Communication method and device for client application and trusted application, terminal and medium

Abstract

The invention provides a communication method and device for a client application and a trusted application, a terminal and a medium, and relates to the technical field of communication. The method is applied to a TEE agent module of which a terminal is deployed in a rich execution environment (REE), and comprises the following steps: in response to a target access request sent by a target client application for a target trusted application, obtaining first double linked list information corresponding to a target channel, updating the first double linked list information according to information carried in the target access request to obtain second double linked list information; wherein the target channel is a channel between the target client application and the target trusted application; and refusing to use the target channel under the condition that the second double linked list information meets the preset limitation strategy. According to the invention, the effective utilization rate of TEE resources is improved, and the stability of a trusted execution environment TEE is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method, device, terminal and medium between a client application and a trusted application. Background Art

[0002] With the development of science and technology, in order to build a security framework for terminals to resist various possible attacks, the existing technology has designed a hardware architecture TrustZone platform for terminals. The TrustZone platform conceptually divides the hardware and software resources of the system-on-chip (SoC) into two worlds: secure (Secure World) and non-secure (NormalWorld). The secure world is configured with a trusted execution environment (TEE), and the non-secure environment is configured with a rich execution environment (REE). All operations that need to be kept confidential in the terminal are executed in the secure world (such as fingerprint recognition, password processing, data encryption and decryption, security authentication, etc.), and the remaining operations are executed in the non-secure world (such as user operating system, various applications, etc.). The secure world and the non-secure world are converted through the Monitor Mode mode.

[0003] The communication rules between the client application (CA) and the trusted application (TA) on the rich execution environment REE side of the TrustZone platform are: CA calls the OpenSession interface / CloseSession interface in the GP (Global Platform) specification, the trusted execution environment TEE loads the required TA from the rich execution environment REE, and CA establishes / closes the session channel with the TA. In the process of realizing communication through the session channel, the existing technology needs to copy the TA of the rich execution environment REE to the trusted execution environment TEE for operation, and then realize functions such as data copying, TA integrity verification, TA authentication, and TA access to secure files, which consumes a lot of resources.

[0004] In addition, the CA developed by the third-party company frequently calls the OpenSession interface to establish a connection with the TA. Frequent operations easily lead to TEE resources being occupied by a single TA, affecting the efficiency of fingerprint, password, security authentication and other functions. Therefore, the existing technology occupies a large amount of TEE resources due to frequent operations, which easily leads to problems such as waste of resources, blocking of other security services, and poor stability of the trusted execution environment TEE. Summary of the invention

[0005] The present application provides a method, device, terminal and medium for communication between a client application and a trusted application, so as to solve the problems in the prior art of TEE resource waste and poor stability of the trusted execution environment (TEE) caused by frequent access of a single client application to a trusted application.

[0006] According to a first aspect of the present application, a method for communicating between a client application and a trusted application is provided, which is applied to a TEE agent module deployed in a rich execution environment (REE) by a terminal, and the method comprises:

[0007] In response to a target access request for a target trusted application sent by a target client application, first bidirectional linked list information corresponding to a target channel is obtained, and the first bidirectional linked list information is updated according to information carried in the target access request to obtain second bidirectional linked list information; wherein the target channel is a channel between the target client application and the target trusted application;

[0008] When the second bidirectional linked list information satisfies the preset restriction policy, the target channel is refused to be used.

[0009] Optionally, the second bidirectional linked list is composed of nodes, wherein different nodes represent access requests for the target trusted application sent by the same target client application at different time points; the tail node of the second bidirectional linked list is the target node corresponding to the target access request;

[0010] The second bidirectional linked list information includes the number of nodes in the second bidirectional linked list and the time difference between the tail node and the head node of the second bidirectional linked list;

[0011] The preset restriction strategy includes: preset restriction on single access time length and / or preset restriction on number of times;

[0012] The second bidirectional linked list information satisfies the preset restriction strategy, including at least one of the following:

[0013] The number of nodes in the second bidirectional linked list exceeds the preset limit number of times;

[0014] The time difference between the tail node and the head node of the second bidirectional linked list exceeds the preset limit single access time length.

[0015] Optionally, after updating the first bidirectional linked list information according to the information carried in the target access request to obtain the second bidirectional linked list information, the method further includes:

[0016] Receiving the initial restriction policy of the target channel sent by the upper layer process of the terminal through a target communication mode; wherein the target communication mode includes a Socket communication mode;

[0017] Adjusting the initial restriction strategy to obtain an adjusted restriction strategy;

[0018] When the time of the target node is within the time period between the start time and the end time of the adjusted restriction policy, the adjusted restriction policy is determined as the preset restriction policy; or, when the time of the target node is within the time period between the start time and the end time of the initial restriction policy, the initial restriction policy is determined as the preset restriction policy.

