Security processing methods, apparatus and electronic devices in multi-trusted execution environments

Abstract

This application provides a security processing method, apparatus, and electronic device in a multi-trusted execution environment. In the aforementioned security processing method, after the electronic device obtains a first request from a first CA, it sends the first request to a first TA according to the first security level required by the first request, and the first TA performs security processing on the first request. After the electronic device obtains a second request from the first CA, it can send the second request to a second TA through a second TEE according to the second security level required by the second request, and the second TA performs security processing on the second request. The second security level is higher than the first security level. Since the first TEE and the second TEE are two isolated TEEs, different security applications used for key management in the electronic device can run in isolated TEEs, reducing coupling and improving the security of the electronic device.

Description

Technical Field

[0001] This application relates to the field of smart terminal technology, and in particular to a security processing method, apparatus and electronic device in a multi-trusted execution environment. Background Technology

[0002] Currently, with the development of communication technology, the application of smart electronic devices is becoming increasingly widespread. To protect user privacy and information security, smart electronic devices (such as smartphones and / or tablets) typically include a rich execution environment (REE) and a trusted execution environment (TEE). The REE, also known as the general execution environment, includes a rich execution environment operating system (REE OS) running on a general-purpose processor, as well as client applications (CAs). The TEE, also known as the secure execution environment, can run a trusted execution environment operating system (TEE OS), providing trusted security services to the CA (such as fingerprint verification, password verification, and / or facial recognition services). These security services can run on the TEE OS as trusted applications (TAs). Summary of the Invention

[0003] This application provides a security processing method, apparatus, and electronic device in a multi-trusted execution environment. This application also provides a computer-readable storage medium to enable different security applications used for key management in an electronic device to run in isolated trusted execution environments, thereby reducing the coupling phenomenon that occurs when different security applications used for key management run in the same trusted execution environment and improving the security of the electronic device.

[0004] In a first aspect, embodiments of this application provide a secure processing method in a multi-trusted execution environment, applied to an electronic device. The electronic device includes: a rich execution environment, a first trusted execution environment, a second trusted execution environment, and a secure element. The rich execution environment includes: a first client application. The first trusted execution environment includes: a first trusted application for key management. The secure element includes: a second trusted application for key management. The method includes: obtaining a first request from the first client application; sending the first request to the first trusted application according to a first security level required by the first request, whereby the first trusted application performs secure processing on the first request; obtaining a second request from the first client application; sending the second request to the second trusted application through the second trusted execution environment according to a second security level required by the second request, whereby the second trusted application performs secure processing on the second request; wherein the second security level is higher than the first security level.

[0005] In the aforementioned security processing method under a multi-trusted execution environment, after the electronic device obtains a first request from the first CA, it sends the first request to the first TA according to the first security level required by the first request, and the first TA performs security processing on the first request. After the electronic device obtains a second request from the first CA, it can send the second request to the second TA through the second TEE according to the second security level required by the second request, and the second TA performs security processing on the second request. The second security level is higher than the first security level. Since the first TA runs in the first TEE, and the first TEE and the second TEE are two isolated TEEs, different security applications used for key management in the electronic device can run in isolated TEEs, reducing the coupling phenomenon that occurs when different TAs used for key management run in the same TEE, and improving the security of the electronic device.

[0006] In one possible implementation, the first request may include a first key generation request; the rich execution environment may further include: a second client application for key management, a third client application for key services, and a fourth client application for key services; thus, obtaining the first request from the first client application in the rich execution environment can be: the second client application obtains the first key generation request from the first client application; according to the first security level required by the first request, the first request is sent to a first trusted application, and the first trusted application performs security processing on the first request; the second client application sends the first key generation request to the third client application according to the first security level required by the first key generation request; the third client application sends the first key generation request to the first trusted application; the first trusted application generates a first key according to the first key generation request and sends the first key to the third client application.

[0007] In one possible implementation, the first trusted application generates a first key based on a first key generation request, sends the first key to the third client application, and then the third client application can send the first key to the second client application. The second client application saves the first key and sends the identifier of the first key to the first client application.

[0008] In one possible implementation, the second client application stores the first key. After sending the identifier of the first key to the first client application, the second client application can obtain the first data encryption request from the first client application. The first data encryption request carries the first data to be encrypted and the identifier of the first key. Based on the identifier of the first key, the second client application obtains the first key and, according to the first security level required by the first data encryption request, sends the first key and the first data to the third client application. The third client application sends the first key and the first data to the first trusted application. The first trusted application uses the first key to encrypt the first data and sends the encrypted first data to the third client application. The third client application sends the encrypted first data to the second client application. The second client application then sends the encrypted first data to the first client application.

[0009] In one possible implementation, the second request may include a second key generation request; the first trusted execution environment further includes a fourth trusted application for trusted communication; the rich execution environment further includes a second client application for key management, a third client application for key services, and a fourth client application for key services; thus, obtaining the second request from the first client application can be: the second client application obtains the second key generation request from the first client application; according to the second security level required by the second request, the second request is sent to the second trusted application through the second trusted execution environment, and the second trusted application performs secure processing on the second request; the second client application sends the second key generation request to the fourth client application according to the second security level required by the second key generation request; the fourth client application sends the second key generation request to the fourth trusted application; the fourth trusted application establishes a trusted connection with the second trusted execution environment and sends the second key generation request to the second trusted application through the trusted connection; the second trusted application generates a second key according to the second key generation request and sends the second key to the fourth trusted application through the trusted connection.

[0010] In one possible implementation, the second trusted application generates a second key according to the second key generation request, sends the second key to the fourth trusted application through the aforementioned trusted connection, and then the fourth trusted application sends the second key to the fourth client application; the fourth client application sends the second key to the aforementioned second client application; the second client application saves the aforementioned second key and sends the identifier of the aforementioned second key to the first client application.

