequency bands (e.g., millimeter wave bands) to achieve, for example, high data transmission rates. The wireless communication module 192 can support various technologies for ensuring performance on high-frequency bands, such as, for example, beamforming, massive multiple-input multiple-output (massive MIMO), full-dimensional MIMO (FD-MIMO), array antennas, analog beamforming, or massive antennas. The wireless communication module 192 can support various requirements specified in the electronic device 101, an external electronic device (e.g., electronic device 104), or a network system (e.g., a second network 199). According to an embodiment, the wireless communication module 192 may support a peak data rate for implementing eMBB (e.g., 20 Gbps or greater), loss coverage for implementing mMTC (e.g., 164 dB or less), or U-plane delay for implementing URLLC (e.g., 0.5 ms or less for each of the downlink (DL) and uplink (UL), or 1 ms or less for a round trip).

[0045] The antenna module 197 may transmit or receive a signal or power to or from the outside of the electronic device 101 (e.g., an external electronic device). According to an embodiment, the antenna module 197 may include an antenna including a radiation element formed of a conductive material or a conductive pattern formed in or on a substrate (e.g., a printed circuit board (PCB)). According to an embodiment, the antenna module 197 may include a plurality of antennas (e.g., an array antenna). In this case, at least one antenna suitable for a communication scheme used in a communication network (such as the first network 198 or the second network 199) may be selected from the plurality of antennas by, for example, the communication module 190 (e.g., the wireless communication module 192). A signal or power may then be transmitted or received between the communication module 190 and the external electronic device via the selected at least one antenna. According to an embodiment, another component (e.g., a radio frequency integrated circuit (RFIC)) other than the radiation element may be additionally formed as a part of the antenna module 197.

[0046] According to various embodiments, the antenna module 197 may form a millimeter wave antenna module. According to an embodiment, the millimeter wave antenna module may include a printed circuit board, an RFIC, and a plurality of antennas (e.g., array antennas), wherein the RFIC is disposed on a first surface (e.g., bottom surface) of the printed circuit board, or is adjacent to the first surface and is capable of supporting a specified high frequency band (e.g., millimeter wave band), and the plurality of antennas are disposed on a second surface (e.g., top surface or side surface) of the printed circuit board, or is adjacent to the second surface and is capable of transmitting or receiving signals of the specified high frequency band.

[0047] At least some of the above components may be coupled to each other and transmit signals (e.g., commands or data) therebetween via an inter-peripheral communication scheme (e.g., a bus, a general purpose input and output (GPIO), a serial peripheral interface (SPI), or a mobile industry processor interface (MIPI)).

[0048] According to an embodiment, a command or data may be sent or received between the electronic device 101 and the external electronic device 104 via a server 108 coupled to the second network 199. Each of the electronic device 102 or the electronic device 104 may be a device of the same type as the electronic device 101, or a device of a different type from the electronic device 101. According to an embodiment, all or some operations to be run at the electronic device 101 may be run at one or more of the external electronic device 102, the external electronic device 104, or the server 108. For example, if the electronic device 101 should automatically perform a function or service or should perform a function or service in response to a request from a user or another device, the electronic device 101 may request one or more external electronic devices to perform at least a part of the function or service instead of running the function or service, or the electronic device 101 may request one or more external electronic devices to perform at least a part of the function or service in addition to running the function or service. The one or more external electronic devices that receive the request may perform at least a part of the requested function or service, or perform additional functions or additional services related to the request, and transmit the result of the execution to the electronic device 101. The electronic device 101 may provide the result as at least part of the reply to the request, with or without further processing the result. To this end, cloud computing technology, distributed computing technology, mobile edge computing (MEC) technology, or client-server computing technology, for example, may be used. The electronic device 101 may provide ultra-low latency services using, for example, distributed computing or mobile edge computing. In another embodiment, the external electronic device 104 may include an Internet of Things (IoT) device. The server 108 may be an intelligent server using machine learning and / or neural networks. According to an embodiment, the external electronic device 104 or the server 108 may be included in the second network 199. The electronic device 101 may be applied to intelligent services (e.g., smart homes, smart cities, smart cars, or healthcare) based on 5G communication technology or IoT-related technologies.

[0049] The electronic device according to various embodiments may be one of various types of electronic devices. For example, the electronic device may include a portable communication device (e.g., a smart phone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a home appliance. According to an embodiment of the present disclosure, the electronic device is not limited to the above-mentioned devices.

[0050] It should be understood that the various embodiments of the present disclosure and the terms used therein are not intended to limit the technical features set forth herein to specific embodiments, but include various changes, equivalents or alternatives of the corresponding embodiments. Regarding the description of the accompanying drawings, similar reference numerals may be used to refer to similar or related elements. It should be understood that the singular form of the noun corresponding to the project may include one or more things, unless the relevant context clearly indicates otherwise. As used herein, each of the phrases such as "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "at least one of A, B or C" may be included in any one or all possible combinations of the items listed together with the corresponding phrases in the phrases. As used herein, terms such as "1st" and "2nd" or "first" and "second" may be used to simply distinguish the corresponding component from another component, and do not limit the component in other aspects (e.g., importance or order). It should be understood that if an element (e.g., a first element) is referred to as being “coupled”, “coupled to”, “connected to” or “connected to” another element (e.g., a second element) with or without the terms “operably” or “communicatively”, it means that the element can be coupled to the other element directly (e.g., wired), wirelessly or via a third element.