[0019] Optionally, after determining the adjusted restriction strategy as the preset restriction strategy, or after determining the initial restriction strategy as the preset restriction strategy, the method further includes:

[0020] Determine whether the second bidirectional linked list information satisfies a preset restriction strategy;

[0021] In the case that the second bidirectional linked list information does not satisfy the preset restriction policy, the channel of the target channel is called to establish an OpenSession interface, so as to send the target access request to the target trusted application through the target channel.

[0022] Optionally, the start time of the adjusted restriction policy is later than the end time of the initial restriction policy.

[0023] Optionally, before refusing to use the target channel, the method further includes:

[0024] Creating a first pointer and a tail pointer for the second doubly linked list;

[0025] The node pointed to by the first pointer and the node pointed to by the last pointer are respectively determined as the first node and the last node of the second bidirectional linked list.

[0026] Optionally, when refusing to use the target channel, the method further includes:

[0027] A notification including a target error code is sent to the target client application, so that the target client application releases the shared memory resources of the trusted execution environment TEE where the target trusted application is located based on the target error code; wherein the target error code is used to indicate that the error type of the access failure is to restrict access to the target trusted application.

[0028] According to a second aspect of the present application, a communication device between a client application and a trusted application is provided, which is applied to a TEE agent module deployed in a rich execution environment (REE) by a terminal, and the device includes:

[0029] an acquisition and update module, configured to obtain, in response to a target access request for a target trusted application sent by a target client application, first bidirectional linked list information corresponding to a target channel, and update the first bidirectional linked list information according to information carried in the target access request to obtain second bidirectional linked list information; wherein the target channel is a channel between a target client application and a target trusted application;

[0030] A rejection module is used to reject the use of the target channel when the second bidirectional linked list information meets a preset restriction policy.

[0031] According to a third aspect of the present application, a terminal is provided, comprising: a TEE agent module and at least one target client application deployed in a rich execution environment REE, and at least one target trusted application deployed in a trusted execution environment TEE.

[0032] According to a fourth aspect of the present application, a computer-readable storage medium is provided, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the communication method between the client application and the trusted application as described in the first aspect above.

[0033] According to a fifth aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the communication method between a client application and a trusted application described in the first aspect.

[0034] The present application provides a method for communicating between a client application and a trusted application, which is applied to a TEE proxy module deployed in a rich execution environment (REE) at a terminal. The method comprises: in response to a target access request for a target trusted application sent by a target client application, obtaining first bidirectional linked list information corresponding to a target channel, and updating the first bidirectional linked list information according to information carried in the target access request to obtain second bidirectional linked list information; wherein the target channel is a channel between a target client application and a target trusted application; and when the second bidirectional linked list information satisfies a preset restriction policy, refusing to use the target channel.

[0035] The second bidirectional linked list information in the present application can reflect the current usage of the target channel in real time. When the second bidirectional linked list information meets the preset restriction policy, the target channel is refused to be used, and access to the target trusted application is refused. A large amount of TEE resources will no longer be occupied, and the distribution of TEE resources on each task can be balanced, thereby improving the stability of the trusted execution environment TEE.

[0036] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0038] Figure 1 A schematic diagram of a flow chart of a method for communication between a client application and a trusted application provided in an embodiment of the present application;

[0039] Figure 2 A flow chart of another method for communicating between a client application and a trusted application provided in an embodiment of the present application;

[0040] Figure 3 A schematic diagram of the structure of a communication device between a client application and a trusted application provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of the structure of a terminal provided in an embodiment of the present application.

[0042] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0043] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0044] In the process of achieving communication through the session channel, the existing technology needs to copy the TA of the enriched execution environment REE to the trusted execution environment TEE for operation, thereby realizing functions such as data copying, TA integrity verification, TA authentication, and TA access to secure files. Among them, the processes of loading TA and TA accessing secure files are likely to lead to a large consumption of trusted execution environment TEE resources, for the following reasons:

[0045] (1) The trusted execution environment TEE and the rich execution environment REE are switched through the Monitor Mode mode. During the switching process, the trusted execution environment TEE only supports single-threaded operation.

[0046] (2) The TA in the rich execution environment REE needs to be loaded into the TEE environment to run, and data copying takes time.

[0047] (3) After initializing TA, the relevant technology needs to open the security file, which also takes time.

[0048] Since the trusted execution environment TEE only supports single-threaded operation and TEE resources are limited, the high-frequency CA-TA process of creating session channels causes a single TA to occupy a high amount of TEE resources, which easily blocks the operating efficiency of other TA services.

