Container system applied to intelligent terminal and intelligent terminal

Abstract

The invention discloses a container system applied to an intelligent terminal and the intelligent terminal. According to the embodiment of the invention, the container system comprises a container unit, and the container unit runs in a safe environment of the intelligent terminal and stores a container attribute file; the container unit comprises a first data interface, the first data interface is connected with an application program running on the intelligent terminal to perform data interaction, and data in the container attribute file is mapped with a data characteristic value stored in the application program. According to the container system applied to the intelligent terminal and the intelligent terminal provided by the embodiment of the invention, the data security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of real person authentication, and in particular to a container system applied to a smart terminal and the smart terminal. Background Art

[0002] With the rapid development of mobile Internet and smart phones, the business related to mobile terminals and individuals is also developing continuously, and more and more secure, flexible and convenient applications are being provided for different groups of people and scenarios. As a result, the security issues of systems and information closely related to applications are facing serious challenges.

[0003] In the existing technology, the security environment based on mobile terminal "TEE+SE" and "TEE+secure storage" combined with cryptographic algorithms has become a new trend in security solutions. However, due to the serious fragmentation of TEE in mobile terminals and the lack of endorsement by authoritative institutions, the security solutions based on mobile terminals cannot meet the security requirements of applications. At the same time, in terms of development mode, application vendors generally need to bind with terminal manufacturers to develop customized solutions, which has high development costs.

[0004] Therefore, it is hoped that there will be a new container system and smart terminal applied to smart terminals that can overcome the above problems. Summary of the invention

[0005] In view of the above problems, an object of the present invention is to provide a container system and a smart terminal applied to a smart terminal, in particular, a container system based on real-person authentication, so as to improve the security of data.

[0006] According to one aspect of the present invention, there is provided a container system applied to a smart terminal, comprising:

[0007] A container unit, wherein the container unit runs in a security environment of the intelligent terminal and stores a container attribute file;

[0008] The container unit includes a first data interface, which is connected to an application program running on the smart terminal for data interaction.

[0009] The data in the container attribute file is mapped to the data characteristic values ​​stored in the application.

[0010] Optionally, a second data interface is provided in the secure environment;

[0011] The second data interface is connected to a remote trusted service platform server; the security environment applies for a certificate from the remote trusted service platform server through the second data interface;

[0012] The container unit applies for a certificate to the server corresponding to the application through the first data interface and / or the second data interface.

[0013] Optionally, a cryptographic algorithm module runs in the container unit; the cryptographic algorithm module is used for at least one of key generation, data encryption, data decryption, certificate signing, and signature verification; the cryptographic algorithm module is used to implement at least one of symmetric cryptographic algorithms, asymmetric cryptographic algorithms, international algorithms, and national cryptographic algorithms.

[0014] Optionally, the container unit includes:

[0015] A real-person container subunit, which is used for at least one of the generation, use, and destruction of real-person associated data;

[0016] An application container subunit, which is used for at least one of the creation, use, destruction, generation, storage, operation, import, export, and deletion of privacy data of the application container.

[0017] Optionally, the information stored in the container attribute file includes at least one selected from the container space size, the occupied space size of the container, the container file index counter, and the access authorization value.

[0018] Optionally, when storing and / or deleting data in the container unit, update the occupied space size of the container in the container attribute file;

[0019] When storing a file in the container unit, update the container file index counter in the container attribute file.

[0020] Optionally, when generating data and / or importing data into the container unit, verify whether there is the corresponding access permission;

[0021] When generating data and / or importing data into the container unit, the application stores the corresponding data feature value.

[0022] Optionally, a privacy information file is also stored in the secure environment;

[0023] The privacy information file includes privacy data and data attributes, and the data attributes include at least one selected from data type, access identifier, key algorithm, length, and use.

[0024] Optionally, the application applies for generating a key pair; after the container unit verifies the authorization, it generates the corresponding key pair;

[0025] The application applies for a certificate; the container unit performs key signing according to the key pair;

[0026] The application applies for a certificate to the application server, and the application server verifies the signature to the remote trusted service platform server; the application server applies for a digital certificate to the application CA server;

[0027] The application applies to install the digital certificate; the container unit stores the digital certificate.

[0028] Optionally, a subordinate service certificate is generated according to the digital certificate, and the subordinate service certificate is used for the authentication of subordinate services.

[0029] According to another aspect of the present invention, an intelligent terminal is provided. The intelligent terminal includes the container system as described above.

[0030] The container system and the intelligent terminal applied to the intelligent terminal provided by the embodiments of the present invention store a container attribute file in a container unit in a secure environment, and the data in the container attribute file is mapped to the data characteristic values in the application program, thereby realizing data isolation and improving data security.