[0011] In one possible implementation, the second client application stores the second key and sends the identifier of the second key to the first client application. The second client application can then obtain a second data encryption request from the first client application. This second data encryption request carries the second data to be encrypted and the identifier of the second key. The second client application obtains the second key based on the identifier of the second key and, according to the second security level required by the second data encryption request, sends the second key and the second data to the fourth client application. The fourth client application sends the second key and the second data to a fourth trusted application. The fourth trusted application sends the second key and the second data to the second trusted application via a trusted connection with the second trusted execution environment. The second trusted application encrypts the second data using the second key and sends the encrypted second data to the fourth trusted application via the trusted connection. The fourth trusted application then sends the encrypted second data to the fourth client application. The fourth client application sends the encrypted second data to the second client application. Finally, the second client application sends the encrypted second data to the first client application.

[0012] In one possible implementation, the first trusted execution environment is implemented based on the processor of the electronic device, and the second trusted execution environment is implemented based on the virtual machine in the electronic device; the first trusted execution environment and the second trusted execution environment are two trusted execution environments that are isolated from each other.

[0013] In the above implementation, the first TA and the fourth TA run in the first TEE. The fourth TA does not directly access the second TA, but first establishes a trusted connection with the second TEE and accesses the second TA through this trusted connection. Since the first TEE and the second TEE are two TEEs that are isolated from each other, the occurrence of coupling phenomenon can be reduced and the security of electronic devices can be improved.

[0014] Secondly, embodiments of this application provide a secure processing apparatus in a multi-trusted execution environment. This apparatus is included in an electronic device and has the function of implementing the electronic device behaviors described in the first aspect and its possible implementations. The functions can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the aforementioned functions. For example, a receiving unit, a processing module, and a transmitting module, etc.

[0015] Thirdly, embodiments of this application provide an electronic device, including: one or more processors; a memory; multiple application programs; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the electronic device, cause the electronic device to perform the method provided in the first aspect.

[0016] It should be understood that the second and third aspects of the embodiments of this application are consistent with the technical solutions of the first aspect of the embodiments of this application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation are similar, and will not be described again.

[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the method provided in the first aspect.

[0018] Fifthly, embodiments of this application provide a computer program that, when executed by a computer, performs the method provided in the first aspect.

[0019] In one possible design, the program in the fifth aspect can be stored wholly or partially on a storage medium packaged with the processor, or it can be stored wholly or partially on a memory not packaged with the processor. Attached Figure Description

[0020] Figure 1 A schematic diagram of the key management process in electronic devices provided by existing related technologies;

[0021] Figure 2 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application;

[0022] Figure 3 A software structure block diagram of an electronic device provided in one embodiment of this application;

[0023] Figure 4 A schematic diagram of an ARM architecture provided for one embodiment of this application;

[0024] Figure 5A schematic diagram of an ARM architecture provided for another embodiment of this application;

[0025] Figure 6 A flowchart illustrating a security processing method in a multi-trusted execution environment provided in one embodiment of this application;

[0026] Figure 7 This is a schematic diagram illustrating the implementation of a security processing method in a multi-trusted execution environment according to an embodiment of this application;

[0027] Figure 8 A schematic diagram of an ARM architecture provided in yet another embodiment of this application;

[0028] Figure 9 A schematic diagram illustrating the implementation of a security processing method in a multi-trusted execution environment, as provided in another embodiment of this application;

[0029] Figure 10 A schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0030] The terminology used in the implementation section of this application is for the purpose of explaining specific embodiments of this application only, and is not intended to limit this application.

[0031] Figure 1 A schematic diagram of the key management process in electronic devices provided for existing related technologies, such as Figure 1 As shown, the REE includes a first CA, a second CA for key management, a third CA for key services, and a fourth CA for key services; the TEE includes a first TA for key management and a third TA for proxy services; and the embedded secure element (eSE) of the electronic device includes a second TA for key management.

[0032] The first CA can be a common client application installed on an electronic device, such as an instant messaging application, map application, banking application, or music playback application. When the first CA needs to use a key, it can access the first TA in the TEE through the third CA in the REE used for key services; or, the first CA can access the third TA in the TEE through the fourth CA in the REE used for key services, and then the third TA accesses the second TA in the eSE through the driver in the TEE. However, since the third TA and the driver required to access the second TA both run in the TEE, there is a possibility that the third TA and the driver are coupled with the first TA, posing a certain security risk.

[0033] Based on the above problems, this application provides a security processing method in a multi-trusted execution environment, which can enable different security applications used for key management in electronic devices to run in isolated trusted execution environments, reduce the coupling phenomenon that occurs when different security applications used for key management run in the same trusted execution environment, and improve the security of electronic devices.

[0034] The security processing method in a multi-trusted execution environment provided in this application can be applied to electronic devices, such as smartphones, tablets, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs). This application does not impose any restrictions on the specific type of electronic device.

[0035] For example, Figure 2 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application, such as... Figure 2 As shown, the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone jack 170D, a sensor module 180, buttons 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0036] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0037] Processor 110 may include one or more processing units, such as application processors (APs), modem processors, graphics processing units (GPUs), image signal processors (ISPs), controllers, video codecs, digital signal processors (DSPs), baseband processors, and / or neural network processing units (NPUs). These different processing units may be independent devices or integrated into one or more processors.

[0038] The controller can generate operation control signals based on the instruction opcode and timing signals to complete the control of instruction fetching and execution.

[0039] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0040] USB port 130 is a USB standard compliant interface, specifically a Mini USB port, Micro USB port, USB Type-C port, etc. USB port 130 can be used to connect a charger to charge electronic device 100, and can also be used for data transfer between electronic device 100 and peripheral devices. It can also be used to connect headphones for audio playback. This interface can also be used to connect other electronic devices, such as AR devices.

[0041] It is understood that the interface connection relationships between the modules illustrated in the embodiments of this application are merely illustrative and do not constitute a structural limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0042] The charging management module 140 receives charging input from a charger. The charger can be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 receives charging input from the wired charger via a USB interface 130. In some wireless charging embodiments, the charging management module 140 receives wireless charging input via the wireless charging coil of the electronic device 100. While charging the battery 142, the charging management module 140 can also supply power to the electronic device 100 via the power management module 141.