[0049] That is to say, in actual applications, technicians also need to pay attention to the frequency of creating session channels between CA and TA and the frequency of operations on security files to avoid blocking other TA services due to TEE resource occupation. Furthermore, due to business reasons and code vulnerabilities, CAs developed by third-party companies are prone to frequently start and run TA in the TEE environment, which leads to frequent switching between the rich execution environment REE and the trusted execution environment TEE. Frequent operations can easily lead to TEE resources being occupied by a single TA, affecting the efficiency of implementing functions such as fingerprints, passwords, and security authentication.

[0050] Therefore, the existing technology occupies a large amount of TEE resources due to frequent operations, which easily leads to problems such as waste of TEE resources, blocking of other security services, and poor stability of the trusted execution environment TEE.

[0051] In order to solve the above technical problems, the overall inventive concept of the present application is to provide a communication method between a client application and a trusted application applied in the field of communication technology to improve the stability of TEE resources.

[0052] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0053] Embodiment 1:

[0054] Figure 1 The present invention provides a flow chart of a method for communicating between a client application and a trusted application. Figure 1 As shown, the communication method between the client application and the trusted application is applied to the TEE agent module deployed in the rich execution environment REE by the terminal, including the following steps:

[0055] S10. In response to a target access request for a target trusted application sent by a target client application, obtain first bidirectional linked list information corresponding to a target channel, and update the first bidirectional linked list information according to information carried in the target access request to obtain second bidirectional linked list information; wherein the target channel is a channel between a target client application and a target trusted application.

[0056] It should be understood that the Trusted Execution Environment TEE is an independent, highly secure system. Compared with TEE, the Rich Execution Environment REE is a common operating system, such as Linux, Android, etc., which can complete specific business functions in conjunction with TEE. The target client application can be any client application CA running in the Rich Execution Environment REE. The client application CA can achieve communication between the secure world and the non-secure world through interaction with TA, thereby realizing the required business functions.

[0057] The target access request can carry information such as the time information of the current time point, task type, task content, etc. The target trusted application can be any trusted application running in the trusted execution environment TEE, which can access all functions of the device's main processor and memory. Hardware isolation technology protects it from the impact of client applications installed in the rich execution environment.

[0058] The first bidirectional linked list information is the bidirectional linked list information corresponding to the target channel when the target client application sends a target access request for the target trusted application at the previous time point.

[0059] The second bidirectional linked list information is the bidirectional linked list information corresponding to the target channel when the target client application sends a target access request for the target trusted application at the current time point.

[0060] It should be noted that different client applications use different channels to communicate with the same trusted application, and different channels are also used to communicate with different trusted applications from the same client application.

[0061] For example, the communication between client application 1 and trusted application 1 uses channel 1, the communication between client application 2 and trusted application 1 uses channel 2, and the communication between client application 3 and trusted application 1 uses channel 3.

[0062] For another example, the communication between client application 1 and trusted application 2 uses channel 4, the communication between client application 1 and trusted application 3 uses channel 5, and the communication between client application 1 and trusted application 4 uses channel 6.

[0063] S20: When the second bidirectional linked list information satisfies the preset restriction policy, the target channel is refused to be used.

[0064] In the embodiment of the present application, the preset restriction policy is a custom restriction policy, or is called a restriction rule, restriction condition, etc. The restriction policy has a start time and an end time, that is, before the start time is reached, the present embodiment does not use the preset restriction policy to restrict the opening of the target channel; after the end time is exceeded, the present embodiment also does not use the preset restriction policy to restrict the opening of the target channel.

[0065] The start time and end time of the preset restriction policy in the embodiment of the present application can be in seconds, or in days, months, or years. The definition of the start time and end time is not specifically limited in the embodiment of the present application. The time period between the start time and the end time is the valid time period.

[0066] Since the preset restriction policy can be continuously updated, the effective time periods of multiple preset restriction policies set for the same channel in the embodiment of the present application may not overlap with each other.

[0067] Optionally, if the effective time periods of multiple restriction policies for the same channel overlap, the embodiment of the present application can select the earlier restriction policy / later restriction policy according to actual needs. The embodiment of the present application does not specifically limit the number of restriction policies for the same channel.

[0068] Exemplarily, in this embodiment, restriction strategy 1 corresponding to channel A is set for the first time, and restriction strategy 2 corresponding to channel A is set for the second time. The start time and end time of restriction strategy 1 are respectively from 3 o'clock to 5 o'clock; the start time and end time of restriction strategy 2 are respectively from 4 o'clock to 6 o'clock.

[0069] In this case, this embodiment can select the restriction strategy based on historical data, or can select the latter based on the coverage principle, or can select the strategy based on the current usage of TEE resources.