[0031] Furthermore, a remote trusted service platform server is introduced to provide certificates, making the data link more trustworthy and secure. At the same time, the problem that application providers and device manufacturers must be bound is solved, improving development efficiency and reducing costs.

[0032] Furthermore, the cryptographic algorithm module running in the container unit supports a variety of arithmetic processes and algorithms, with a wide range of applications.

[0033] Furthermore, private data is stored in a secure environment, ensuring the security of private data.

[0034] Furthermore, when importing data into the container unit, it will verify whether there is corresponding access permission, improving security. Description of the Drawings

[0035] Through the following description of the embodiments of the present invention with reference to the drawings, the above and other objects, features, and advantages of the present invention will become clearer. In the drawings:

[0036] Figure 1 Shows a schematic structural diagram of a container system according to an embodiment of the present invention;

[0037] Figure 2 Shows a file management model of a container system according to an embodiment of the present invention;

[0038] Figure 3 Shows a secure data link diagram of a container system according to an embodiment of the present invention;

[0039] Figure 4 Shows a schematic diagram of the creation process of a container system according to an embodiment of the present invention;

[0040] Figure 5 Shows a schematic diagram of the destruction process of a container system according to an embodiment of the present invention;

[0041] Figure 6 Shows a schematic diagram of the certificate activation process of a container system according to an embodiment of the present invention;

[0042] Figure 7 Shows a schematic diagram of the data import / export process of a container system according to an embodiment of the present invention;

[0043] Figure 8 Shows a schematic diagram of the identity token activation process of a container system according to an embodiment of the present invention;

[0044] Figure 9 Shows a schematic diagram of the structure of a smart terminal according to an embodiment of the present invention. Detailed implementation manners

[0045] The various embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. In each of the drawings, the same elements are denoted by the same or similar reference numerals. For clarity, the various parts in the drawings are not drawn to scale. In addition, some well-known parts may not be shown in the figures.

[0046] The following will further describe in detail the specific implementation manners of the present invention in conjunction with the accompanying drawings and embodiments. Many specific details of the present invention are described below, such as the structure, materials, dimensions, processing techniques and technologies of components, in order to understand the present invention more clearly. However, as those skilled in the art can understand, the present invention can be implemented without these specific details.

[0047] It should be understood that when describing the structure of a component, when a layer or a region is referred to as being "above" or "over" another layer or another region, it may mean directly above the other layer or another region, or there may be other layers or regions between it and the other layer or another region. And if the component is flipped, this layer or region will be "below" or "beneath" the other layer or another region.

[0048] Figure 1 Shows a schematic diagram of the structure of a container system according to an embodiment of the present invention. As Figure 1 shown, the container system according to an embodiment of the present invention is applied to a smart terminal (such as a smart phone, a smart watch, etc.) and includes a container unit 10.

[0049] Specifically, the container unit 10 runs in the secure environment of the intelligent terminal and stores a container attribute file. Optionally, the secure environment of the intelligent terminal includes at least one selected from the TEE (Trusted Execution Environment), SE (Secure Element) environment, and system keystore, etc.

[0050] The container unit 10 includes a first data interface. The first data interface is connected to the application 20 running on the intelligent terminal for data interaction. Among them, the data in the container attribute file is mapped to the data characteristic values stored in the application 20.

[0051] Optionally, a second data interface is set in the secure environment. The second data interface is connected to the remote trusted service platform server. The secure environment applies for a certificate to the remote trusted service platform server through the second data interface.

[0052] Optionally, a privacy information file is also stored in the secure environment. The privacy information file includes privacy data and data attributes. The data attributes include at least one selected from data type, access identifier, key algorithm, length, and usage, etc.

[0053] In an optional embodiment of the present invention, a cryptographic algorithm module runs in the container unit. The cryptographic algorithm module is used for at least one of key generation, data encryption, data decryption, certificate signing, and signature verification, etc. The cryptographic algorithm module is used to implement at least one of symmetric cryptographic algorithms, asymmetric cryptographic algorithms, international algorithms, and national cryptographic algorithms, etc.

[0054] In an optional embodiment of the present invention, the container unit includes a real-person container subunit and an application container subunit. The real-person container subunit is used for at least one of the generation, use, and destruction of real-person associated data, etc. The application container subunit is used for at least one of the creation, use, destruction (etc.), generation, storage, operation, import, export, and deletion of privacy data, etc.