[0043] The power management module 141 connects the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, providing power to the processor 110, internal memory 121, display screen 194, camera 193, and wireless communication module 160, etc. The power management module 141 can also monitor parameters such as battery capacity, battery cycle count, and battery health status (leakage current, impedance). In some other embodiments, the power management module 141 may also be located within the processor 110. In other embodiments, the power management module 141 and the charging management module 140 may be located in the same device.

[0044] The wireless communication function of electronic device 100 can be realized through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor, etc.

[0045] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover one or more communication frequency bands. Different antennas can also be multiplexed to improve antenna utilization. For example, antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with tuning switches.

[0046] The mobile communication module 150 can provide solutions for wireless communication, including 2G / 3G / 4G / 5G, applied to the electronic device 100. The mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves via antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to a modem processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modem processor and convert it into electromagnetic waves for radiation via antenna 1. In some embodiments, at least some functional modules of the mobile communication module 150 may be housed in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 150 and at least some modules of the processor 110 may be housed in the same device.

[0047] The modem processor may include a modulator and a demodulator. The modulator modulates the low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator demodulates the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through an audio device (not limited to speaker 170A, receiver 170B, etc.) or displays images or videos through the display screen 194. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 110 and may be housed in the same device as the mobile communication module 150 or other functional modules.

[0048] The wireless communication module 160 can provide solutions for wireless communication applications on the electronic device 100, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via antenna 2, performs frequency modulation and filtering of the electromagnetic wave signals, and sends the processed signal to processor 110. The wireless communication module 160 can also receive signals to be transmitted from processor 110, perform frequency modulation and amplification, and convert them into electromagnetic waves for radiation via antenna 2.

[0049] In some embodiments, antenna 1 of electronic device 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, enabling electronic device 100 to communicate with networks and other devices via wireless communication technology. The wireless communication technology may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies, etc. The GNSS may include the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), the BeiDou Navigation Satellite System (BDS), the Quasi-Zenith Satellite System (QZSS), and / or satellite-based augmentation systems (SBAS).

[0050] Electronic device 100 implements display functions through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0051] Display screen 194 is used to display images, videos, etc. Display screen 194 includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a miniature LED, a microLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, electronic device 100 may include one or N displays 194, where N is a positive integer greater than 1.

[0052] Electronic device 100 can perform shooting functions through ISP, camera 193, video codec, GPU, display 194 and application processor.

[0053] The ISP (Image Signal Processor) is used to process data fed back from the camera 193. For example, when taking a picture, the shutter is opened, and light is transmitted through the lens to the camera's photosensitive element. The light signal is converted into an electrical signal, and the camera's photosensitive element transmits the electrical signal to the ISP for processing, transforming it into an image visible to the naked eye. The ISP can also perform algorithmic optimization of image noise, brightness, and skin tone. The ISP can also optimize parameters such as exposure and color temperature of the shooting scene. In some embodiments, the ISP can be set in the camera 193.

[0054] Camera 193 is used to capture still images or videos. An object is projected onto a photosensitive element by generating an optical image through the lens. The photosensitive element can be a charge-coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then passed to an ISP for conversion into a digital image signal. The ISP outputs the digital image signal to a DSP for processing. The DSP converts the digital image signal into image signals in standard RGB, YUV, or other formats. In some embodiments, the electronic device 100 may include one or N cameras 193, where N is a positive integer greater than 1.

[0055] Digital signal processors (DSPs) are used to process digital signals. Besides digital image signals, they can also process other digital signals. For example, when electronic device 100 selects a frequency, the DSP can perform Fourier transforms on the frequency energy.

[0056] Video codecs are used to compress or decompress digital video. Electronic device 100 may support one or more video codecs. Thus, electronic device 100 can play or record videos in various encoding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0057] An NPU (Neural Processing Unit) is a computational processor for neural networks (NNs). By borrowing the structure of biological neural networks, such as the transmission patterns between neurons in the human brain, it can rapidly process input information and continuously learn on its own. NPUs enable intelligent cognitive applications in electronic devices, such as image recognition, facial recognition, speech recognition, and text understanding.

[0058] The external storage interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external storage interface 120 to perform data storage functions. For example, music, video, and other files can be saved on the external memory card.

[0059] Internal memory 121 can be used to store computer executable program code, which includes instructions. Internal memory 121 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback, image playback, etc.), etc. The data storage area may store data created during the use of electronic device 100 (such as audio data, phonebook, etc.). Furthermore, internal memory 121 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc. Processor 110 executes various functional applications and data processing of electronic device 100 by running instructions stored in internal memory 121 and / or instructions stored in memory located in the processor.

[0060] Electronic device 100 can implement audio functions, such as music playback and recording, through audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, and application processor.

[0061] The audio module 170 is used to convert digital audio information into analog audio signals for output, and also to convert analog audio input into digital audio signals. The audio module 170 can also be used for encoding and decoding audio signals. In some embodiments, the audio module 170 may be located in the processor 110, or some functional modules of the audio module 170 may be located in the processor 110.

[0062] The speaker 170A, also known as a "loudspeaker," is used to convert audio electrical signals into sound signals. The electronic device 100 can listen to music or make hands-free calls through the speaker 170A.

[0063] The receiver 170B, also known as the "earpiece," is used to convert audio electrical signals into sound signals. When the electronic device 100 answers a telephone call or voice message, the receiver 170B can be brought close to the ear to listen to the voice.

[0064] Microphone 170C, also known as a "microphone" or "voice transducer," is used to convert sound signals into electrical signals. When making a phone call or sending a voice message, the user can speak by bringing their mouth close to microphone 170C, inputting the sound signal into microphone 170C. Electronic device 100 may have at least one microphone 170C. In some embodiments, electronic device 100 may have two microphones 170C, which, in addition to collecting sound signals, can also perform noise reduction. In other embodiments, electronic device 100 may also have three, four, or more microphones 170C, which can collect sound signals, reduce noise, identify the sound source, and perform directional recording, etc.