[0070] The first selection scheme: the scheme for selecting the restriction strategy based on historical data is: the user frequently accessed the target channel from 5 to 6 o'clock in the previous period (for example, the previous week or the previous month), so this embodiment can select the restriction strategy in combination with the quantity restrictions provided by each restriction strategy. For example, restriction strategy 1 limits the startup to 2 times within 10 minutes, and restriction strategy 2 limits the startup to 10 times within 10 minutes. Since restriction strategy 2 is more in line with user habits, this embodiment of the application can use restriction strategy 2 in the overlapping time period.

[0071] The second option is to select a restriction policy with a later effective time.

[0072] The third selection scheme: when all client applications generate services resulting in low TEE resource utilization, select restriction strategy 2; when all client applications generate services resulting in high TEE resource utilization, select restriction strategy 1. The embodiment of the present application can also make specific settings for the selection of restriction strategies based on other information, and the embodiment of the present application does not make specific limitations on this.

[0073] The second bidirectional linked list information in the present application can reflect the current usage of the target channel in real time. When the second bidirectional linked list information meets the preset restriction policy, the target channel is refused to be used, and access to the target trusted application is refused. A large amount of TEE resources will no longer be occupied, and the distribution of TEE resources on each task can be balanced, thereby improving the stability of the trusted execution environment TEE.

[0074] In a possible implementation, when refusing to use the target channel, the method further includes:

[0075] S30. Send a notification including a target error code to the target client application, so that the target client application releases the shared memory resources of the trusted execution environment TEE where the target trusted application is located based on the target error code; wherein the target error code is used to indicate that the error type of the access failure is to restrict access to the target trusted application.

[0076] After the client application CA receives the error code corresponding to "TEE is busy, call restriction" returned by the TEE proxy module, the client application CA fails to start TA, and CA releases the memory resources applied for in the trusted execution environment TEE according to the process.

[0077] That is to say, the embodiment of the present application restricts the client application CA from calling the OpenSession interface, and then when a target error code is received, the shared memory applied for by the client application CA is released.

[0078] This embodiment improves user experience by sending notifications to the target client application.

[0079] In a possible implementation, the second bidirectional linked list is composed of nodes, wherein different nodes represent access requests for the target trusted application sent by the same target client application at different time points; the tail node of the second bidirectional linked list is the target node corresponding to the target access request.

[0080] The second bidirectional linked list information includes the number of nodes in the second bidirectional linked list and the time difference between the tail node and the head node of the second bidirectional linked list.

[0081] It should be understood that the second bidirectional linked list can be in the form of a bidirectional linked list, specifically a bidirectional circular linked list. The form of the first bidirectional linked list is similar to that of the second bidirectional linked list, and the embodiment of the present application will not elaborate on its form.

[0082] In this embodiment, for different channels between CA and TA, a corresponding bidirectional circular linked list can be created respectively. Each time the OpenSession interface is accessed to start the TA, the operation time is recorded in the bidirectional circular linked list, and the time difference between the time when the head and tail pointers of the bidirectional circular linked list point to the data is calculated, and it is determined whether the time difference satisfies the restriction policy to determine whether the CA is restricted from calling the OpenSession interface.

[0083] Compared with the first bidirectional linked list, the second bidirectional linked list adds a target node corresponding to the current time point, and the target node stores the time information of the current time point carried in the target access request. In other words, the number of nodes in the second bidirectional linked list is one more than the number of nodes in the first bidirectional linked list. In addition, the tail node in the second bidirectional linked list is the target node, while the tail node in the first bidirectional linked list is the previous node corresponding to the target access request at the previous time point, and is an adjacent node of the target node.

[0084] The preset restriction strategy includes: a preset restriction on the duration of a single access and / or a preset restriction on the number of times.

[0085] It should be understood that the preset limit single access time length can be customized to 10 minutes, 20 minutes, etc., or can be set accordingly according to the setting rules. The present embodiment does not specifically limit the specific value of the preset limit single access time length. Similarly, the preset limit times can be customized to 5 times, 10 times, 20 times, etc., or can be set accordingly according to the setting rules. The present embodiment does not specifically limit the specific value of the preset limit times.

[0086] In addition, the preset restriction strategies corresponding to different channels may be different. For example, the preset restriction strategy for the first channel may be to limit calling the first channel to 10 times within 10 minutes; the preset restriction strategy for the second channel may be to limit calling the second channel to 10 times within 20 minutes.

[0087] The second bidirectional linked list information satisfies the preset restriction strategy, including at least one of the following:

[0088] Item 1: The number of nodes in the second doubly linked list exceeds the preset limit.

[0089] For example, the preset limit is 10 times, which means that starting from the time of the first node, the target channel can only be called 10 times within 10 minutes. Then the target node corresponds to the 11th node in the second bidirectional linked list. This node causes the corresponding number of nodes to be 11, which exceeds the preset limit of 10. Therefore, in this case, the embodiment of the present application rejects the call of the target channel.