[0055] In an optional embodiment of the present invention, the information stored in the container attribute file includes at least one selected from container space size, occupied container space size, container file index counter, and access authorization value, etc. Optionally, when storing and / or deleting data in the container unit, the occupied container space size in the container attribute file is updated; when storing a file in the container unit, the container file index counter in the container attribute file is updated. Optionally, when generating data and / or importing data into the container unit, it is verified whether there is corresponding access permission; when generating data and / or importing data into the container unit, the application stores the corresponding data characteristic values.

[0056] Figure 2The file management model of the container system according to an embodiment of the present invention is shown. In the present application, the real-person container (real-person container subunit) and the application container (application container subunit) are abstract concepts. For example, they refer to a structure for implementing a file management to meet the functions of the container system and the goals of the system, and there can be various organizational methods. As Figure 2 shown, taking a typical container file management model as an example:

[0057] The key data is stored in the user device certificate key pair file 100, such as the user device certificate key pair. Further, for the content about the user device certificate key pair, etc., reference can be made to Figure 8 and related descriptions.

[0058] The certificate data is stored in the user device certificate file 110, such as the user device certificate. Further, for the content about the user device certificate, etc., reference can be made to Figure 8 and related descriptions.

[0059] The user device identifier is stored in the user device identifier file 120. Further, for the content about the user device identifier, etc., reference can be made to Figure 8 and related descriptions.

[0060] The application container attribute file (container attribute file) 200 is a file that can represent the characteristics of the application container. The container attribute file is named, for example, with the application container identifier, and the application container identifier can uniquely identify the application in the terminal system. An optional calculation rule is: HASH(application package name + application certificate fingerprint). Optionally, the information stored in the container attribute file includes but is not limited to the container space size, the occupied space size of the container, the container file index counter, and the access authorization value, etc. Among them, the container file index counter can be an integer value of a file index that accumulates forward; the access authorization value can be a HASH value of a PIN code.

[0061] The data file (privacy information file) 210 is a file that stores user privacy information, including data attributes and (privacy) data. Among them, the data attributes represent parameters related to the data, such as data type, access identifier, key algorithm of the key, length, and usage, etc.

[0062] The data feature value 220 is, for example, data stored by a (general) application program itself and can be mapped to the data file in the container unit (container TA).

[0063] Figure 3 The security data (authentication) chain diagram of the container system according to an embodiment of the present invention is shown. As Figure 3As shown, the container unit according to an embodiment of the present invention runs in the secure environment (mobile secure environment) of the intelligent terminal. The server corresponding to the application running on the intelligent terminal is, for example, deployed in the cloud, and the remote trusted platform server is deployed in the cloud.

[0064] Specifically, business keys and digital certificates of multiple applications (such as Application 1, Application 2, etc.) are stored in the container unit (mobile secure environment).

[0065] Application 1 - Server applies for a certificate from Application 1 - CA Server and receives the issued certificate from Application 1 - CA Server. The container unit applies for a certificate from Application 1 - Server and receives the issued certificate from Application 1 - Server.

[0066] Application 2 - Server applies for a certificate from Application 2 - CA Server and receives the issued certificate from Application 2 - CA Server. The container unit applies for a certificate from Application 2 - Server and receives the issued certificate from Application 2 - Server.

[0067] The container unit applies for a certificate from the remote trusted platform server and receives the user device certificate and user device identifier issued by the remote trusted platform server.

[0068] The user device certificate, user device identifier, and user device certificate key pair are stored in the container unit. The business key / digital certificate of the application requests the signature of the user device certificate / user device identifier / user device certificate key pair, and the user device certificate / user device identifier / user device certificate key pair requests the signature of the trusted device key.

[0069] The server corresponding to the application (Application 1 - Server, Application 2 - Server) requests signature verification from the remote trusted platform server.

[0070] Figure 4 Shows a schematic diagram of the creation process of the container system according to an embodiment of the present invention. As Figure 4 shown, the creation process of the container system according to an embodiment of the present invention includes the following steps:

[0071] Step 1: Create an application container;

[0072] The ordinary application requests the security carrier access service program to create an application container (container unit).

[0073] Step 1.1: Create an application container according to the application information;

[0074] The security carrier access service program requests the container unit / container TA (Trusted Application) to create an application container according to the application information.

[0075] Step 1.1.1: Set authorization;

[0076] The container TA sets authorization.

[0077] Step 1.1.2: Create an application container property file;

[0078] The container TA creates an application container property file.

[0079] The container TA completes the creation of the application container and sends the creation result to the secure carrier access service program; the secure carrier access service program sends the creation result to the ordinary application program.