[0051] As used in conjunction with various embodiments of the present disclosure, the term "module" may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with other terms (e.g., "logic," "logic block," "component," or "circuit"). A module may be a single integrated component or its smallest unit or a portion thereof suitable for performing one or more functions. For example, according to an embodiment, a module may be implemented in the form of an application specific integrated circuit (ASIC).

[0052] The various embodiments described herein may be implemented as software (e.g., program 140) including one or more instructions stored in a storage medium (e.g., internal memory 136 or external memory 138) that can be read by a machine (e.g., electronic device 101). For example, under the control of a processor, a processor (e.g., processor 120) of the machine (e.g., electronic device 101) may call at least one of the one or more instructions stored in the storage medium and execute the at least one instruction with or without the use of one or more other components. This causes the machine to be operated to perform at least one function according to the at least one instruction called. One or more instructions may include code generated by a compiler or code executable by an interpreter. The machine-readable storage medium may be provided in the form of a non-transitory storage medium. Among them, the term "non-transitory" only means that the storage medium is a tangible device and does not include signals (e.g., electromagnetic waves), but the term does not distinguish between the case where data is semi-permanently stored in the storage medium and the case where data is temporarily stored in the storage medium.

[0053] According to an embodiment, the method according to various embodiments of the present disclosure may be included and provided in a computer program product. The computer program product may be traded as a product between a seller and a buyer. The computer program product may be distributed in the form of a machine-readable storage medium (e.g., a compact disk read-only memory (CD-ROM)), or may be distributed (e.g., downloaded or uploaded) online via an application store (e.g., PlayStoreTM), or may be distributed (e.g., downloaded or uploaded) directly between two user devices (e.g., smart phones). If distributed online, at least a portion of the computer program product may be temporarily generated or at least temporarily stored in a machine-readable storage medium (e.g., a memory of a manufacturer's server, an application store's server, or a relay server).

[0054] According to various embodiments, each of the above-mentioned components (e.g., a module or a program) may include a single entity or multiple entities, and some of the multiple entities may be separately arranged in different components. According to various embodiments, one or more of the above-mentioned components may be omitted, or one or more other components may be added. Alternatively or additionally, multiple components (e.g., a module or a program) may be integrated into a single component. In this case, according to various embodiments, the integrated component may still perform one or more functions of each of the multiple components in the same or similar manner as performed by a corresponding one of the multiple components before integration. According to various embodiments, the operations performed by a module, a program or another component may be performed sequentially, in parallel, repeatedly or heuristically, or one or more of the operations may be run or omitted in a different order, or one or more other operations may be added.

[0055] Figure 2 is a block diagram illustrating a procedure according to an embodiment of the present disclosure.

[0056] According to an embodiment, the program 140 may include an operating system (OS) 142 for controlling one or more resources of the electronic device 101, middleware 144, or an application 146 executable in the OS 142. The OS 142 may include, for example, an Android TM 、iOS TM , Windows TM , Symbian TM 、Tizen TM or Bada TM For example, at least a portion of program 140 may be preloaded on electronic device 101 during manufacturing, or may be downloaded from or updated by an external electronic device (eg, electronic device 102 or 104 or server 108) during user use.

[0057] OS 142 may control management (e.g., allocation or deallocation) of one or more system resources (e.g., processes, memory, or power) of electronic device 101. Additionally or alternatively, OS 142 may include one or more drivers to drive other hardware devices of electronic device 101, such as input module 150, sound output module 155, display module 160, audio module 170, sensor module 176, interface 177, haptic module 179, camera module 180, power management module 188, battery 189, communication module 190, subscriber identification module 196, or antenna module 197.

[0058] The middleware 144 may provide various functions to the application 146 so that the application 146 can use functions or information provided from one or more resources of the electronic device 101. For example, the middleware 144 may include an application manager 201, a window manager 203, a multimedia manager 205, a resource manager 207, a power manager 209, a database manager 211, a package manager 213, a connection manager 215, a notification manager 217, a location manager 219, a graphic manager 221, a security manager 223, a telephony manager 225, or a voice recognition manager 227.

[0059] For example, the application manager 201 can manage the life cycle of the application 146. For example, the window manager 203 can manage one or more graphical user interface (GUI) resources used on the screen. For example, the multimedia manager 205 can identify one or more formats to be used to play the media file, and can encode or decode the corresponding media file in the media file using a codec suitable for the corresponding format selected from the one or more formats. The resource manager 207 can, for example, manage the source code of the application 146 or the memory space of the memory 130. The power manager 209 can, for example, manage the capacity, temperature or power of the battery 189, and determine or provide relevant information to be used for the operation of the electronic device 101 based at least in part on the corresponding information of the capacity, temperature or power of the battery 189. According to an embodiment, the power manager 209 can cooperate with a basic input / output system (BIOS) (not shown) of the electronic device 101.