[0065] The 170D headphone jack is used to connect wired headphones. The 170D headphone jack can be a USB 130 interface or a 3.5mm Open Mobile Terminal Platform (OMTP) standard interface, a CTIA (Cellular Telecommunications Industry Association of the USA) standard interface.

[0066] Buttons 190 include a power button, volume buttons, etc. Buttons 190 can be mechanical buttons or touch-sensitive buttons. Electronic device 100 can receive button input and generate key signal inputs related to user settings and function control of electronic device 100.

[0067] Motor 191 can generate vibration alerts. Motor 191 can be used for incoming call vibration alerts or for touch vibration feedback. For example, different vibration feedback effects can correspond to touch operations performed on different applications (such as taking photos, playing audio, etc.). Motor 191 can also correspond to different vibration feedback effects for touch operations performed on different areas of the display screen 194. Different application scenarios (such as time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also be customized.

[0068] Indicator 192 can be an indicator light, used to indicate charging status, power changes, or to indicate messages, missed calls, notifications, etc.

[0069] The SIM card interface 195 is used to connect a SIM card. The SIM card can be inserted into or removed from the SIM card interface 195 to make contact with and separate from the electronic device 100. The electronic device 100 can support one or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc. Multiple cards can be inserted into the same SIM card interface 195 simultaneously. The multiple cards can be of the same or different types. The SIM card interface 195 is also compatible with different types of SIM cards. The SIM card interface 195 is also compatible with external memory cards. The electronic device 100 interacts with the network through the SIM card to realize functions such as calls and data communication. In some embodiments, the electronic device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.

[0070] The software architecture of the aforementioned electronic devices can adopt a layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture. The following section uses a layered architecture as an example to illustrate the software structure of electronic devices.

[0071] Figure 3This is a software architecture block diagram of an electronic device provided in one embodiment of this application. The layered architecture divides the software system into several layers, each with a clear role and division of labor. Layers communicate with each other through software interfaces. In some embodiments, the software system can be divided into four layers, from top to bottom: applications, application framework, system, and kernel. It should be understood that the execution environment in the electronic device 100 includes REE and TEE, and applications and operating systems (OS) can run independently under both TEE and REE. Meanwhile, each layer of the software architecture includes software components that can run on both TEE and REE, which will be described in detail below:

[0072] The application layer can include a series of applications. Based on their execution environment, these applications can be categorized into ordinary applications (REE apps) and trusted applications (TAs). REE apps are those running on an REE (Remote Application Environment), such as calendar, memo, map, navigation, video, payment, or chat apps; REE apps can also be called CAs (Certificates of Compatibility). TAs are those running on a TEE (Trusted Application Environment). Compared to REEs, TEEs provide a more secure space for data and code execution, ensuring their confidentiality and integrity. Therefore, TEEs can be used to run apps with high security requirements.

[0073] It's important to note that the TA (Transaction Provider) can be a standalone app, such as a wallet application. Alternatively, the TA may not be a standalone app but rather embedded within the REE app to implement a specific function within the REE app. For example, if the REE app is a banking app, the transfer function within a banking app requires a banking TA. In other words, running the banking app and triggering the transfer function will activate the banking TA. Clearly, the banking TA can be understood as an app embedded within the REE app.

[0074] The application framework layer provides application programming interfaces (APIs) and a programming framework for applications within the application layer. For example, the application framework layer includes various services that support application execution, such as Bluetooth and / or camera services. Also, based on the execution environment, the application framework layer includes services that support the REE app and services that support the TA.

[0075] The system layer can include operating systems running under REE (which can be referred to as ordinary operating systems REE OS), such as Android, iOS, and Linux, as well as operating systems running under TEE (which can be referred to as trusted operating systems TEE OS). It should be understood that the OS can include system libraries, such as media libraries and 3D graphics processing libraries (e.g., OpenGLES). Media libraries support playback and recording of various common audio and video formats, as well as still image files. Media libraries can support various audio and video encoding formats, such as JPG and PNG. 3D graphics processing libraries are used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0076] The kernel layer is the layer between hardware and software. It can include hardware drivers such as display drivers, touchscreen drivers, camera drivers, audio drivers, sensor drivers, and Bluetooth drivers, which are used to drive the hardware. Similarly, corresponding to the two execution environments, these hardware drivers can also be divided into two types.

[0077] Furthermore, the processor of electronic device 100 can typically employ an advanced reduced instruction set computing (RISC) machine (ARM) architecture. Because ARM uses a reduced instruction set computing (RISC) instruction set, it avoids complex instructions, focusing primarily on logic control and using little or no microcode control. This allows for a small size and low power consumption in the system-on-chip (SoC), making it highly suitable for small electronic devices.

[0078] Figure 4 A schematic diagram of an ARM architecture provided in one embodiment of this application, as shown below. Figure 4 As shown, the ARM architecture can include four exception levels (EL), from EL0 to EL3. For ELn (where n is an integer greater than or equal to 0), the larger n is, the greater the privileged access the software can have. Execution at EL0 level is called unprivileged execution. Furthermore, the larger n is, the higher the privileged access to resources within the electronic device 100.

[0079] EL0 runs applications from the application layer, such as REE apps and TAs, as well as various services provided by the application framework layer to support application execution, such as general application services and security application services. EL1 runs the operating system (OS) from the system layer, such as REE OS and TEE OS, and hardware drivers from the kernel layer, such as general application drivers and security application drivers. EL2 runs a hypervisor, which can create virtual machines, each with its own independent operating system (i.e., the OS running within each virtual machine), capable of independently running applications and storing data. EL3 supports transitions between secure and insecure states. For example, EL3 runs a security monitor (SecureMonitor).

[0080] Figure 5 A schematic diagram of an ARM architecture provided for another embodiment of this application, as shown below. Figure 5 As shown, the electronic device 100 includes an REE and two TEEs, which can be referred to as the first TEE and the second TEE, respectively. The first TEE can be implemented based on the processor 110 of the electronic device 100. ARM integrates TrustZone technology with the Cortex-A processor, providing a platform that can support the first TEE as well as security-aware applications and security services. As a trusted execution environment in the electronic device 100, the first TEE can provide trusted applications for the REE side.