[0080] Figure 5 Shows a schematic diagram of the destruction process of the container system according to an embodiment of the present invention. As Figure 5 shown, the destruction process of the container system according to an embodiment of the present invention includes the following steps:

[0081] Step 1: Destroy the application container;

[0082] The ordinary application program requests the secure carrier access service program to destroy the application container (container unit).

[0083] Step 1.1: Destroy the application container according to the application information;

[0084] The secure carrier access service program requests the container TA to destroy the application container according to the application information.

[0085] Step 1.1.1: Verify authorization;

[0086] The container TA verifies authorization.

[0087] Step 1.1.2: Read the container information;

[0088] The container TA reads the container information.

[0089] Step 1.1.3: Delete all files;

[0090] The container TA deletes all files according to the file index counter.

[0091] Step 1.1.4: Delete the application container property file;

[0092] The container TA deletes the application container property file.

[0093] The container TA completes the destruction of the application container and sends the destruction result to the secure carrier access service program; the secure carrier access service program sends the destruction result to the ordinary application program.

[0094] Step 2: Delete all data feature values.

[0095] The ordinary application deletes all data feature values.

[0096] In an alternative embodiment of the present invention, the application container (container unit) can support the storage, use, and deletion of various privacy data, not limited to symmetric and asymmetric keys, certificates, user privacy data (metadata), etc. When the application container stores or deletes data, the occupied space of the container should be updated. When the application container stores a file, the container file index counter should be updated. When generating or importing data, the access permission of the data can be set. Whether generating or importing data, the application side will obtain the feature value of the data and should be saved in the application space so as to be able to index to the corresponding privacy file.

[0097] Optionally, the usage scenario of the application container is to enable a digital certificate for an ordinary application. Specifically, the application requests to generate a key pair; after the container unit verifies and authorizes, it generates the corresponding key pair and sends the data feature value of the key pair to the application.

[0098] Combined with Figure 6 As shown, the certificate enabling process of the container system according to the embodiment of the present invention specifically includes the following steps:

[0099] Step 1: Generate a key pair (key parameters);

[0100] The ordinary application requests the security carrier access service program to generate a key pair (key parameters).

[0101] Step 1.1: Generate a key pair (application information, key parameters);

[0102] The security carrier access service program requests the container TA (container unit) to generate a key pair (application information, key parameters).

[0103] Step 1.1.1: Verify authorization;

[0104] The container TA verifies authorization.

[0105] Step 1.1.2: Generate a key pair;

[0106] The container TA generates a key pair according to the key parameters.

[0107] Step 1.1.3: Store the key pair (key, key parameters);

[0108] The container TA saves the generated key pair. In response to the data feature value of the key, the ordinary application receives the data feature value via the security carrier access service program.

[0109] Step 2: Save the data feature value;

[0110] The ordinary application saves the data feature value.

[0111] Step 3: Apply for a certificate (certificate attributes, data feature values);

[0112] An ordinary application program applies for a certificate from the secure carrier access service program according to the certificate attributes and data feature values.

[0113] Step 3.1: Apply for a certificate (application information, certificate attributes, data feature values);

[0114] The secure carrier access service program applies for a certificate from the container TA according to the application information, certificate attributes, and data feature values.

[0115] Step 3.1.1: Generate a CSR (certificate attributes, data feature values);

[0116] The container TA retrieves the key according to the data feature values and generates a CSR (Certificate Signing Request).

[0117] Step 3.1.2: Sign the CSR with the real-person key;

[0118] The container TA signs with the real-person key. Then, the container TA sends the CSR and the signature value to the secure carrier access service program, and the secure carrier access service program sends the CSR and the signature value to the ordinary application program.

[0119] Step 4: Apply for a certificate (CSR, signature value);

[0120] The ordinary application program applies for a certificate from the application server.

[0121] Step 4.1: Verify the signature (CSR, signature value);

[0122] The application server verifies the signature with the remote trusted service platform server. Then, the remote trusted service platform server sends the signature verification result to the application server.

[0123] Step 4.2: Apply for a certificate (CSR);

[0124] The application server applies for a certificate from the application CA server. Then, the application CA server sends the digital certificate to the application server. The application server sends the digital certificate to the ordinary application program.

[0125] Step 5: Install the certificate (digital certificate);

[0126] The ordinary application program applies to the secure carrier access service program to install the digital certificate.

[0127] Step 5.1: Install the certificate (application information, digital certificate);

[0128] The secure carrier access service program requests the container TA to install a digital certificate.

[0129] Step 5.1.1: Save the certificate (digital certificate);

[0130] The container TA saves the digital certificate and generates a data feature value of the certificate. Then, the container TA sends the data feature value to the secure carrier access service program. The secure carrier access service program sends the data feature value to the general application program.