[0060] For example, the database manager 211 can generate, search or change the database to be used by the application 146. For example, the package manager 213 can manage the installation or update of the application distributed in the form of a package file. For example, the connection manager 215 can manage the wireless connection or direct connection between the electronic device 101 and the external electronic device. For example, the notification manager 217 can provide a function of notifying the user that a specified event (e.g., an incoming call, message, or alarm) has occurred. For example, the location manager 219 can manage the location information about the electronic device 101. For example, the graphic manager 221 can manage one or more graphic effects to be provided to the user or a user interface related to one or more graphic effects.

[0061] For example, the security manager 223 can provide system security or user authentication. For example, the phone manager 225 can manage the voice call function or video call function provided by the electronic device 101. For example, the voice recognition manager 227 can send the user's voice data to the server 108, and receive from the server 108 a command corresponding to a function to be performed on the electronic device 101 based at least in part on the voice data or at least in part on the text data converted from the voice data. According to an embodiment, the middleware 244 can dynamically delete some existing components or add new components. According to an embodiment, at least a portion of the middleware 144 can be included as a part of the OS 142, or can be implemented as another software separated from the OS 142.

[0062] The application 146 may include, for example, a home page 251, a dialer 253, a short message service (SMS) / multimedia message service (MMS) 255, an instant message (IM) 257, a browser 259, a camera 261, an alarm clock 263, a contact 265, a voice recognition 267, an email 269, a calendar 271, a media player 273, an album 275, a watch 277, a health 279 (e.g., for measuring exercise level or biometric information, such as blood sugar) or an environmental information 281 (e.g., for measuring air pressure, humidity or temperature information) application. According to an embodiment, the application 146 may also include an information exchange application (not shown) capable of supporting information exchange between the electronic device 101 and an external electronic device. For example, the information exchange application may include a notification relay application adapted to transmit specified information (e.g., a call, a message or an alarm) to an external electronic device or a device management application adapted to manage an external electronic device. The notification relay application may transmit notification information corresponding to a specified event (e.g., receiving an email) occurring in another application (e.g., an email application 269) of the electronic device 101 to the external electronic device. Additionally or alternatively, the notification relay application may receive notification information from an external electronic device and provide the notification information to a user of the electronic device 101 .

[0063] The device management application may control power (e.g., turning on or off) or functionality (e.g., adjusting brightness, resolution, or focus) of the external electronic device or some of its components (e.g., a display module or a camera module of the external electronic device). Additionally or alternatively, the device management application may support installation, deletion, or updating of applications executed on the external electronic device.

[0064] When a server (e.g., an edge server) provides authentication services, there is a risk of exposing the user's credentials and / or personal information under an attack against the server because the server manages the user's credentials and / or personal information and performs user authentication. For passwordless authentication, the authentication server is vulnerable to software attacks, which may limit the availability of authentication services for user devices.

[0065] The present disclosure provides a method for implementing a method in an electronic device (e.g., Figure 1 A method for protecting the user's credential information within an electronic device 101 instead of an external server (eg, an edge server) and directly authenticating the user using the credential information within the electronic device.

[0066] In the present disclosure, a hardware-based trusted execution environment (TEE) technology can be used to securely store and / or manage user credentials required for user login (or user authentication). In the present disclosure, the authentication scheme based on user credentials can be protected by hardware technology, and the user can directly control the authentication scheme, thereby strengthening the data self-sovereign identity. The authentication scheme according to the present disclosure can provide an on-device authentication function, and the on-device authentication function can be protected to prevent software attacks or phishing attacks.

[0067] Figure 3a An example of providing a sign in function in an electronic device according to an embodiment of the present disclosure is shown.

[0068] refer to Figure 3a , electronic devices (e.g. Figure 1 The electronic device 101 may provide a user interface (UI) to enable the electronic device (eg, Figure 1 electronic device 101) or an external electronic device (e.g., Figure 1 The electronic device 102 or the electronic device 104) performs the login function.

[0069] Figure 3b An example of providing a login function through passwordless authentication in an electronic device according to an embodiment of the present disclosure is shown.

[0070] refer to Figure 3b , which can be used in electronic devices (e.g. Figure 1 The electronic device 101 of the present invention uses hardware-based TEE technology without a password to protect the user credentials. According to an embodiment, the user credentials can be a password, fingerprint, face, voice, iris, palm, or finger vein pattern that can identify the owner.

[0071] Figure 4 is a diagram illustrating a user authentication method according to an embodiment of the present disclosure.

[0072] refer to Figure 4, the system includes an electronic device 400 (eg, Figure 1 The electronic device 101 of the present invention includes an account service server 410 and an application server 420. The account service server 410 can manage the user account of the electronic device 400 and use the user credentials to authenticate the user. The application server 420 is a server that can provide services and / or content to the electronic device 400, and when receiving the authorization code from the electronic device 400, the application server 420 can obtain the user account information from the account service server 410.