[0081] The second TEE can be implemented based on a virtual machine (i.e., the EL2 layer virtual machine monitor in the ARM framework). As another trusted execution environment in the electronic device 100, the second TEE can provide trusted applications for the REE side. It should be noted that in the embodiments of this application, the second TEE and the first TEE are two mutually isolated trusted execution environments.

[0082] For ease of understanding, the following embodiments of this application will be described using the following methods: Figures 2-5 The electronic device with the structure shown in the figure, together with the accompanying drawings and application scenarios, will be used to specifically describe the security processing method provided in the embodiments of this application under a multi-trusted execution environment.

[0083] Figure 6 This is a flowchart of a security processing method in a multi-trusted execution environment provided in one embodiment of this application. This security processing method can be applied to electronic device 100. See also... Figure 5The electronic device 100 may include: a REE, a first TEE, a second TEE, and a secure element (eSE); wherein, the REE may include: a first CA; the first TEE may include: a first TA for key management; and the second TEE may include: a third TA for proxy services. Additionally, the secure element includes a second TA for key management. It should be noted that the secure element (eSE) in... Figure 5 Not shown in the image.

[0084] like Figure 6 As shown, the security processing methods in the above-mentioned multi-trusted execution environment may include:

[0085] Step 601: Electronic device 100 obtains the first request of the first CA.

[0086] Step 602: The electronic device 100 sends the first request to the first TA according to the first security level required by the first request, and the first TA performs security processing on the first request.

[0087] Step 603: Electronic device 100 obtains the second request of the first CA.

[0088] In step 604, the electronic device 100 sends the second request to the second TA via the second TEE according to the second security level required by the second request, and the second TA performs security processing on the second request. The second security level is higher than the first security level.

[0089] Steps 601-602 and 603-604 can be executed sequentially or in parallel. This embodiment does not limit the execution order of steps 601-602 and 603-604, but... Figure 6 The example shown is that steps 601 to 602 are executed before steps 603 to 604.

[0090] It should be noted that the first security level and the second security level in this embodiment do not mean that the request in the electronic device 100 can only have two security levels. The first security level can represent a type of security level, and the second security level can also represent a type of security level. However, the security level represented by the first security level is lower than the security level represented by the second security level.

[0091] In the aforementioned security processing method under a multi-trusted execution environment, after the electronic device 100 obtains a first request from the first CA, it sends the first request to the first TA according to the first security level required by the first request, and the first TA performs security processing on the first request. After the electronic device 100 obtains a second request from the first CA, it can send the second request to the second TA through the second TEE according to the second security level required by the second request, and the second TA performs security processing on the second request. The second security level is higher than the first security level. Since the first TA runs in the first TEE, and the first TEE and the second TEE are two isolated TEEs, different security applications used for key management in the electronic device 100 can be run in isolated TEEs, reducing the coupling phenomenon that occurs when different TAs used for key management run in the same TEE, and improving the security of the electronic device 100.

[0092] Figure 7 This is a schematic diagram illustrating the implementation of a security processing method in a multi-trusted execution environment according to an embodiment of this application, as shown below. Figure 7 As shown, the REE may also include: a second CA for key management, a third CA for key services, and a fourth CA for key services.

[0093] In some examples, the first request mentioned above can be a first key generation request. In this case, step 601 can be: the second CA obtains the first key generation request from the first CA; step 602 can be: the second CA sends the first key generation request to the third CA according to the first security level required by the first key generation request; the third CA sends the first key generation request to the first TA; the first TA generates the first key according to the first key generation request and sends the first key to the third CA. Specifically, when generating the first key generation request, the first CA determines that the first TA should process the first key generation request based on the first security level required by the first key generation request. Therefore, the first CA can include an identifier indicating that the first TA will process the first key generation request in the first key generation request. After obtaining the first key generation request, the second CA can determine that the first TA will process the first key generation request based on the identifier carried in the first key generation request. Therefore, the second CA sends the first key generation request to the third CA, which then sends the first key generation request to the first TA.

[0094] Furthermore, after the first TA generates the first key according to the first key generation request and sends the first key to the third CA, the third CA sends the first key to the second CA, the second CA saves the first key and sends the identifier of the first key to the first CA.

[0095] Furthermore, after the second CA stores the first key and sends the identifier of the first key to the first CA, the second CA can also obtain the first data encryption request from the first CA; wherein the first data encryption request carries the first data to be encrypted and the identifier of the first key; then, the second CA obtains the first key based on the identifier of the first key, and according to the first security level required by the first data encryption request, sends the first key and the first data to the third CA; the third CA sends the first key and the first data to the first TA; the first TA uses the first key to encrypt the first data and sends the encrypted first data to the third CA; the third CA sends the encrypted first data to the second CA; the second CA sends the encrypted first data to the first CA.

[0096] For example, in the above embodiment, the first CA can be a wallet application. When a user uses the "open" function in the wallet application for the first time, the wallet application needs to generate a key. When generating the first key generation request, the wallet application determines that the security level required for the "open" function is low. Therefore, based on the first security level required for the "open" function, the wallet application determines that the first TA should handle the first key generation request, and thus the wallet application can include an identifier indicating that the first TA is handling the request in the first key generation request. After obtaining the first key generation request, the second CA can determine that the first TA should handle the first key generation request based on the identifier carried in the first key generation request. Therefore, the second CA sends the first key generation request to the third CA, which then sends the first key generation request to the first TA. The first TA generates a first key for the "open" function based on the first key generation request and sends the first key to the third CA. The third CA sends the first key to the second CA, and the second CA saves the first key and sends the identifier of the first key to the first CA.

[0097] When a user uses the "Open Door" function in the wallet application, the wallet application needs to encrypt the first data to be sent. Similarly, when generating the first data encryption request, the wallet application determines that the security level required for the "Open Door" function is low. Therefore, based on the first security level required for the "Open Door" function, the wallet application determines that the first data encryption request will be processed by the first TA. Thus, the wallet application can carry the identifier of being processed by the first TA in the first data encryption request.