[0131] Step 6: Save the data feature value.

[0132] The general application program saves the data feature value to complete the activation of the application digital certificate.

[0133] Optionally, the usage scenario of the application container is data import and export. As shown in combination with Figure 7 The data import of the container system according to the embodiment of the present invention includes the following steps:

[0134] Step 1: Import data (data parameters, data);

[0135] The general application program requests the secure carrier access service program to import data.

[0136] Step 1.1: Import data (application information, data parameters, data);

[0137] The secure carrier access service program requests the container TA to import data.

[0138] Step 1.1.1: Save the data;

[0139] The container TA saves the data.

[0140] Step 1.1.2: Update the application container property file;

[0141] The container TA updates the application container property file and generates a corresponding data feature value. Then, the container TA sends the data feature value to the secure carrier access service program. The secure carrier access service program sends the data feature value to the general application program. Optionally, it supports encrypting the data with the key of the container TA before saving when importing data.

[0142] Step 2: Save the data feature value.

[0143] The general application program saves the data feature value.

[0144] The data usage of the container system according to the embodiment of the present invention includes the following steps:

[0145] Step 3: Process data (data feature value, data to be processed);

[0146] An ordinary application requests a secure carrier access service program to process data (generally referring to key encryption / decryption and signature verification operations).

[0147] Step 3.1: Process data (application information, data characteristic value, data to be processed);

[0148] The secure carrier access service program requests the container TA to process data.

[0149] Step 3.1.1: Verify authorization;

[0150] The container TA verifies the authorization.

[0151] Step 3.1.2: Process data (data characteristic value, data to be processed);

[0152] The container TA processes the data (generally referring to key operations such as encryption / decryption). After that, the container TA sends the processed data to the secure carrier access service program, and the secure carrier access service program sends the processed data to the ordinary application.

[0153] The data export of the container system according to the embodiment of the present invention includes the following steps:

[0154] Step 4: Export data (data characteristic value);

[0155] An ordinary application requests the secure carrier access service program to export data.

[0156] Step 4.1: Export data (application information, data characteristic value);

[0157] The secure carrier access service program requests the container TA to export data.

[0158] Step 4.1.1: Verify authorization;

[0159] The container TA verifies the authorization.

[0160] Step 4.1.2: Read data (data characteristic value).

[0161] The container TA reads the data. After that, the container TA sends the read data to the secure carrier access service program, and the secure carrier access service program sends the data to the ordinary application. Optionally, it supports decrypting the encrypted data first and then providing it to the ordinary application.

[0162] The data deletion of the container system according to the embodiment of the present invention includes the following steps:

[0163] Step 5: Delete data (data characteristic value);

[0164] An ordinary application requests the security carrier access service program to delete data.

[0165] Step 5.1: Delete data (application information, data eigenvalue);

[0166] The security carrier access service program requests the container TA to delete data.

[0167] Step 5.1.1: Verify authorization;

[0168] The container TA verifies the authorization.

[0169] Step 5.1.2: Delete data;

[0170] The container TA deletes the data.

[0171] Step 5.1.3: Update the application container property file;

[0172] The container TA updates the application container property file. After that, the container TA sends the updated result to the security carrier access service program, and the security carrier access service program sends the updated result to the ordinary application.

[0173] Step 6: Delete the data eigenvalue.

[0174] The ordinary application deletes the data eigenvalue.

[0175] Optionally, (the ordinary application) generates a subordinate service certificate according to the digital certificate. Different subordinate service certificates are used for the authentication of different subordinate services (i.e., different specific sub-services in the ordinary application).

[0176] The container system according to an embodiment of the present invention further includes a process for opening an identity token. Figure 8 The schematic diagram of the identity token opening process of the container system according to an embodiment of the present invention is shown. As Figure 8 shown, the identity token opening interaction of the container system according to an embodiment of the present invention occurs among the user, the management application 130, the security carrier 110, and the remote trusted service platform server 300.

[0177] First, a unified description is made for the terms that may be involved in the identity token opening interaction (the container system described in this application):

[0178] Identity Token refers to the identity proof data used to present to the authenticator in this product.

[0179] Identity Token System refers to the technical system that supports the operation of the identity token product.

[0180] Remote Trusted Service Platform (RTSP), i.e., the remote trusted service platform server 300.

[0181] Certificate Authority (CA) server, which forms part of the RTSP and is responsible for issuing, managing, storing, and revoking digital certificates.

[0182] User Device Cert (UDC), a digital certificate issued by the RTSP for a user's trusted device.

