Time synchronization method and system

Abstract

The invention discloses a time synchronization method and system. The time synchronization method according to the embodiment of the invention comprises the following steps: requesting time synchronization through a trusted application to obtain synchronization time; the trusted application program obtains the synchronization time and carries out time synchronization according to the synchronization time, and the trusted application program runs in a safe execution environment. According to the time synchronization method and system provided by the embodiment of the invention, time synchronization can be efficiently and safely realized in a safe execution environment.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a time synchronization method and system. Background Art

[0002] In modern computer network systems, time synchronization is not only a key factor in ensuring system reliability and security, but also the cornerstone for achieving data consistency and coordinated system operation. With the rapid development of distributed systems, cloud computing, the Internet of Things, and industrial automation, accurate time synchronization between devices and components has become particularly critical. Time synchronization ensures the order of events, the accuracy of transactions, and the effective execution of security protocols.

[0003] In the existing technology, TEE (Trusted Execution Environment) is a technology that provides a secure execution environment by running applications in an isolated environment to protect them from malware and other security threats. The wide application of TEE, such as secure payment on mobile devices, enterprise data protection, and control systems for critical infrastructure, all rely on the high security it provides. However, TEE itself does not have an independent clock source, which means it must rely on an external clock source to obtain time information (for time synchronization). This reliance not only raises concerns about the security of the clock source, but also increases costs and complexity.

[0004] Therefore, it is hoped that there will be a new time synchronization method and system that can overcome the above problems. Summary of the invention

[0005] In view of the above problems, the object of the present invention is to provide a time synchronization method and system, in particular, a TEE trusted time synchronization method and system, so as to efficiently and securely realize time synchronization in a secure execution environment.

[0006] According to one aspect of the present invention, there is provided a time synchronization method, comprising:

[0007] Request time synchronization through a trusted application to obtain synchronized time;

[0008] The trusted application obtains the synchronization time and performs time synchronization according to the synchronization time.

[0009] Wherein, the trusted application runs in a secure execution environment.

[0010] Optionally, the trusted application trusts the trusted application;

[0011] The trusted application requests time synchronization from the trusted service.

[0012] Optionally, the time synchronization method further includes:

[0013] The trusted application receives the boot broadcast to request time synchronization when booting;

[0014] After the trusted application performs time synchronization according to the synchronization time, the secure execution environment manages the synchronization time.

[0015] Optionally, the time synchronization method further includes:

[0016] The trusted application requests time synchronization from the trusted service;

[0017] The trusted service obtains the service time, and signs the service time to obtain a signed time package;

[0018] The trusted application obtains the signed time package and provides the signed time package to the trusted application program;

[0019] The trusted application verifies the signature of the signed time package.

[0020] Optionally, the time synchronization method further includes:

[0021] The trusted application requests time synchronization from the trusted service;

[0022] The trusted service returns a time packet to the trusted application;

[0023] The trusted application provides the trusted application package name and a hash of the trusted application feature data, and the time package to the trusted application program;

[0024] The trusted application verifies whether the trusted application has the authority for time synchronization through the package name and the hash of the trusted application feature data.

[0025] Optionally, the time synchronization method further includes:

[0026] The trusted application obtains the secure execution environment runtime at the time of the request;

[0027] The trusted application requests time synchronization according to the request time;

[0028] The trusted application provides the acquired synchronization time to the trusted application program;

[0029] The trusted application obtains the secure execution environment running time at the synchronization time;

[0030] The trusted application determines whether to perform time synchronization based on the time difference between the secure execution environment running time at the synchronization time and the secure execution environment running time at the request time,

[0031] Wherein, when the time difference is less than a set threshold, the trusted application performs time synchronization according to the synchronization time.

[0032] Optionally, the time synchronization method further includes:

[0033] The trusted application generates a serial number and provides the serial number to the trusted application;

[0034] The trusted application requests time synchronization according to the serial number to obtain a synchronization time corresponding to the serial number.