[0073] Application 401 and account service application 403 may be installed on electronic device 400 and / or executed on electronic device 400. Application 401 may communicate with application server 420 and send and receive data and / or information to and from application server 420, and account service application 403 may communicate with account service server 410 and send and receive data and / or information to and from account service server 410.

[0074] The account service server 410 may include: an authentication module 411 for user authentication; an authorization module 413 for issuing an authorization code so that an external server (e.g., application server 420) can obtain user account information; and a resource server 415 for providing an access token and / or user account information to an external server (e.g., application server 420).

[0075] Electronic device 400 may receive user credentials from the credential owner and send the received user credentials to account service server 410. Upon receiving the user credentials, account service server 410 may use the user credentials to perform user verification, and when user verification is complete, send an authorization code for the user to electronic device 400.

[0076] In operation S401, the application 401 in the electronic device 400 may request authorization by sending a request for authorization to the account service application 403. According to an embodiment, the request for authorization may be<response_type=code,client_id=CLIENT_ID,redirect_uri=CALLBACK_URL,scope=read> realized in the form of .

[0077] In operation S402 , the account service application 403 may receive user credentials based on user input.

[0078] In operation S403, the account service application 403 may send an authorization request to the authorization module 413 in the account service server 410 to request authorization. According to an embodiment, the authorization request may include user credentials. According to an embodiment, the authorization request may be in the form of<response_type=code,client_id=CLIENT_ID,redirect_uri=CALLBACK_URL,scope=read,User credential> realized in the form of .

[0079] In operation S404, the authentication module 411 and the authorization module 413 in the account service server 410 may exchange user verification related messages with each other. According to an embodiment, the user verification related messages may include user credentials.

[0080] In operation S405, the authorization module 413 in the account service server 410 may send the verified user authentication information to the account service application 403. In operation S406, the account service application 403 may receive a user authorization permission based on the user input.

[0081] In operation S407, account service application 403 may send the user authorization permission to authorization module 413 in account service server 410. In operation S408, authorization module 413 in account service server 410 may send a response message including an authorization code to account service application 403 (using authorization code<authorization code> to reply).

[0082] In operation S409, account service application 403 may send an authorization code to application 401. In operation S410, application 401 may send an authorization code to application server 420. In operation S411, application server 420 may send an access token request (Access Token Request) including the authorization code to authorization module 413 in account service server 410. <authorizationcode>).

[0083] In operation S412, the authorization module 413 in the account service server 410 may send an access token permission (Access Token Permission) including the access token to the application server 420.<access token> In operation S413, the application server 420 may send a user information request (requesting user information) including a Call API with an access token to the resource server 415.<Call API w / access token> In operation S414 , the resource server 415 may send user account information (user account info) to the application server 420 .

[0084] Figure 5 is a diagram illustrating a system according to an embodiment of the present disclosure.

[0085] refer to Figure 5 , the system may include an electronic device 500 (eg, Figure 1 electronic device 101), server 560 (for example, Figure 1 server 108), a first external electronic device 570 (eg, Figure 1 electronic device 102) and a second external electronic device 580 (eg, Figure 1 electronic device 104). Figure 4 Unlike the electronic device 400 that performs user authentication through an external server (eg, account service server 410), Figure 5 The electronic device 500 may have multiple modules to perform user authentication by itself.

[0086] The electronic device 500 may include a secure area (or domain world; or secure world) and a non-secure area (or non-secure world; or normal world), each area independently executing applications and / or services (or application codes). According to an embodiment, the secure area and the non-secure area may be two worlds physically (or in hardware) separated within the electronic device 500. According to an embodiment, applications and / or services (or application codes) that need to protect user privacy or personal information may be executed in the secure area. For example, the non-secure area may be implemented in an Android environment (or a rich execution environment (REE)), and the secure area may be implemented in a TEE that is physically isolated from Android.

[0087] The electronic device 500 may include an authenticator application (App) (host process) 510 executed in a non-secure area for user authentication, an authenticator application (domain VM) 520 executed in a secure area for user authentication, a remote monitoring and management (RMM) 530 implemented in a secure area, a kernel 540 implemented in a non-secure area, and a root 550 implemented in a non-secure area. In the present disclosure, the authenticator applications 510 and 520 for user authentication may be executed in a non-secure area and a secure area in the electronic device 500, respectively, and user credentials may be protected and / or used by the authenticator application 520 executed in a secure area that is inaccessible to external devices, thereby enhancing the protection of privacy information.

[0088] The authenticator application 510 executed in the non-secure area may include an authenticator agent 511. The authenticator agent 511 may relay communication between the authenticator application 520 executed in the secure area and an external device (eg, server 560, first external electronic device 570, and / or second external electronic device 580).