[0090] Item 2: The time difference between the tail node and the first node of the second bidirectional linked list exceeds the preset limit on the length of a single access time.

[0091] For example, the preset limit on the length of a single access is 20 minutes, the time of the tail node of the second bidirectional linked list is 6 o'clock, the time of the first node is 5:30, and the time difference is 30 minutes. 30 minutes exceeds the preset limit on the length of a single access of 20 minutes. Therefore, in this case, the embodiment of the present application rejects the call of the target channel.

[0092] In addition to the preset limit times and the preset limit single access time length, the preset limit strategy may also include other contents. Therefore, the present application embodiment does not specifically limit the contents included in the preset limit strategy, and the contents may be adaptively adjusted according to actual needs. The present application embodiment can achieve the refinement of the preset limit strategy, thereby achieving effective rejection of the use of the target channel.

[0093] This application can effectively limit the frequency of CA calling the OpenSession interface to load and run TA in the trusted execution environment TEE through a preset restriction strategy, thereby improving the reasonable allocation of TEE resources.

[0094] In a possible implementation, before refusing to use the target channel, the method further includes:

[0095] S40: Create a head pointer and a tail pointer for the second doubly linked list.

[0096] S50: Determine the node pointed to by the first pointer and the node pointed to by the last pointer as the first node and the last node of the second doubly linked list, respectively.

[0097] This application can implement the application of restriction strategy through bidirectional linked list and double pointer. Bidirectional pointer can confirm the storage time point of the first node and the tail node respectively, and then provide technical support for determining the time difference between the tail node and the first node of the second bidirectional linked list.

[0098] In a possible implementation, after the first bidirectional linked list information is updated according to the information carried in the target access request to obtain the second bidirectional linked list information in S10, the method further includes the following steps:

[0099] S60. Receive an initial restriction policy of a target channel sent by an upper-layer process of the terminal through a target communication mode; wherein the target communication mode includes a Socket communication mode.

[0100] In the embodiment of the present application, the upper layer process of the terminal may refer to a voice service ListenerService, etc. The TEE proxy module receives data sent by the voice service ListenerService using a Socket communication method. In this embodiment, the TCP protocol can be used to ensure data reliability. The Socket communication method is a non-blocking method, which can ensure that the REE function running in a single thread is not blocked; and in the case of timeout retransmission, the communication method can ensure the integrity of data transmission.

[0101] The upper layer sends the restriction policy to the TEE proxy module through socket communication, where the data involved in the restriction policy includes but is not limited to: single restriction time length, number of restrictions, policy start time, policy end time, etc.

[0102] This restriction policy can be used to restrict specific CAs from accessing the OpenSession interface to start TA.

[0103] S70: Adjust the initial restriction strategy to obtain an adjusted restriction strategy.

[0104] S80. When the time of the target node is within the time period between the start time and the end time of the adjusted restriction policy, the adjusted restriction policy is determined as the preset restriction policy; or, when the time of the target node is within the time period between the start time and the end time of the initial restriction policy, the initial restriction policy is determined as the preset restriction policy.

[0105] The initial restriction strategy in the embodiment of the present application is provided by the upper layer process of the terminal. In the subsequent adjustment process, the embodiment of the present application does not specifically limit the number of adjustments, and can save each adjustment strategy, or only save the latest adjustment strategy. The embodiment of the present application does not specifically limit the specific setting of the adjustment strategy.

[0106] It should be noted that the adjustment strategy in the embodiment of the present application may also include multiple sub-adjustment strategies, each of which corresponds to its own effective time period. For example, the adjustment strategy includes three segmented sub-adjustment strategies, where the effective time period of sub-adjustment strategy A is from 8:00 to 14:00, the effective time period of sub-adjustment strategy B is from 14:00 to 24:00, and the effective time period of sub-adjustment strategy C is from 24:00 to 8:00 the next day. Each restriction strategy is executed within the corresponding effective time period.

[0107] The embodiment of the present application provides an adjustment operation for the restriction policy. Through the adjustment operation, on the one hand, the normal operation of the business initiated by the client application CA can be guaranteed; on the other hand, the personalized needs of different users can be met, the user experience can be improved, and the business needs of users in different scenarios can be met through dynamically adjusted restriction policies.

[0108] In a possible implementation, the start time of the adjusted restriction policy is later than the end time of the initial restriction policy.

[0109] In the embodiment of the present application, the time setting strategy can ensure that when selecting a restriction strategy, it is possible to quickly determine which restriction strategy to use based only on time, thereby improving the efficiency of selecting the restriction strategy and providing technical support for subsequent rapid restriction of the target channel.