[0183] User Device Identifier (UDI), an identification number generated by the RTSP for a user's trusted device according to rules, which is associated with both the user and the trusted device. The UDI of the same user on different devices is different, and the UDI is bound to the user device certificate.

[0184] Trusted Device Key (TDK), a trusted device authentication key deployed by the device manufacturer to the device. The TDK can be called through the TEE interface and used to sign data to ensure that the data comes from a legitimate device trusted by the device manufacturer.

[0185] Trusted device authentication server, which forms part of the RTSP and is responsible for verifying the data signed with the TDK in the device to ensure that the data comes from a legitimate device trusted by the device manufacturer.

[0186] A unified description of the keys that may be involved in this application:

[0187] The Trusted Device Key (abbreviated as TDK) is a trusted device authentication key deployed by the device manufacturer to the device. The TDK is called through the TEE interface and used to sign data to ensure that the data comes from a legitimate device trusted by the device manufacturer. The trusted device key is generated or pre - installed in the security carrier 110. The security carrier 110 holds the private key of the trusted device key, and the RTSP holds the public key or certificate of the trusted device key.

[0188] The RTSP platform key (abbreviated as RTSP - TK) is created or pre - installed by the RTSP. The RTSP holds the private key of the RTSP platform key, and the security carrier 110 pre - installs the public key of the RTSP platform key.

[0189] The CA root key (abbreviated as CA - ROOT) is the key used by the certificate issuing server in the RTSP to issue certificates. The CA root key is generated or pre - installed by the RTSP. The RTSP stores the private key and certificate of the CA root key; the CA - ROOT certificate is also distributed to the authentication device 500.

[0190] The Application Business Authentication Key Public Key or Public Key Certificate (referred to as ABA-PK) is used to verify the business authorization package of the real-person information submitted by the general application 120 when it calls the security carrier 100. This authorization package is signed by RTSP using the corresponding private key. The Application Business Authentication Key Public Key or Public Key Certificate is pre-set by RTSP or dynamically generates an application authorization verification key pair, and the public key is pre-set or synchronized (stored) to the security carrier 110.

[0191] The Application Authorization Verification Key Private Key (referred to as ABA-SK) is stored in RTSP. RTSP uses this key to authorize and sign the business of the submitted real-person information of the application.

[0192] The Token Encryption Master Key (referred to as TEK-MK) is used to decentralize the master key of each identity token encryption key. The Token Encryption Master Key is created or pre-set by RTSP and synchronized to the authentication device 500. The Token Encryption Master Key is stored in RTSP / the authentication device 500.

[0193] The Token Encryption Sub-Key (referred to as TEK-DK) is the key used to encrypt the identity token data on the user device side. The Token Encryption Sub-Key is decentralized by RTSP and transmitted (stored) to the security carrier 110.

[0194] The Secure Channel Key Group (referred to as SCKs, specifically including the encryption key SCK-ENC and the verification key SCK-HMAC) is used to establish a secure channel between the security carrier 110 and RTSP, and is created during the process of opening the user device certificate. The Secure Channel Key Group is randomly generated by RTSP and synchronized to the security carrier 110. The Secure Channel Key Group is stored in RTSP / the security carrier 110.

[0195] The User Device Certificate Key Pair (including the User Device Certificate Private Key UDC-SK and the User Device Certificate Public Key UDC-PK) is created and generated (randomly generated) by the security carrier 110, and the public key is exported to RTSP for signing the user device certificate (UDC-PK is exported and sent to RTSP), the private key is used for business confirmation signature, and the public key is used for signature verification. The security carrier 110 saves UDC-SK and the UDC signed by RTSP; RTSP saves the UDC.

[0196] The Identity Information Submission Temporary Asymmetric Encryption Key (referred to as IEK) is used to encrypt and protect the identity information when submitting the identity information to the application. It is generated by the application server 200 and synchronized to the security carrier 110 after being authenticated by RTSP. The application server 200 caches or saves the private key of the identity information submission temporary asymmetric encryption key.

[0197] Specifically, the user sends a function activation request to the management application 130 (the user operates the management application 130 for activation); the management application 130 collects the user's identity information and on-site face (takes a face photo), and the user provides the identity information and the on-site face photo to the management application 130.

[0198] The security carrier 110 obtains the ciphertext of the face information from the management application 130, calculates and saves the face feature template (calculates and saves the face feature data obtained by using the face photo), encrypts the identity information and the face photo with the RTSP-TK public key, where RTSP-TK is, for example, the key of the remote trusted service platform server. The security carrier 110 sends the ciphertext of the identity information to the management application 130.