[0098] After the second CA receives the first data encryption request from the wallet application, it can determine that the first TA will handle the first key generation request based on the identifier carried in the first data encryption request. The second CA obtains the first key based on the identifier of the first key and then sends the first key and the first data to the third CA. The third CA sends the first key and the first data to the first TA. The first TA uses the first key to encrypt the first data and sends the encrypted first data to the third CA. The third CA sends the encrypted first data to the second CA. The second CA sends the encrypted first data to the wallet application.

[0099] In some examples, the second request mentioned above can be a second key generation request; thus, step 603 can be: the second CA obtains the second key generation request from the first CA; step 604 can be: the second CA sends the second key generation request to the fourth CA according to the second security level required by the second key generation request, the fourth CA sends the second key generation request to the second TA through the third TA, the second TA generates the second key according to the second key generation request, and sends the second key to the fourth CA through the third TA. Specifically, when the first CA generates the second key generation request, it determines whether to use the second TA to process the second key generation request based on the second security level required by the second key generation request, so the first CA can carry an identifier indicating that the second TA will process the second key generation request in the second key generation request. After obtaining the second key generation request, the second CA can determine whether the second TA will process the second key generation request based on the identifier carried in the second key generation request. Therefore, the second CA sends the second key generation request to the fourth CA, and the fourth CA sends the second key generation request to the second TA through the third TA.

[0100] Furthermore, after the second TA generates the second key according to the second key generation request and sends the second key to the fourth CA through the third TA, the fourth CA can also send the second key to the second CA. The second CA saves the second key and sends the identifier of the second key to the first CA.

[0101] Furthermore, after the second CA stores the second key and sends the identifier of the second key to the first CA, the second CA can also obtain the second data encryption request from the first CA. The second data encryption request carries the second data to be encrypted and the identifier of the second key. Then, the second CA obtains the second key based on the identifier of the second key, and according to the second security level required by the second data encryption request, sends the second key and the second data to the fourth CA. The fourth CA sends the second key and the second data to the second TA via the third TA. The second TA uses the second key to encrypt the second data and sends the encrypted second data to the fourth CA via the third TA. The fourth CA sends the encrypted second data to the second CA, and the second CA sends the encrypted second data to the first CA.

[0102] Additionally, it should be noted that in the above example, the third TA implements a proxy service, which can establish a secure connection with the second TA through the security application driver in the second TEE, thereby enabling interaction between the fourth CA and the second TA.

[0103] Taking the first CA as an example of a wallet application, when a user uses the "Payment" function in the wallet application for the first time, the wallet application needs to generate a key. When generating the second key generation request, the wallet application determines that the security level required for the "Payment" function is high. Therefore, based on the second security level required for the "Payment" function, the wallet application determines that the second TA should handle the second key generation request. Thus, the wallet application can include an identifier indicating that the second TA will handle the second key generation request in the second key generation request. After obtaining the second key generation request, the second CA can determine that the second TA should handle the second key generation request based on the identifier carried in the second key generation request. Therefore, the second CA sends the second key generation request to the fourth CA, which then sends the second key generation request to the second TA through the third TA. The second TA generates a second key for the "Payment" function based on the second key generation request and sends the second key to the fourth CA through the third TA. The fourth CA sends the second key to the second CA, the second CA saves the second key, and sends the identifier of the second key to the first CA.

[0104] When a user uses the "Payment" function in the wallet application, the wallet application needs to encrypt the second data to be sent. Similarly, when generating the second data encryption request, the wallet application determines that the security level required for the "Payment" function is high. Therefore, based on the second security level required for the "Payment" function, the wallet application determines that the second data encryption request will be processed by the second TA. Thus, the wallet application can carry the identifier of being processed by the second TA in the second data encryption request.

[0105] After the second CA receives the second data encryption request from the wallet application, it can determine that the second TA will handle the second data encryption request based on the identifier carried in the second data encryption request. The second CA obtains the second key based on the identifier of the second key and then sends the second key and the second data to the fourth CA. The fourth CA sends the second key and the second data to the second TA through the third TA. The second TA uses the second key to encrypt the second data and sends the encrypted second data to the fourth CA through the third TA. The fourth CA sends the encrypted second data to the second CA. The second CA sends the encrypted second data to the wallet application.

[0106] In this embodiment, the first TA runs in the first TEE, and the third TA and the security application driver run in the second TEE. The first TEE and the second TEE are two TEEs that are isolated from each other, so that different security applications used for key management in the electronic device 100 can run in isolated TEEs, reducing the coupling phenomenon that occurs when different TAs used for key management run in the same TEE, and improving the security of the electronic device 100.

[0107] Figure 8 A schematic diagram of an ARM architecture provided in another embodiment of this application, and Figure 5 Compared to the ARM architecture shown, the difference is that the second TEE does not include the third TA, but only the security application driver, while the first TEE includes the first TA for key management and the fourth TA for trusted communication.

[0108] The following is about Figure 8 The security handling methods under the ARM architecture shown are introduced below. See [link / reference]. Figure 9 , Figure 9 This is a schematic diagram illustrating the implementation of a security processing method in a multi-trusted execution environment according to another embodiment of this application. Figure 9 In addition, the REE also includes: a second CA for key management, a third CA for key services, and a fourth CA for key services;

[0109] Figure 9 The processing of the first request in the illustrated embodiment and Figure 7 The processing of the first request is the same in the illustrated embodiment, and will not be repeated here.

[0110] In some examples, the second request can be a second key generation request; thus, step 603 can be: the second CA obtains the second key generation request from the first CA; step 604 can be: the second CA sends the second key generation request to the fourth CA according to the second security level required by the second key generation request; the fourth CA sends the second key generation request to the fourth TA, the fourth TA establishes a trusted connection with the second TEE, and sends the second key generation request to the second TA through the trusted connection; the second TA generates a second key according to the second key generation request, and sends the second key to the fourth TA through the trusted connection.