[0110] In a possible implementation, after determining the adjusted restriction policy as the preset restriction policy in step S80, or after determining the initial restriction policy as the preset restriction policy, the method further includes the following steps:

[0111] S90: Determine whether the second bidirectional linked list information satisfies a preset restriction strategy.

[0112] S100: When the second bidirectional linked list information does not satisfy the preset restriction policy, call the channel of the target channel to establish an OpenSession interface, so as to send the target access request to the target trusted application through the target channel.

[0113] In an embodiment of the present application, the second bidirectional linked list information does not meet the preset restriction policy, indicating that the client application does not frequently use the corresponding channel. In this case, the embodiment of the present application can achieve normal access to the target trusted application and achieve normal processing of the business in the access request by the target trusted application.

[0114] An embodiment of the present application provides a communication method between a client application and a trusted application, which is used to limit the frequency of calling the OpenSession interface when the CA communicates with the TA, thereby achieving control over the reasonable calling of the target channel. In other words, the embodiment of the present application can limit the high-frequency activation and access of the CA developed by a third party to the TA, balance the use of TEE resources in different businesses, and thereby improve the stability of the TEE.

[0115] Embodiment 2:

[0116] Figure 2 A flow chart of another method for communicating between a client application and a trusted application provided in an embodiment of the present application. Figure 2 As shown, another method for communicating between a client application and a trusted application includes the following steps:

[0117] S21. The upper-layer process of the terminal sends a restriction policy to the TEE proxy module.

[0118] It should be understood that socket communication is established between the TEE proxy module and the upper-level process, and the upper-level process sends data carrying restriction policy rules to the TEE proxy module through this communication method, wherein the restriction policy rules include at least one of the following: single restriction time length, number of restrictions, policy start time and policy end time.

[0119] S22. The TEE proxy module adjusts the restriction strategy.

[0120] This embodiment can implement the restriction policy process in the TEE proxy module through a bidirectional linked list and a double pointer, wherein the number of nodes in the bidirectional linked list represents the number of accesses, which is used to compare with the limit number in the restriction policy. The data stored in each node in the bidirectional linked list is the system time when the CA accesses the OpenSession interface, and the data difference of the time stored in the node pointed to by the head and tail double pointers represents the time difference between the first and last calls to the OpenSession interface by the restriction policy. If the number of nodes is less than or equal to the limit number and the time difference meets the restriction condition, then this embodiment restricts the CA from calling the OpenSession interface.

[0121] Furthermore, in the embodiment of the present application, as the number of access requests initiated by the client application CA increases, the number of nodes in the bidirectional linked list continues to increase.

[0122] Optionally, the embodiment of the present application can store a single restriction time length, number of restrictions, policy start time and policy end time through global variables, and realize dynamic adjustment of the restriction policy by modifying the value of the global variable.

[0123] Optionally, the number of restrictions in the restriction policy can be reflected by the number of nodes in the bidirectional linked list. Therefore, after the upper-level process sends data carrying the restriction policy, the TEE proxy module can dynamically adjust the restriction policy by adding / reducing nodes in the bidirectional linked list.

[0124] Optionally, since the restriction policy is constantly adjusted, this embodiment needs to set a suitable policy start time for the adjusted policy. Specifically, this embodiment determines whether the policy is being executed, and if so, sets the adjusted policy to take effect after the last policy end time.

[0125] S23. The client application CA sends TEEC_OpenSession to the TEE proxy module to apply for calling the OpenSession interface to start the target channel.

[0126] S24, the TEE proxy module determines whether the bidirectional linked list information of the target channel corresponding to the access request meets the restriction policy. If yes, then execute steps S251, 261 and S27 in sequence; if no, then execute steps S252, S262 and S27.

[0127] S251. The TEE proxy module returns an error code restricting access to TA to the client application CA.

[0128] It should be understood that during the process of the client application CA starting the trusted application TA, if the corresponding bidirectional linked list information does not meet the restriction policy, the TEE agent module returns an error code of TA restricted access to CA to notify the following information: CA failed to start TA.

[0129] S261, release shared memory. Specifically, CA can release TEE shared memory according to the error code returned by the TEE proxy module.

[0130] S252. The TEE proxy module sends TA_OpenSession to the trusted application TA to confirm the start of the target channel.

[0131] S262: The trusted application TA returns a notification of successful TA loading to the client application CA.

[0132] S27. The client applies CA to perform subsequent services.

[0133] This method can prevent mobile phones and other terminals from occupying a large amount of TEE resources due to loading and accessing a single TA, and can ensure the rapid implementation of functions such as fingerprints, passwords, and security authentication.

[0134] This method is used to limit the frequency of calling the OpenSession interface when CA communicates with TA, thereby achieving control over the reasonable calling of the target channel. In other words, the embodiment of the present application can limit the high-frequency activation and access of CA developed by a third party to TA, balance the use of TEE resources in different businesses, and thereby improve the stability of TEE.