[0035] Optionally, the time synchronization method further includes:

[0036] The trusted application receives a power-on broadcast;

[0037] The trusted application sends a serial number request to the trusted application program;

[0038] The trusted application generates a serial number;

[0039] The trusted application records the secure execution environment running time at the time of the request;

[0040] The trusted application sends the serial number to the trusted application;

[0041] The trusted application requests time synchronization from the trusted service;

[0042] The trusted service obtains the service time;

[0043] The trusted service signs the service time and the serial number to obtain a time packet;

[0044] The trusted service returns the time packet to the trusted application;

[0045] The trusted application sends the time packet to the trusted application program;

[0046] The trusted application performs application authentication on the trusted application;

[0047] The trusted application performs a timeout check;

[0048] The trusted application verifies the signature of the time packet;

[0049] The trusted application performs time synchronization.

[0050] According to another aspect of the present invention, there is provided a time synchronization system, comprising:

[0051] A trusted application module, wherein the trusted application module is used to request time synchronization and to obtain synchronized time;

[0052] A trusted application module, wherein the trusted application module runs in a secure execution environment; the trusted application module obtains the synchronization time through the trusted application module, and performs time synchronization according to the synchronization time.

[0053] Optionally, the time synchronization system further includes a trusted service module;

[0054] The trusted application module requests the trusted service module for time synchronization to obtain the synchronization time provided by the trusted service module.

[0055] The time synchronization method and system provided by the embodiment of the present invention obtain time synchronization in a secure execution environment through a trusted application trusted by a trusted application, thereby realizing time synchronization in a secure execution environment in a safe, efficient, low-cost and high-benefit manner.

[0056] Furthermore, the transmitted time data is signed and transmitted using a secure communication channel, which can prevent man-in-the-middle attacks and data tampering, and ensure the integrity and confidentiality (security) of the data during transmission.

[0057] Furthermore, the trusted application verifies the trusted application permissions and signs the time data returned by the trusted service, ensuring that only legally authorized trusted applications can obtain and use the synchronized time data.

[0058] Furthermore, the trusted application monitors the running time of the secure execution environment system and determines timeouts during the verification process, ensuring the timeliness of the time synchronization operation.

[0059] Furthermore, by obtaining time synchronization from trusted applications trusted by trusted applications to a secure execution environment, the deployment and maintenance costs of time synchronization are effectively reduced while maintaining high accuracy and high reliability.

[0060] Furthermore, the time synchronization solution of the present application can be flexibly and compatibly implemented in different TEE platforms and network environments.

[0061] The time synchronization method and system provided in the embodiments of the present invention break through the limitations of existing time synchronization technologies and are a method and system designed specifically for a secure execution environment. They can not only provide high-precision time synchronization, but also ensure the security and reliability of the synchronization process. The solution of the present application can significantly improve the performance of TEE in key applications and enhance its protection capabilities in the face of complex security challenges. It can reduce dependence on external time sources and allow business processes to respond to time changes more quickly. The accurate and reliable time synchronization mechanism provides security for time-sensitive businesses such as financial transactions and blockchain applications, and effectively prevents time fraud and synchronization errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The above and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0063] Figure 1 A method flow chart of a time synchronization method according to an embodiment of the present invention is shown;

[0064] Figure 2 An interactive flow chart of time synchronization according to an embodiment of the present invention is shown;

[0065] Figure 3 A schematic structural diagram of a time synchronization system according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0066] Various embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. In each of the accompanying drawings, identical elements are represented by identical or similar reference numerals. For the sake of clarity, the various parts in the accompanying drawings are not drawn to scale. In addition, some well-known parts may not be shown in the drawings.

[0067] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. Many specific details of the present invention, such as the structure, materials, dimensions, processing technology and techniques of the components are described below to provide a clearer understanding of the present invention. However, as those skilled in the art will appreciate, the present invention may be implemented without following these specific details.