[0199] The management application 130 submits a real-person verification to the remote trusted service platform server 300, and the submitted real-person verification includes the ciphertext of the identity information (the user's identity information and the face ciphertext). The remote trusted service platform server 300 decrypts the identity information and the photo (the user's identity and the face data) with the RTSP-TK private key, and conducts a comparison with the database of the authoritative agency service (for the face). The remote trusted service platform server 300 returns the comparison result to the management application 130.

[0200] The management application 130 calls the security carrier 110 to create an activation request. The security carrier 110 conducts a security check on the device status, creates a UDC-SK key pair (the generation of the UDC-SK key has the property of one key per device), assembles the activation request data (including at least the public key of the security key pair, the device identifier, and the self-signature), and signs the activation request data with TDK (Trusted Device Key, the trusted device key) (for the second time). Among them, the security carrier 110 requests the user to set the key PIN code (pops up the TUI (Trusted UI, the trusted interface) for the user to set the PIN code). The security carrier 110 returns the activation request data to the management application 130.

[0201] The management application 130 sends an activation request to the remote trusted service platform server 300, and the activation request includes the activation request data. The remote trusted service platform server 300 verifies the activation request data with the TDK public key, generates the UDI, issues the UDC (generates the user device identifier UDI according to the user information and issues the user device certificate UDC), generates the SCKs, disperses the sub-key TEK-DK with the TEK-MK (for the user device identifier), and encrypts the UDC, TEK-DK, UDI, and the user's identity information with the SCKs, and encrypts the SCKs with the UDC-PK. The remote trusted service platform server 300 sends the activation response data (including the above data) to the management application 130.

[0202] The management application 130 imports the activation response (activation response data) into the secure carrier 110. The secure carrier 110 decrypts the SCKs using the UDC-SK, and then decrypts and saves the UDC, UDI, TEK-DK, and user identity information using the SCKs. The secure carrier 110 binds the local biometric feature, and if the binding is successful, the trusted token can be unlocked using the local biometric feature verification.

[0203] Optionally, the container TA runs in the trusted execution environment TEE112, providing functions such as generation, use, and destruction of real-person associated data, creation, use, and destruction of containers, generation, storage, operation, import, export, and deletion of privacy data, etc.

[0204] Optionally, the container TA includes a real-person container of an abstract concept, generally referring to a space for generating, using, and destroying real-person associated data. The container TA includes an application container of an abstract concept, generally referring to a space involved in the creation, use, and destruction of application containers, and the generation, storage, operation, import, export, and deletion of privacy data.

[0205] Optionally, the container TA includes a cryptographic algorithm module, providing algorithm functions such as key generation, data encryption and decryption, certificate signing and verification, etc.

[0206] According to another aspect of the present invention, an intelligent terminal is provided. The intelligent terminal includes the container system as described above.

[0207] Figure 9 The structural schematic diagram of the intelligent terminal according to an embodiment of the present invention is shown. As Figure 9 shown, the terminal device (intelligent terminal) 100 is a terminal device held by a user, such as a smart phone, a smart watch, etc. The terminal device 100 integrates a secure carrier (such as TEE or SE or both).

[0208] The intelligent terminal according to an embodiment of the present invention includes at least one of the following components:

[0209] The secure carrier 110 is a software and hardware module on the terminal device 100. Internally, it accesses the TEE\SE to implement the secure function interface and provides the interface to external applications. Among them, the secure carrier access service program 111 provides the entity program for the external interface of the secure carrier 110. It accesses the TEE\SE to implement the functional interface encapsulation of the identity token and provides external calls. The TEE (Trusted Execution Environment) 112 is a type of secure carrier, which is a logical secure isolation area of the system SOC and can execute secure application programs. The SE (Secure Element) 112 is generally an independent encryption chip. Due to its independent isolation characteristics, it has a higher security level than the TEE. Invoking the SE interface in the TEE can further ensure business security.

[0210] The general application program 120 is an application program that calls the secure carrier 110 to call various functions of the identity token. The management application program 130 is an application program that calls the secure carrier 110 to perform the activation management of the identity token.

[0211] The terminal device 100 is also respectively connected to the application server 200, the remote trusted service platform server 300, and the authentication device 500 to perform information interaction.

[0212] The remote trusted service platform server 300 is the general term for services participating in the operation of the identity token service, including but not limited to: authoritative identity authentication service, certificate issuance service, identity token verification service, activation management service, application access service, etc., and also includes the relevant background services of the terminal device manufacturer.

[0213] The application server 200 is the background service of the general application program 120 and processes the authentication requests of the general application program 120.