[0089] The authenticator application 520 executed in the secure area may include an application UI module 521 that provides a UI, an authentication module 522 that performs user verification, a token generation module 523 that issues an access token, an authorization module 524, and a resource server module 525 that provides user information and / or an access token to an external server. The authenticator application 520 executed in the secure area may include an integrity measurement value 526, a public key 527 of a service provider 561, and a certificate chain of a public key 528 of a certification authority (CA).

[0090] The RMM 530 is firmware executed in a secure area and can manage a stage page table of the secure area and a CPU context of a domain. According to an embodiment, a domain may refer to a software (SW) program executed at an exception level 0 or 1 on the RMM 530. According to an embodiment, a domain may include all of ART, shim, and applications.

[0091] The server 560 may also be referred to as a remote server, and may be implemented as a cloud server or an edge server that provides services and / or content to the electronic device 500. The server 560 may include a service provider 561 that provides services and / or content to the electronic device 500.

[0092] The first external electronic device 570 may be an electronic device (e.g., a TV) on which a dependent application 571 is installed. The dependent application 571 may request user authentication from the electronic device 500, receive an access token from the electronic device 500, and send the access token to the server 560. According to an embodiment, the dependent application 571 may be installed and / or executed on the electronic device 500 instead of the first external electronic device 570. The second external electronic device 580 may be an electronic device (e.g., a Wi-Fi router) including a service registry 581.

[0093] Figure 6 is a diagram showing a packaging structure of an authenticator application according to an embodiment of the present disclosure.

[0094] The authenticator application package 600 is provided by a service provider (e.g. Figure 5 The credential owner can download the authenticator application package on an electronic device (eg, a smartphone).

[0095] refer to Figure 6 , the package 600 of the authenticator application may include an application UI module 601, an authentication module 602, a token generation module 603, an authorization module 604, a resource server module 605, and an authenticator agent 605. According to an embodiment, the package 600 of the authenticator application may also include a runtime image module 607. According to an embodiment, the package 600 of the authenticator application may also include an OS / kernel image module 608.

[0096] The package 600 of the authenticator application may include a package provided by a service provider (e.g., Figure 5 The package 600 of the authenticator application may include a certificate 608 signed by the public key of the service provider 561 of the CA, and the certificate 608 may include an integrity measurement value 609. The package 600 of the authenticator application may include a certificate 610 signed by the CA, and the certificate 610 may include the public key of the service provider 611. According to an embodiment, the package 600 of the authenticator application may also include a certificate chain 612 of the public key of the CA.

[0097] Service providers (e.g. Figure 5 The service provider 561 of the authenticator application can package the authenticator application into the virtual machine image. The service provider (e.g., Figure 5 The service provider 561 of can have metadata and package image. In an embodiment, the service provider (e.g., Figure 5 The service provider 561) may have (or encapsulate) a certificate 608 including an integrity measurement value 609 of a virtual machine image to execute in a secure area including the application UI module 601, the authentication module 602, the token generation module 603, and the authorization module 604. In an embodiment, the service provider may have (or encapsulate) a runtime image 607 and an OS / kernel image 608. In an embodiment, the service provider may have (or encapsulate) a certificate including an integrity measurement value 609 of a virtual machine image to execute in a secure area including the application UI module 601, the authentication module 602, the token generation module 603, and the authorization module 604. According to an embodiment, the service provider may have (or encapsulate) a certificate signed by a private key of a CA, the certificate including a public key of the provider. According to an embodiment, the service provider may have (or encapsulate) a certificate chain 612, which may be used to obtain and verify the public key of the CA.

[0098] According to an embodiment, the virtual machine image may be provided by a service provider (e.g., Figure 5 In an embodiment, the service provider (e.g., Figure 5 An application packaged by a service provider 561) can be uploaded to the application market. The credential owner can download the authenticator application package on an electronic device (e.g., a smart phone). The integrity of the image for execution in the secure area can be verified using a certificate 908 including an integrity measurement value 609. According to an embodiment, in addition to the certificate and certificate chain, the relying application can also request the authenticator application to perform remote authentication. The certificate chain can be used to verify the validity of the certificate 608 including the integrity measurement value 609. The integrity measurement value 609 can then be compared with the remote authentication, and the integrity of the authenticator can be verified in the relying application.

[0099] Figure 7 is a diagram showing an internal configuration of an electronic device in which a packaged authenticator application is executed according to an embodiment of the present disclosure.

[0100] When a service provider (e.g. Figure 5 The authenticator application package generated by the service provider 561) is downloaded to the electronic device (e.g., Figure 5 When the authenticator application is on an electronic device 500), the authenticator application can be implemented in the form of a SW stack in the electronic device.

[0101] refer to Figure 7 , the SW stack 700 of the authenticator application may include an authenticator application 710 that may be executed in a non-secure area, and the authenticator application 710 may include an authenticator agent 711. The authenticator agent 711 may relay communication between the authenticator application 720 executed in the secure area and an external device (e.g., the server 560, the first external electronic device 570, and / or the second external electronic device 580).