[0111] Furthermore, the second TA generates a second key according to the second key generation request, sends the second key to the fourth TA through the aforementioned trusted connection, the fourth TA sends the second key to the fourth CA, the fourth CA sends the second key to the second CA; the second CA stores the second key and sends the identifier of the second key to the first CA.

[0112] Furthermore, the second CA stores the second key. After sending the identifier of the second key to the first CA, the second CA can also obtain the second data encryption request from the first CA. The second data encryption request carries the second data to be encrypted and the identifier of the second key. The second CA obtains the second key based on the identifier of the second key, and according to the second security level required by the second data encryption request, sends the second key and the second data to the fourth CA. The fourth CA sends the second key and the second data to the fourth TA. The fourth TA sends the second key and the second data to the second TA through a trusted connection with the second TEE. The second TA uses the second key to encrypt the second data and sends the encrypted second data to the fourth TA through the trusted connection. The fourth TA sends the encrypted second data to the fourth CA. The fourth CA sends the encrypted second data to the second CA. The second CA sends the encrypted second data to the first CA.

[0113] Additionally, it should be noted that in the above example, the establishment of a trusted connection between the fourth TA and the second TEE can be achieved by the security application driver in the fourth TA and the second TEE shaking hands to establish a trusted connection between the fourth TA and the second TEE.

[0114] Taking the first CA as an example of a wallet application, when a user uses the "Payment" function in the wallet application for the first time, the wallet application needs to generate a key. When generating the second key generation request, the wallet application determines that the security level required for the "Payment" function is high. Therefore, based on the second security level required for the "Payment" function, the wallet application determines that the second TA should handle the second key generation request. Thus, the wallet application can include an identifier indicating that the second TA will handle the second key generation request in the second key generation request. After obtaining the second key generation request, the second CA can determine that the second TA should handle the second key generation request based on the identifier carried in the second key generation request. Therefore, the second CA sends the second key generation request to the fourth CA, which in turn sends the second key generation request to the fourth TA. The fourth TA establishes a trusted connection with the second TEE and sends the second key generation request to the second TA through the trusted connection. The second TA generates a second key for the "Payment" function based on the second key generation request and sends the second key to the fourth TA through the trusted connection. The fourth TA sends the second key to the fourth CA, which in turn sends the second key to the second CA. The second CA saves the second key and sends the identifier of the second key to the first CA.

[0115] When a user uses the "Payment" function in the wallet application, the wallet application needs to encrypt the second data to be sent. Similarly, when generating the second data encryption request, the wallet application determines that the security level required for the "Payment" function is high. Therefore, based on the second security level required for the "Payment" function, the wallet application determines that the second data encryption request will be processed by the second TA. Thus, the wallet application can carry the identifier of being processed by the second TA in the second data encryption request.

[0116] After the second CA receives the second data encryption request from the wallet application, it can determine that the second TA will handle the second data encryption request based on the identifier carried in the second data encryption request. The second CA obtains the second key based on the identifier of the second key and sends the second key and the second data to the fourth CA. The fourth CA sends the second key and the second data to the fourth TA. The fourth TA sends the second key and the second data to the second TA through a trusted connection with the second TEE. The second TA uses the second key to encrypt the second data and sends the encrypted second data to the fourth TA through the trusted connection. The fourth TA sends the encrypted second data to the fourth CA. The fourth CA sends the encrypted second data to the second CA. The second CA sends the encrypted second data to the wallet application.

[0117] In this embodiment, the first TA and the fourth TA run in the first TEE. The fourth TA does not directly access the second TA, but first establishes a trusted connection with the second TEE and accesses the second TA through the trusted connection. Since the first TEE and the second TEE are two TEEs that are isolated from each other, the occurrence of coupling phenomenon can be reduced and the security of the electronic device 100 can be improved.

[0118] The above embodiments use key generation and data encryption as examples to illustrate the security processing method in a multi-trusted execution environment provided by the embodiments of this application. It is understood that the processing flow for security processing requests such as data decryption and / or signature verification is the same as the above flow, and will not be repeated here.

[0119] Additionally, it should be noted that in the above embodiments, the first request and the second request are requests from the same CA. In practical applications, the first request and the second request can also be requests from different CAs, without changing the processing flow.

[0120] It is understood that some or all of the steps or operations in the above embodiments are merely examples, and other operations or variations thereof can be performed in the embodiments of this application. Furthermore, the steps may be performed in different orders as presented in the above embodiments, and it is not necessary to perform all the operations in the above embodiments.

[0121] It is understood that, in order to achieve the above-mentioned functions, electronic devices include hardware and / or software modules that perform the respective functions. Based on the algorithm steps of the examples described in conjunction with the embodiments disclosed in this application, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in conjunction with the embodiments, but such implementation should not be considered beyond the scope of this application.

[0122] This embodiment can divide the electronic device into functional modules according to the above method embodiment. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one module. The integrated module can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0123] Figure 10 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. In the case where functional modules are divided according to their respective functions, Figure 10 A schematic diagram of a possible composition of the electronic device 1000 involved in the above embodiments is shown, such as... Figure 10 As shown, the electronic device 1000 may include: a receiving unit 1001, a processing unit 1002, and a transmitting unit 1003;

[0124] The processing unit 1002 can be used to support the electronic device 1000 in executing steps 601 to 604, and / or other processes used in the technical solutions described in the embodiments of this application.

[0125] It should be noted that all relevant content of each step involved in the method embodiments of this application can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0126] The electronic device 1000 provided in this embodiment is used to execute the security processing method in the above-described multi-trusted execution environment, and thus can achieve the same effect as the above-described method.

[0127] It should be understood that electronic device 1000 can correspond to Figure 2 The electronic device 100 shown. The functions of the receiving unit 1001 and the transmitting unit 1003 can be determined by… Figure 2 The processor 110, antenna 1, and mobile communication module 150 in the electronic device 100 shown are, and / or, implemented by the processor 110, antenna 2, and wireless communication module 160; the function of the processing unit 1002 can be achieved by... Figure 2 The processor 110 in the electronic device 100 shown is implemented.