[0214] The authentication device 500 is a device used to verify and authenticate the identity token generated by the terminal device.

[0215] The container system and intelligent terminal applied to an intelligent terminal according to an embodiment of the present invention. The application container (secure environment) provides security measures such as data isolation, access control, and resource limitation, enhancing the overall security of the system; a perfect file management mechanism is built in the secure environment, enhancing the isolation and availability of data; the construction of the PKI (Public Key Infrastructure) system is improved, making the data link more trustworthy and secure. At the same time, the binding (coupling) problem between application providers and device manufacturers is solved, improving development efficiency and reducing costs. It reduces the resources occupied by multiple trusted applications during the operation of the device system, can provide real-person authentication services to applications, and prevents the risk of application institutions leaking user identity information privacy; a data encapsulation interface around the PKI certificate system is provided in the secure environment, which complies with the relevant specifications of the National Cryptography Administration, and an authoritative institution is introduced; a powerful cryptographic algorithm module is implemented in the secure environment, providing support for a rich variety of symmetric and asymmetric cryptographic algorithms (including national cryptographic algorithms and international algorithms), and the data encapsulation complies with the specifications of the National Cryptography Administration, which can better meet the needs of industries such as finance; in the secure environment, not only keys are provided, but also broader protection for the storage of user privacy data is provided, and detailed data access control means are provided, providing rich data storage. It can store not only keys but also user-related data such as private photos and electronic licenses, and is also applicable to the import, storage, and export of user privacy data; user identity token authentication and user device identification anonymize personal information on the application server, ensuring the security of personal information.

[0216] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising one..." does not exclude the existence of additional identical elements in the process, method, article or device comprising the said element.

[0217] As described above with reference to the embodiments of the present invention, these embodiments do not describe all the details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made according to the above description. These embodiments are selected and specifically described in this specification in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can make good use of the present invention and its modifications based on the present invention. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. A container system applied to a smart terminal, comprising: A container unit, wherein the container unit runs in a security environment of the intelligent terminal and stores a container attribute file; The container unit includes a first data interface, which is connected to an application program running on the smart terminal for data interaction. The data in the container attribute file is mapped to the data characteristic values ​​stored in the application.

2. The container system according to claim 1, wherein: A second data interface is provided in the security environment; The second data interface is connected to a remote trusted service platform server; the security environment applies for a certificate from the remote trusted service platform server through the second data interface; The container unit applies for a certificate from the server corresponding to the application through the first data interface and / or the second data interface.

3. The container system according to claim 1, wherein: A cryptographic algorithm module runs in the container unit; the cryptographic algorithm module is used for at least one of key generation, data encryption, data decryption, certificate signing and signature verification; the cryptographic algorithm module is used to implement at least one of a symmetric cryptographic algorithm, an asymmetric cryptographic algorithm, an international algorithm and a national secret algorithm.

4. The container system according to claim 1, wherein: The container unit comprises: A real person container subunit, the real person container subunit being used for at least one of generating real person associated data, using real person associated data, and destroying real person associated data; An application container subunit, wherein the application container subunit is used for at least one of creating an application container, using an application container, destroying an application container, generating private data, storing private data, calculating private data, importing private data, exporting private data and deleting private data.

5. The container system according to claim 1, wherein: The information stored in the container attribute file includes at least one selected from the group consisting of container space size, container occupied space size, container file index counter, and access authorization value.

6. The container system according to claim 5, wherein: When storing and / or deleting data in the container unit, updating the size of the space occupied by the container in the container attribute file; When a file is stored in the container unit, a container file index counter in the container attribute file is updated.

7. The container system of claim 1, wherein: When generating data and / or importing data into the container unit, verifying whether corresponding access rights are possessed; When generating data and / or importing data into the container unit, the application stores corresponding data feature values.

8. The container system of claim 1, wherein: The secure environment also stores a privacy information file; The privacy information file includes privacy data and data attributes, and the data attributes include at least one selected from data type, access identifier, key algorithm, length and purpose.

9. The container system of claim 1, wherein: The application program applies for generating a key pair; after the container unit verifies the authorization, it generates a corresponding key pair; The application applies for a certificate; the container unit performs key signing according to the key pair; The application program applies for a certificate from the application server, and the application server verifies the signature from the remote trusted service platform server; The application server applies for a digital certificate from the application CA server; The application program applies for installing the digital certificate; the container unit stores the digital certificate.

10. The container system according to claim 9, wherein: A subordinate service certificate is generated according to the digital certificate, and the subordinate service certificate is used for authentication of the subordinate service.

11. An intelligent terminal, comprising: The container system according to any one of claims 1 to 10.

Images