[0102] The SW stack 700 of the authenticator application may include an authenticator application 720 that may be executed in a secure area, and the authenticator application 720 may include an application UI module 721, an authentication module 722, a token generation module 723, an authorization module 724, a resource server module 725, and a runtime image module 726. According to an embodiment, the authenticator application 720 that may be executed in a secure area may further include an OS / kernel image module 727.

[0103] The database or storage device 730 in the electronic device may include a SW stack 700, which includes SW binary files, Figure 5 The database or storage device 730 may further include a certificate chain 733 of the public key of the CA. According to an embodiment, the certificate chain 733 of the public key of the CA may be signed by the service provider (e.g., Figure 5 The certificate 731 signed by the public key of the service provider 561 of the CA may include the integrity measurement value 732. According to an embodiment, the certificate 733 signed by the CA may include the public key 734 of the service provider.

[0104] During credential holder registration, the credential holder may first register and subscribe to the service. The initial registration process may be the same as the original online registration process for the service. In an embodiment, after the initial registration, the credential holder may first have to download the required user data to an electronic device (e.g., a smartphone).

[0105] The credential owner can start the authenticator application. The credential owner can start the initial preparation of the authenticator application through the UI and trusted I / O.

[0106] In the non-secure area (or non-secure world; or normal world), the authenticator agent 711 can connect to the remote server of the service provider. Remote authentication and verification are performed, and the authenticator application 720 in the secure area (or domain world; or secure world) and the remote server can be securely connected (through the authenticator agent 711 in the non-secure area).

[0107] Figure 8 is a diagram illustrating a data structure for credential user registration stored in an electronic device according to an embodiment of the present disclosure.

[0108] refer to Figure 8 , the electronic device may include a storage device 800 and a secure execution HW 830. The storage device 800 may be implemented as a persistent storage device, and the secure execution HW 830 may be implemented as a secure storage device or a secure element.

[0109] The storage device 800 in the electronic device may include a certificate 810 signed by the public key of the service provider and a certificate 812 signed by the CA. In an embodiment, the storage device 800 may also include a certificate chain 814 of the public key of the CA. According to an embodiment, the certificate 810 signed by the public key of the service provider may include an integrity measurement value 811. According to an embodiment, the certificate 812 signed by the CA may include a public key 813 of the service provider.

[0110] The storage device 800 in the electronic device may include data 820 to 823 encrypted by a sealing key 831 stored in the security-enhanced HW 830. The data 820 to 823 encrypted by the sealing key 831 may include a user credential 820, a subscription status 821, a user profile 822, and an encryption key 823. According to an embodiment, the authenticator application in the secure area may download user data including the user credential, the subscription status, the user profile, and the encryption key through a secure channel.

[0111] In the present disclosure, user credentials, subscription status, user profile, and encryption keys may be defined as follows.

[0112] 1) User credentials

[0113] This can be a password, fingerprint, face, voice, iris, palm or finger vein pattern, which can identify the credential owner and is provided to the account service provider during the initial registration process.

[0114] 2) Subscription status

[0115] Information about the subscription registered and paid for by the credential holder

[0116] 3) User Profile

[0117] Personal information, such as username, email address, phone number, etc.

[0118] 4) Encryption Key

[0119] The shared key information between the authenticator application generated by the service provider and the remote server of the service provider is used to generate and verify the access token. Each authentication token generated can be signed and verified by the shared key information.

[0120] According to an embodiment, the authenticator application may seal the provided data. According to an embodiment, the authenticator application may securely store confidential data in a persistent storage device using standard techniques in the field of trusted computing. According to an embodiment, the user data may be encrypted using an encryption key generated directly by the authenticator, and the key may be stored in hardware. Since the stored key is only available to the authenticator, only the authenticator can decrypt the user data.

[0121] The authenticator application may generate a sealing key to encrypt the provided data. Depending on the embodiment, the sealing key may be an encryption key different from the encryption key provided by the service provider. The authenticator application may encrypt the provided user data using the sealing key generated for the user data.

[0122] The authenticator app can store encrypted user data in on-device persistent storage and store the sealing key with hardware-enforced security. Since the sealing key is only retrieved by the authenticator, only the authenticator app can decrypt the user data. Only the authenticator app can unseal the user data.

[0123] According to an embodiment, the application-dependent client key registration process may be performed in the following 1) to 3).

[0124] 1) The credential owner may download the dependent application on another electronic device (or user device) that is to use the service (after being authenticated by the authenticator application).

[0125] 2) After remote authentication and verification, the dependent application can connect to the server (or remote server) through a secure channel.

[0126] 3) The dependent application may download the client key from the service provider's server (or remote server). According to an embodiment, the client key may be considered to have been registered with the server in terms of authentication. According to an embodiment, operation 3) may be performed based on the client key registration process of OAuth 2.0.

[0127] Fig. 9 is a diagram showing an example for describing a user authentication method on a device according to an embodiment of the present disclosure.

[0128] refer to Fig. 9 , the system may include an electronic device 900 , a server 930 , and an external electronic device 940 .