[0128] When using integrated units, the electronic device 1000 may include a processing module, a storage module, and a communication module.

[0129] The processing module can be used to control and manage the actions of the electronic device 1000. For example, it can support the electronic device 1000 in executing the steps performed by the receiving unit 1001, processing unit 1002, and sending unit 1003. The storage module can support the electronic device 1000 in storing program code and data. The communication module can support communication between the electronic device 1000 and other devices.

[0130] The processing module can be a processor or controller, which can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination of functions that implement computing capabilities, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a device that interacts with other electronic devices, such as radio frequency circuitry, a Bluetooth chip, and / or a Wi-Fi chip.

[0131] In one embodiment, when the processing module is a processor and the storage module is a memory, the electronic device 1000 involved in this embodiment can be a device having... Figure 2 The device with the structure shown.

[0132] This application also provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to execute this application. Figures 6-9 The method provided in the illustrated embodiment.

[0133] This application also provides a computer program product, which includes a computer program that, when run on a computer, causes the computer to execute this application. Figures 6-9 The method provided in the illustrated embodiment.

[0134] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0135] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0136] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0137] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0138] The above description is merely a specific embodiment of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. The protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A security processing method in a multi-trusted execution environment, characterized in that, The method is applied to an electronic device, the electronic device comprising: a rich execution environment, a first trusted execution environment, a second trusted execution environment, and a secure element; the rich execution environment comprising: a first client application; the first trusted execution environment comprising: a first trusted application for key management; the secure element comprising: a second trusted application for key management; the method comprising: Obtain the first request from the first client application; Based on the first security level required by the first request, the first request is sent to the first trusted application, which then performs security processing on the first request. Obtain the second request from the first client application; Based on the second security level required by the second request, the second request is sent to the second trusted application through the second trusted execution environment, and the second trusted application performs secure processing on the second request; wherein, the second security level is higher than the first security level; The second request includes a second key generation request; the first trusted execution environment further includes a fourth trusted application for trusted communication; the rich execution environment further includes a second client application for key management, a third client application for key services, and a fourth client application for key services. The second request to obtain the first client application includes: The second client application obtains the second key generation request from the first client application; The step of sending the second request to the second trusted application through the second trusted execution environment, based on the second security level required by the second request, and having the second trusted application perform security processing on the second request, includes: The second client application sends the second key generation request to the fourth client application according to the second security level required by the second key generation request; The fourth client application sends the second key generation request to the fourth trusted application; The fourth trusted application establishes a trusted connection with the second trusted execution environment and sends the second key generation request to the second trusted application through the trusted connection. The second trusted application generates a second key based on the second key generation request, and sends the second key to the fourth trusted application through the trusted connection.

2. The method according to claim 1, characterized in that, The first request includes a first key generation request; The rich execution environment also includes: a second client application for key management, a third client application for key services, and a fourth client application for key services; The first request to obtain the first client application includes: The second client application obtains the first key generation request from the first client application; The step of sending the first request to the first trusted application according to the first security level required by the first request, and having the first trusted application perform security processing on the first request, includes: The second client application sends the first key generation request to the third client application according to the first security level required by the first key generation request; The third client application sends the first key generation request to the first trusted application; The first trusted application generates a first key based on the first key generation request and sends the first key to the third client application.

3. The method according to claim 2, characterized in that, After the first trusted application generates a first key based on the first key generation request and sends the first key to the third client application, the process further includes: The third client application sends the first key to the second client application; The second client application stores the first key and sends the identifier of the first key to the first client application.

4. The method according to claim 3, characterized in that, After the second client application stores the first key and sends the identifier of the first key to the first client application, it also includes: The second client application obtains the first data encryption request from the first client application; wherein the first data encryption request carries the first data to be encrypted and the identifier of the first key; The second client application obtains the first key based on the identifier of the first key, and sends the first key and the first data to the third client application according to the first security level required by the first data encryption request; The third client application sends the first key and the first data to the first trusted application; The first trusted application uses the first key to encrypt the first data and sends the encrypted first data to the third client application; The third client application sends the encrypted first data to the second client application; The second client application sends the encrypted first data to the first client application.

5. The method according to claim 1, characterized in that, After the second trusted application generates a second key according to the second key generation request and sends the second key to the fourth trusted application through the trusted connection, the process further includes: The fourth trusted application sends the second key to the fourth client application; The fourth client application sends the second key to the second client application; The second client application stores the second key and sends the identifier of the second key to the first client application.

6. The method according to claim 5, characterized in that, After the second client application stores the second key and sends the identifier of the second key to the first client application, it also includes: The second client application obtains the second data encryption request from the first client application; wherein the second data encryption request carries the second data to be encrypted and the identifier of the second key; The second client application obtains the second key based on the identifier of the second key, and sends the second key and the second data to the fourth client application according to the second security level required by the second data encryption request; The fourth client application sends the second key and the second data to the fourth trusted application; The fourth trusted application sends the second key and the second data to the second trusted application through a trusted connection with the second trusted execution environment; The second trusted application uses the second key to encrypt the second data, and sends the encrypted second data to the fourth trusted application through the trusted connection; The fourth trusted application sends the encrypted second data to the fourth client application; The fourth client application sends the encrypted second data to the second client application; The second client application sends the encrypted second data to the first client application.

7. The method according to any one of claims 1-6, characterized in that, The first trusted execution environment is implemented based on the processor of the electronic device, and the second trusted execution environment is implemented based on a virtual machine in the electronic device; the first trusted execution environment and the second trusted execution environment are two trusted execution environments that are isolated from each other.

8. An electronic device, characterized in that, include: One or more processors; Memory; Multiple applications; And one or more computer programs, wherein the one or more computer programs are stored in the memory, the one or more computer programs including instructions that, when executed by the electronic device, cause the electronic device to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when run on a computer, causes the computer to perform the method as described in any one of claims 1-7.

Images