[0068] It should be understood that when describing the structure of a component, when a layer or a region is referred to as being "on" or "over" another layer or another region, it may mean that it is directly on the other layer or another region, or that other layers or regions are included between it and the other layer or another region. Moreover, if the component is turned over, the layer or a region will be "below" or "beneath" another layer or another region.

[0069] There are two main methods for existing TEE to obtain time. One is to obtain the time on the REE (Rich Execution Environment) side, and the other is to obtain the time through the built-in hardware security mechanism.

[0070] The inventors have found that the solution of obtaining the time on the REE side has the following problems:

[0071] 1. Security issues: Obtaining time from REE may be affected by REE security issues, such as malware tampering with time.

[0072] 2. Dependency The time accuracy and security of TEE are highly dependent on the time synchronization status and accuracy of REE.

[0073] 3. Performance overhead issue: Communication between TEE and REE will introduce additional performance overhead.

[0074] There are several problems with the solution of obtaining time through built-in hardware security mechanisms:

[0075] 1. Cost issue: Hardware security mechanisms usually require special hardware support, which increases costs.

[0076] 2. Technical complexity: Implementing and maintaining hardware security mechanisms is usually more complex than software solutions.

[0077] 3. Compatibility issues: Implementation on different hardware platforms usually requires specific adaptation and optimization.

[0078] In order to solve the problems in the prior art, the inventor proposes a new time synchronization method and system.

[0079] Figure 1 FIG. 2 shows a method flow chart of a time synchronization method according to an embodiment of the present invention. Figure 1 As shown, the time synchronization method according to an embodiment of the present invention includes the following steps:

[0080] In step S101, time synchronization is requested through a trusted application to obtain synchronization time;

[0081] Time synchronization is requested through a trusted application to obtain synchronized time. The trusted application is, for example, an application that is trusted by a trusted application (TA) and can perform time synchronization.

[0082] In step S102, the trusted application obtains the synchronization time, and performs time synchronization according to the synchronization time.

[0083] Trusted applications obtain synchronization time through trusted applications and perform time synchronization based on the obtained synchronization time. Trusted applications run in a secure execution environment (TEE) to maintain secure time. A secure execution environment is a secure computing platform that is designed to provide an isolated execution environment for securely processing sensitive data and performing critical tasks. The secure execution environment protects applications from external malware and other security threats by providing a protected environment. The secure execution environment can be implemented by both hardware and software, thereby ensuring the integrity and confidentiality of data and code. Trusted applications are secure applications running in a secure execution environment that can access the protected resources of the secure execution environment to perform security-critical operations and store sensitive data.

[0084] Optionally, the trusted application trusts the trusted application. The trusted application requests time synchronization from the trusted service. The trusted service is, for example, a remote service platform that provides secure time.

[0085] In an optional embodiment of the present invention, the time synchronization method further includes the following steps:

[0086] Trusted applications receive boot broadcasts to request time synchronization when booting;

[0087] After the trusted application performs time synchronization according to the synchronization time, the secure execution environment manages the synchronization time.

[0088] In the above embodiment, by obtaining the time from the trusted application when starting up, TEE can be used for (time) management and maintenance, thereby greatly improving the security and accuracy of the time data.

[0089] In an optional embodiment of the present invention, the time synchronization method further includes the following steps:

[0090] The trusted application requests time synchronization from the trusted service;

[0091] The trusted service obtains the service time (the service time is used to determine the synchronization time) and signs the service time to obtain a signed time package;

[0092] The trusted application obtains the signed time package and signs the service time to obtain the signed time package;

[0093] The trusted application obtains the signed time package and provides the signed time package to the trusted application program;

[0094] The trusted application verifies the signature time package.

[0095] In the above embodiment, (all) time synchronization requests and returned data are protected by signatures, which ensures that the data is not tampered with during transmission and can verify the integrity and authenticity of the data.