[0129] The electronic device 900 may include a secure area (or domain world; or secure world) and a non-secure area (or non-secure world; or normal world), and applications and / or services (or application codes) may be independently executed in each of the secure area and the non-secure area. According to an embodiment, the secure area and the non-secure area may be physically (or hardware-wise) separated worlds in the electronic device 900. According to an embodiment, applications and / or services (or application codes) that need to protect user privacy or personal information may be executed in the secure area. For example, the non-secure area may be implemented in an Android environment or REE, and the secure area may be implemented in a TEE that is physically isolated from Android.

[0130] The electronic device 900 may include an authenticator application (host process) 910 executed in a non-secure area and an authenticator application 920 executed in a secure area. The authenticator application 910 executed in the non-secure area may include an authenticator agent 911. The authenticator application 920 executed in the secure area may include an application UI module 921, an authentication module 922, and a token generation module 923.

[0131] The server 930 may also be referred to as a remote server or an application server, and is implemented as a cloud server or an edge server that provides services and / or content to the electronic device 900 .

[0132] The external electronic device 940 may be an electronic device (eg, a TV) on which the dependent application 941 is installed. According to an embodiment, the dependent application 941 may be installed and / or executed on the electronic device 900 instead of the external electronic device 940.

[0133] refer to Fig. 9 In operation S901, the dependent application 941 may send an authentication request message to the authenticator agent 911. In operation 902, the application UI module 921 may receive a user credential request via the UI. In operation 903, the application UI module 921 may receive a user credential input from a credential owner.

[0134] In operation 904, the application UI module 921 may send the user credentials via the UI to the authentication module 922. In operation 905, the authentication module 922 may send a token generation request to the token generation module 923. In operation 906, the token generation module 923 may send an access token to the authentication module 922 in response to the token generation request. In an embodiment, the authentication module 922 may send the access token to the authenticator agent 911 in the non-secure area.

[0135] In operation 907, the authenticator agent 911 in the non-secure area may send an access token to a dependent application 941 in the external electronic device 940. In operation 908, the dependent application 941 may send the access token to the server 930.

[0136] Fig.10 is a diagram showing another example for describing a user authentication method on a device according to an embodiment of the present disclosure.

[0137] refer to Fig.10 , the system may include an electronic device 1000 and a dependent application 1030. The electronic device 1000 may include a secure area (or domain world; or secure world) and a non-secure area (or non-secure world; or normal world), and applications and / or services (or application codes) may be independently executed in each of the secure area and the non-secure area. According to an embodiment, the secure area and the non-secure area may be physically (or in hardware) separated worlds in the electronic device 1000. According to an embodiment, applications and / or services (or application codes) that need to protect user privacy or personal information may be executed in the secure area. For example, the non-secure area may be implemented in an Android environment or REE, and the secure area may be implemented in a TEE that is physically isolated from Android.

[0138] The electronic device 1000 may include an authenticator application (host process) 1010 executed in a non-secure area and an authenticator application 1020 executed in a secure area. The authenticator application 1010 executed in the non-secure area may include an authenticator agent 1011. The authenticator application 1020 executed in the secure area may include an application UI module 1021, an authentication module 1022, a token generation module 1023, and a resource server 1024.

[0139] The dependent application 1030 may be installed and / or executed on the external electronic device. According to an embodiment, the dependent application 1030 may be installed and / or executed on the electronic device 1000.

[0140] refer to Fig.10 In operation S1001 , the dependent application 1030 may send an access token request to the authentication module 1022 in the secure area through the authenticator agent 1011 in the non-secure area.

[0141] In operation S1002, the application UI module 1021 in the secure area may request user credentials and permission request via the UI. In operation S1003, the application UI module 1021 may receive user credential input and permission input from the credential owner.

[0142] In operation S1004, the application UI module 1021 may send the user credentials and permission via the UI to the authentication module 1022. In operation S1005, the authentication module 1022 may send a token generation request to the token generation module 1023. In operation S1006, the token generation module 1023 may send an access token to the authentication module 1022 in response to the token generation request. In operation S1008, the resource server 1024 may send the access token to the dependent application 1030 through the authenticator proxy 1011.

[0143] Fig.11 is a flowchart illustrating the operation of an electronic device according to an embodiment of the present disclosure.

[0144] refer to Fig.11 In operation 1110, an electronic device (eg, Figure 1 Electronic equipment 101 or Figure 5 The electronic device 500 may be executed in a secure area by a first authenticator application ( Figure 5 The electronic device may execute a user authentication process in the first authenticator application in the secure area based on the user credentials. In operation 1130, when the user authentication process is successfully completed in the first authenticator application in the secure area, the electronic device may issue an access token in the first authenticator application in the secure area. In operation 1140, the electronic device may execute a second authenticator application ( Figure 5 The authenticator application 510 of the present invention sends the access token issued by the first authenticator application in the secure area to the external electronic device.

[0145] According to an embodiment, the non-secure area may be implemented in REE, and the secure area may be implemented in TEE. According to an embodiment, the electronic device may receive an authentication request message from an external electronic device through a second authenticator application in the non-secure area.