[0135] Embodiment 3:

[0136] Figure 3 The structure diagram of a communication device between a client application and a trusted application provided in an embodiment of the present application. The device of this embodiment can be in the form of software and / or hardware. Figure 3 As shown, the communication device between the client application and the trusted application provided in this embodiment is applied to the TEE agent module deployed in the rich execution environment REE by the terminal, and the device includes: an acquisition update module 31 and a rejection module 32, wherein:

[0137] The acquisition and update module 31 is used to respond to the target access request for the target trusted application sent by the target client application, obtain the first bidirectional linked list information corresponding to the target channel, and update the first bidirectional linked list information according to the information carried in the target access request to obtain the second bidirectional linked list information; wherein, the target channel is the channel between the target client application and the target trusted application.

[0138] The rejection module 32 is used to reject the use of the target channel when the second bidirectional linked list information satisfies the preset restriction policy.

[0139] Optionally, the second bidirectional linked list is composed of nodes, wherein different nodes represent access requests for the target trusted application sent by the same target client application at different time points; the tail node of the second bidirectional linked list is the target node corresponding to the target access request;

[0140] The second bidirectional linked list information includes the number of nodes in the second bidirectional linked list and the time difference between the tail node and the head node of the second bidirectional linked list;

[0141] The preset restriction strategy includes: preset restriction on the duration of a single access and / or preset restriction on the number of times;

[0142] The second bidirectional linked list information satisfies the preset restriction strategy, including at least one of the following:

[0143] The number of nodes in the second bidirectional linked list exceeds the preset limit;

[0144] The time difference between the tail node and the head node of the second bidirectional linked list exceeds the preset limit of a single access time length.

[0145] Optionally, after the first bidirectional linked list information is updated according to the information carried in the target access request to obtain the second bidirectional linked list information, the communication device between the client application and the trusted application is further used to:

[0146] An initial restriction policy of a target channel sent by an upper-layer process of a receiving terminal is received through a target communication mode; wherein the target communication mode includes a Socket communication mode.

[0147] The initial restriction strategy is adjusted to obtain an adjusted restriction strategy.

[0148] When the time of the target node is within the time period between the start time and the end time of the adjusted restriction policy, the adjusted restriction policy is determined as the preset restriction policy; or, when the time of the target node is within the time period between the start time and the end time of the initial restriction policy, the initial restriction policy is determined as the preset restriction policy.

[0149] Optionally, after determining the adjusted restriction policy as the preset restriction policy, or after determining the initial restriction policy as the preset restriction policy, the communication device between the client application and the trusted application is further used to:

[0150] Determine whether the second bidirectional linked list information satisfies the preset restriction strategy.

[0151] When the second bidirectional linked list information does not satisfy the preset restriction policy, the channel of the target channel is called to establish an OpenSession interface, so as to send the target access request to the target trusted application through the target channel.

[0152] Optionally, the start time of the adjusted restriction policy is later than the end time of the initial restriction policy.

[0153] Optionally, before denying the use of the target channel, the communication means of the client application and the trusted application is further used to:

[0154] Create the first and last pointers for the second doubly linked list.

[0155] The node pointed to by the first pointer and the node pointed to by the last pointer are respectively determined as the first node and the last node of the second doubly linked list.

[0156] Optionally, when the use of the target channel is denied, the communication device between the client application and the trusted application is further used to:

[0157] A notification including a target error code is sent to the target client application, so that the target client application releases the shared memory resources of the trusted execution environment TEE where the target trusted application is located based on the target error code; wherein the target error code is used to indicate that the error type of the access failure is to restrict access to the target trusted application.

[0158] The implementation principle and technical effect of the communication device between the client application and the trusted application provided in this embodiment are similar to those of the communication method between the client application and the trusted application described above, and are not described in detail here.

[0159] Embodiment 3:

[0160] Figure 4 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. The terminal includes a TEE proxy module 41 deployed in a rich execution environment REE, at least one client application 42, and at least one trusted application 43 deployed in a trusted execution environment TEE.

[0161] It should be understood that the client application 42 is referred to as CA, specifically referring to the user-side application running on the REE side. Since the main function of this user-side application is to communicate with TA, and the implementation of such a functional component is imperfect, the embodiment of the present application can set an upper-layer application, namely APK (Android application package), which integrates the CA component. The upper-layer application can use the target channel by calling the OpenSession instruction, and then successfully access the trusted application.

[0162] The implementation principle and technical effect of the terminal provided in this embodiment are similar to the communication method between the client application and the trusted application described above, and will not be described in detail here.