[0096] In an optional embodiment of the present invention, the time synchronization method further includes the following steps:

[0097] The trusted application requests time synchronization from the trusted service;

[0098] The trusted service returns a time packet to the trusted application;

[0099] The trusted application provides the trusted application package name and the hash and time package of the trusted application feature data to the trusted application program;

[0100] The trusted application verifies whether the trusted application has the permission for time synchronization through the package name and the hash of the trusted application feature data.

[0101] In the above embodiment, by verifying whether the application has the authority to synchronize time (with the authority control function) through the trusted application, it is possible to effectively prevent unauthorized applications or third parties from obtaining and tampering with time data, further ensuring the security of time data.

[0102] In an optional embodiment of the present invention, the time synchronization method further includes the following steps:

[0103] The trusted application obtains the secure execution environment runtime at the time of the request;

[0104] The trusted application requests time synchronization according to the request time;

[0105] The trusted application provides the obtained synchronization time to the trusted application program;

[0106] Trusted applications obtain the secure execution environment runtime at the synchronization moment;

[0107] The trusted application determines whether to perform time synchronization based on the time difference between the secure execution environment running time at the synchronization time and the secure execution environment running time at the request time.

[0108] When the (obtained) time difference is smaller than a set threshold, the trusted application performs time synchronization according to the synchronization time.

[0109] In the above embodiment, the timeliness of the time synchronization operation is ensured by monitoring the running time of the TEE system and judging the timeout, and the influence caused by abnormal situations in the time synchronization process is avoided.

[0110] In an optional embodiment of the present invention, the time synchronization method further includes:

[0111] The trusted application generates a (unique) serial number and provides the serial number to the trusted application;

[0112] The trusted application requests time synchronization according to the serial number to obtain the synchronization time corresponding to the serial number.

[0113] In the above embodiment, the trusted application generates a unique serial number associated with the trusted application request, ensuring the traceability and verifiability of the time synchronization request.

[0114] Figure 2 FIG. 2 shows an interactive flow chart of time synchronization according to an embodiment of the present invention. Figure 2 As shown, the solution of the present application obtains time synchronization to TEE for management and maintenance through a TA-trusted application when booting, specifically including the following steps:

[0115] Step 1: The trusted application receives (obtains) the boot broadcast;

[0116] Step 2: The trusted application calls TA to obtain the synchronization time serial number, for example, the trusted application sends a serial number request to the trusted application program;

[0117] Step 2.1: TA generates a random serial number (synchronous time serial number);

[0118] Step 2.2: Obtain and record the current TEE system running time, for example, by recording the secure execution environment running time at the time of the request through a trusted application;

[0119] Step 3: The trusted application sends a time synchronization request to the trusted service and gives the synchronization time serial number obtained from the TA to the trusted service;

[0120] Step 3.1: The trusted service obtains the service time (server security time);

[0121] Step 3.2: The trusted service signs the service time and the serial number to obtain a time package. For example, the trusted service combines the security time and the synchronization time serial number and signs the package using the private key of the trusted service.

[0122] Step 4: The trusted application passes its own package name, the hash of the trusted application feature data, and the time package obtained from the trusted service to the TA;

[0123] Step 4.1: TA verifies whether the trusted application has the permission to synchronize time through the package name and the hash of the trusted application feature data;

[0124] Step 4.2: TA obtains the current TEE system running time and performs a timeout check with the previously recorded TEE system running time;

[0125] Step 4.3: TA uses the public key of the preset trusted service to verify the signature of the time packet;

[0126] Step 4.4: After the signature verification is passed, TA performs the time synchronization operation.

[0127] According to another aspect of the present invention, a time synchronization system is provided, which is used, for example, to implement the time synchronization method described above.

[0128] Figure 3 FIG. 2 shows a schematic diagram of the structure of a time synchronization system according to an embodiment of the present invention. Figure 3 As shown, the time synchronization system according to the embodiment of the present invention includes a device end 10 and a trusted service module 300. The device end 10 includes a trusted application module 100 and a trusted application program module 200.