[0146] According to an embodiment, the first authenticator application in the secure area may include at least one of the following: an integrity measurement value, a public key of a service provider, or a certificate chain of a public key of a CA. According to an embodiment, the electronic device may also include an RMM implemented in the secure area, the RMM managing the stage page table of the secure area and managing the CPU context of the domain.

[0147] According to an embodiment, the memory may include a first storage device and a second storage device. The first storage device may include a sealing key. The second storage device may include user credentials, subscription status, user profile, and encryption key encrypted based on the sealing key.

[0148] According to an embodiment, the first authenticator application in the secure area may include an application UI module that provides a UI, an authentication module that performs a user authentication process, a token generation module that issues an access token, and a resource server module that sends user information and the access token to an external server. According to an embodiment, the user credential may include at least one of a password, fingerprint, face, voice, iris, palm or finger vein pattern that can identify the owner of the user credential.< / authorizationcode>

Claims

1. An electronic device (electronic device 101 in FIG. 1 ; electronic device 500 in FIG. 5 ), comprising: Memory (memory 130 of FIG. 1 ); as well as at least one processor (processor 120 of FIG. 1 ), connected to the memory, Wherein, the at least one processor is configured to control the following operations: receiving user credentials by a first authenticator application (authenticator application 520 of FIG. 5 ) executed in a secure area, and performing a user authentication process in the first authenticator application in the secure area based on the user credentials, When the user authentication process is successfully completed in the first authenticator application in the secure area, controlling the first authenticator application in the secure area to issue an access token, and The access token issued in the first authenticator application in the secure area is transmitted to an external electronic device through a second authenticator application (authenticator application 510 of FIG. 5 ) executed in the non-secure area.

2. The electronic device according to claim 1, wherein: The non-secure area is implemented in a rich execution environment (REE), and the secure area is implemented in a trusted execution environment (TEE).

3. The electronic device according to claim 1 or 2, wherein: The at least one processor is configured to receive an authentication request message from the external electronic device through the second authenticator application in the non-secure area.

4. The electronic device according to any one of claims 1 to 3, wherein: The first authenticator application in the secure area includes at least one of: an integrity measurement value, a public key of a service provider, or a certificate chain of a public key of a certification authority CA.

5. The electronic device according to any one of claims 1 to 4, further comprising a remote monitoring and management (RMM) implemented in the secure area, wherein the RMM is configured to manage a stage page table of the secure area and a CPU context of a management domain.

6. The electronic device according to any one of claims 1 to 5, wherein: The memory includes a first storage device and a second storage device, wherein the first storage device includes a sealing key, and The second storage device includes user credentials, subscription status, user profile and encryption key encrypted based on the sealing key.

7. The electronic device according to any one of claims 1 to 6, wherein: The first authenticator application in the secure area comprises: An application user interface UI module is configured to provide a UI; An authentication module, configured to perform the user authentication process; a token generation module configured to issue the access token; and The resource server module is configured to send the user information and the access token to the external server.

8. The electronic device according to any one of claims 1 to 7, wherein: The user credential includes at least one of a password, fingerprint, face, voice, iris, palm or finger vein pattern for identifying the owner of the user credential.

9. A method for operating an electronic device (electronic device 101 of FIG. 1 ; electronic device 500 of FIG. 5 ), comprising: obtaining, by a first authenticator application (authenticator application 520 of FIG. 5 ) executing in the secure area, user credentials corresponding to the user input; performing a user authentication process in the first authenticator application in the secure area based on the user credentials; issuing an access token in the first authenticator application in the secure area when the user authentication process is successfully completed in the first authenticator application in the secure area; as well as The access token issued in the first authenticator application in the secure area is transmitted to an external electronic device through a second authenticator application (authenticator application 510 of FIG. 5 ) executed in the non-secure area.

10. The method according to claim 9, wherein: The non-secure area is implemented in a rich execution environment (REE), and the secure area is implemented in a trusted execution environment (TEE). 11 . The method according to claim 9 or 10 , further comprising receiving an authentication request message from the external electronic device through the second authenticator application in the non-secure area.

12. The method according to any one of claims 9 to 11, wherein: The first authenticator application in the secure area includes at least one of: an integrity measurement value, a public key of a service provider, or a certificate chain of a public key of a certification authority CA.

13. The method according to any one of claims 9 to 12, wherein: The electronic device further includes a remote monitoring and management RMM implemented in the secure area, the RMM managing a stage page table of the secure area and managing a CPU context of a domain.

14. The method according to any one of claims 9 to 13, wherein: The memory includes a first storage device and a second storage device, wherein the first storage device includes a sealing key, and The second storage device includes user credentials, subscription status, user profile and encryption key encrypted based on the sealing key.

15. The method according to any one of claims 9 to 14, wherein: The first authenticator application in the secure area comprises: An application user interface UI module is configured to provide a UI; An authentication module, configured to perform the user authentication process; a token generation module configured to issue the access token; and The resource server module is configured to send the user information and the access token to the external server.

Images