[0163] It should be noted that the user information and data involved in this application (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0164] That is to say, in the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0165] According to an embodiment of the present application, the present application also provides a readable storage medium and a computer program product.

[0166] The embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, each step of the method in the above embodiment is implemented.

[0167] An embodiment of the present application also provides a computer program product, including a computer program, which implements each step of the method in the above embodiment when executed by a processor.

[0168] Various embodiments of the systems and techniques described above in the present application can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor, which can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0169] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or terminal.

[0170] In the context of the present application, a computer-readable storage medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may be a machine-readable signal medium or a machine-readable storage medium. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0171] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0172] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data terminal), or a computing system that includes middleware components (e.g., an application terminal), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0173] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps disclosed in this application can be performed in parallel, sequentially or in different orders, as long as the desired results of the technical solution disclosed in this application can be achieved, and this document does not limit this.

[0174] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of this application should be included in the protection scope of this application.

Claims

1. A communication method between a client application and a trusted application, characterized in that: The method is applied to a TEE agent module deployed in a rich execution environment (REE) by a terminal, and includes: In response to a target access request for a target trusted application sent by a target client application, first bidirectional linked list information corresponding to a target channel is obtained, and the first bidirectional linked list information is updated according to information carried in the target access request to obtain second bidirectional linked list information; wherein the target channel is a channel between the target client application and the target trusted application; When the second bidirectional linked list information satisfies the preset restriction policy, the target channel is refused to be used.

2. The method according to claim 1, characterized in that The second bidirectional linked list is composed of nodes, wherein different nodes represent access requests for the target trusted application sent by the same target client application at different time points; the tail node of the second bidirectional linked list is the target node corresponding to the target access request; The second bidirectional linked list information includes the number of nodes in the second bidirectional linked list and the time difference between the tail node and the head node of the second bidirectional linked list; The preset restriction strategy includes: preset restriction on single access time length and / or preset restriction on number of times; The second bidirectional linked list information satisfies the preset restriction strategy, including at least one of the following: The number of nodes in the second bidirectional linked list exceeds the preset limit number of times; The time difference between the tail node and the head node of the second bidirectional linked list exceeds the preset limit single access time length.

3. The method according to claim 2, characterized in that After the first bidirectional linked list information is updated according to the information carried in the target access request to obtain the second bidirectional linked list information, the method further includes: Receiving the initial restriction policy of the target channel sent by the upper layer process of the terminal through a target communication mode; wherein the target communication mode includes a Socket communication mode; Adjusting the initial restriction strategy to obtain an adjusted restriction strategy; When the time of the target node is within the time period between the start time and the end time of the adjusted restriction policy, the adjusted restriction policy is determined as the preset restriction policy; or, when the time of the target node is within the time period between the start time and the end time of the initial restriction policy, the initial restriction policy is determined as the preset restriction policy.

4. The method according to claim 3, characterized in that After determining the adjusted restriction strategy as the preset restriction strategy, or after determining the initial restriction strategy as the preset restriction strategy, the method further includes: Determine whether the second bidirectional linked list information satisfies a preset restriction strategy; In the case that the second bidirectional linked list information does not satisfy the preset restriction policy, the channel of the target channel is called to establish an OpenSession interface, so as to send the target access request to the target trusted application through the target channel.

5. The method according to claim 3, characterized in that: The start time of the adjusted restriction policy is later than the end time of the initial restriction policy.

6. The method according to claim 2, characterized in that Before the step of refusing to use the target channel, the method further includes: Creating a first pointer and a tail pointer for the second doubly linked list; The node pointed to by the first pointer and the node pointed to by the last pointer are respectively determined as the first node and the last node of the second bidirectional linked list.

7. The method according to claim 1, characterized in that When the use of the target channel is refused, the method further includes: A notification including a target error code is sent to the target client application, so that the target client application releases the shared memory resources of the trusted execution environment TEE where the target trusted application is located based on the target error code; wherein the target error code is used to indicate that the error type of the access failure is to restrict access to the target trusted application.

8. A communication device between a client application and a trusted application, characterized in that: A TEE agent module applied to a terminal deployed in a rich execution environment (REE), the device comprising: an acquisition and update module, configured to obtain, in response to a target access request for a target trusted application sent by a target client application, first bidirectional linked list information corresponding to a target channel, and update the first bidirectional linked list information according to information carried in the target access request to obtain second bidirectional linked list information; wherein the target channel is a channel between a target client application and a target trusted application; A rejection module is used to reject the use of the target channel when the second bidirectional linked list information meets a preset restriction policy.

9. A terminal, characterized in that: include: A TEE agent module and at least one target client application deployed in a rich execution environment (REE), and at least one target trusted application deployed in a trusted execution environment (TEE).

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the communication method between a client application and a trusted application as described in any one of claims 1 to 7.

Images