[0129] Specifically, the trusted application module 100 is used to request time synchronization and to obtain synchronized time.

[0130] The trusted application module 200 runs in a secure execution environment. The trusted application module 200 obtains the synchronization time through the trusted application module 100 and performs time synchronization according to the synchronization time.

[0131] Optionally, the trusted application module 100 requests the trusted service module 300 for time synchronization to obtain the synchronization time provided by the trusted service module 300 .

[0132] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0133] According to the embodiments of the present invention as described above, these embodiments do not describe all the details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and changes can be made based on the above description. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can make good use of the present invention and the modified use based on the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A time synchronization method, comprising: Request time synchronization through a trusted application to obtain synchronized time; The trusted application obtains the synchronization time and performs time synchronization according to the synchronization time. Wherein, the trusted application runs in a secure execution environment.

2. The time synchronization method according to claim 1, wherein: The trusted application trusts the trusted application; The trusted application requests time synchronization from the trusted service.

3. The time synchronization method according to claim 1, wherein: The time synchronization method further comprises: The trusted application receives the power-on broadcast to request time synchronization when the computer is powered on; After the trusted application performs time synchronization according to the synchronization time, the secure execution environment manages the synchronization time.

4. The time synchronization method according to claim 1, wherein: The time synchronization method further comprises: The trusted application requests time synchronization from the trusted service; The trusted service obtains the service time, and signs the service time to obtain a signed time package; The trusted application obtains the signed time package and provides the signed time package to the trusted application program; The trusted application verifies the signature of the signed time package.

5. The time synchronization method according to claim 1, wherein: The time synchronization method further comprises: The trusted application requests time synchronization from the trusted service; The trusted service returns a time packet to the trusted application; The trusted application provides the trusted application package name and a hash of the trusted application feature data, and the time package to the trusted application program; The trusted application verifies whether the trusted application has the authority for time synchronization through the package name and the hash of the trusted application feature data.

6. The time synchronization method according to claim 1, wherein: The time synchronization method further comprises: The trusted application obtains the secure execution environment runtime at the time of the request; The trusted application requests time synchronization according to the request time; The trusted application provides the acquired synchronization time to the trusted application program; The trusted application obtains the secure execution environment running time at the synchronization time; The trusted application determines whether to perform time synchronization based on the time difference between the secure execution environment running time at the synchronization time and the secure execution environment running time at the request time, Wherein, when the time difference is less than a set threshold, the trusted application performs time synchronization according to the synchronization time.

7. The time synchronization method according to claim 1, wherein: The time synchronization method further comprises: The trusted application generates a serial number and provides the serial number to the trusted application; The trusted application requests time synchronization according to the serial number to obtain a synchronization time corresponding to the serial number.

8. The time synchronization method according to claim 1, wherein: The time synchronization method further comprises: The trusted application receives a power-on broadcast; The trusted application sends a serial number request to the trusted application program; The trusted application generates a serial number; The trusted application records the secure execution environment running time at the time of the request; The trusted application sends the serial number to the trusted application; The trusted application requests time synchronization from the trusted service; The trusted service obtains the service time; The trusted service signs the service time and the serial number to obtain a time packet; The trusted service returns the time packet to the trusted application; The trusted application sends the time packet to the trusted application program; The trusted application performs application authentication on the trusted application; The trusted application performs a timeout check; The trusted application verifies the signature of the time packet; The trusted application performs time synchronization.

9. A time synchronization system, comprising: A trusted application module, wherein the trusted application module is used to request time synchronization and to obtain synchronized time; A trusted application module, wherein the trusted application module runs in a secure execution environment; the trusted application module obtains the synchronization time through the trusted application module, and performs time synchronization according to the synchronization time.

10. The time synchronization system according to claim 9, wherein: The time synchronization system also includes a trusted service module; The trusted application module requests the trusted service module for time synchronization to obtain the synchronization time provided by the trusted service module.

Images