Data transmission method and related apparatus

Abstract

Embodiments of the present application provide a data transmission method and related apparatus, and relate to the technical field of terminals. The method is applied to an electronic device, the electronic device comprising a first secure environment TEE, a smart sensor hub, a non-secure environment REE, a client application CA running in the non-secure environment REE, and a first trusted application TA running in the first secure environment TEE. The method comprises: the client application CA indicating first information to the first trusted application TA, the first information being used to indicate target data of the first trusted application TA; and the first trusted application TA transmitting the target data of the first trusted application TA to the smart sensor hub in response to the first information. In this way, the communication mode of the trusted application TA can be enriched.

Description

Technical Field

[0001] This application relates to the field of terminal technology, and in particular to a data transmission method and related apparatus. Background Technology

[0002] With the rapid development of terminal technology, improving terminal security has become increasingly important. Currently, to enhance data security in electronic devices, secure environments, such as Trusted Execution Environments (TEEs), are employed. Within a TEE, trusted applications (TAs) run. A TA is an application within the TEE that performs a specific function. Because computations are performed within the TEE, it offers high security. Each TA has one or more corresponding client applications (CAs) within a Rich Execution Environment (REE). In the REE environment, information can be transmitted to the TA in the TEE environment by calling the CA's interface, enabling the corresponding function to be completed and the computation result returned.

[0003] However, the communication methods for Trusted Applications (TAs) are currently not rich enough. Summary of the Invention

[0004] This application provides a data transmission method and related apparatus, applicable to the field of terminal technology. By transmitting target data of a first trusted application (TA) to a smart sensor hub, the communication methods of the trusted application (TA) can be enriched.

[0005] In a first aspect, embodiments of this application propose a data transmission method applied to an electronic device, the electronic device including a first secure environment TEE, a smart sensor hub, a non-secure environment REE, a client application CA running in the non-secure environment REE, and a first trusted application TA running in the first secure environment TEE, the method including:

[0006] The client application CA indicates first information to the first trusted application TA, which is used to indicate the target data to be transmitted to the first trusted application TA; the first trusted application TA can respond to the first information and transmit the target data of the first trusted application TA to the smart sensor hub.

[0007] The electronic device can be deployed with an operating system (OS) or a real-time operating system (RTOS). The security of a Rich Execution Environment (REE) is lower than that of a Trusted Execution Environment (TEE). Therefore, compared to a TEE, a REE is considered a less secure environment, while a TEE is considered a secure environment. The first information may include data transmission commands. Optionally, the target data stored in the smart sensor hub can be used for data comparison or verification.

[0008] The first information is used to indicate the target data for transmission of the first trusted application (TA). Optionally, the first information may include a data transmission command. The first trusted application (TA) may be a business-related TA, therefore, the trusted application (TA) may also be called a business TA. Optionally, the business TA may be a business TA with certain security requirements for the data, such as a face recognition TA. The client CA may be a CA associated with the first trusted application (TA). For example, if the first trusted application (TA) is a face recognition TA, then the client CA may be a face recognition CA.

[0009] In this embodiment, the application may be at the application layer. When it detects that a function related to the target data has been triggered, it calls the client application CA to indicate the first information to the first trusted application TA. For example, it may call the client CA to indicate the first information when it detects that the screen unlocking function or the smart notification function has been triggered.

[0010] The target data can be data with certain security and confidentiality requirements, such as at least one of facial data, fingerprint data, voiceprint data, and iris data. The target data of the first trusted application (TA) can be stored in the first secure environment (TEE) where the first trusted application (TA) resides.

[0011] In this embodiment of the application, the client application CA indicates first information to the first trusted application TA, and then the first trusted application TA can transmit target data to the smart sensor hub based on the first information, thus realizing communication between the trusted application TA and the smart sensor hub, thereby enriching the communication methods of the trusted application TA.

[0012] In conjunction with the first aspect, in one possible implementation, the electronic device further includes a second secure environment (TEE) and a second trusted application (TA) running on the second secure environment (TEE). The first trusted application (TA), in response to the first information, transmits target data to the smart sensor hub, which may include:

[0013] In response to the first information, the first trusted application TA transmits the target data of the first trusted application TA to the second trusted application TA; the second trusted application TA transmits the target data of the first trusted application TA to the smart sensor hub through the first interface.

[0014] The second trusted application (TA) is configured with a first interface for connection to the smart sensor hub. The second security environment (TEE) and the first security environment (TEE) can be different security environment modules.

[0015] In this embodiment, the first trusted application (TA) responds to the first information and transmits the target data of the first trusted application (TA) to the second trusted application (TA). Then, the second trusted application (TA) transmits the target data of the first trusted application (TA) to the smart sensor hub through the first interface. That is, a trusted application (TA) in one secure environment TEE can transmit data between the trusted application (TA) in another secure environment TEE and the smart sensor hub. Since the data transmission is carried out through the secure environment TEE as much as possible, the data transmission security between the trusted application (TA) and the smart sensor hub can be improved.

[0016] In conjunction with the first aspect, in one possible implementation, the electronic device further includes a first trusted application TA running in a first secure environment TEE and a second trusted application TA running in a second secure environment TEE. The transmission of target data from the first trusted application TA to the second trusted application TA may include:

[0017] The first trusted application (TA) transmits the target data of the first trusted application (TA) to the first agent application (TA); the first agent application (TA) transmits the target data to the second agent application (TA); the second agent application (TA) transmits the target data to the second trusted application (TA).

[0018] In this embodiment, a first trusted application (TA) transmits its target data to a first proxy application (TA). Then, the first proxy application (TA) transmits the target data to a second proxy application (TA), and then the second proxy application (TA) transmits the target data to a second trusted application (TA). In other words, in this embodiment, different trusted applications (TAs) can communicate through their respective corresponding proxy applications (TAs). The proxy applications (TAs) can control access to trusted applications (TAs) and perform network address translation (NAT), thus improving the security of mutual access between trusted applications (TAs).

[0019] In conjunction with the first aspect, in one possible implementation, before the second agent application TA transmits the target data to the second trusted application TA, the following is also included:

[0020] The second agent application (TA) verifies the calling permissions of the first agent application (TA) so that, if the calling permissions of the first agent application (TA) are verified, the target data can be transmitted to the second trusted application (TA).

[0021] In this embodiment, before the second proxy application TA transmits the target data to the second trusted application TA, the second proxy application TA verifies the calling permissions of the first proxy application TA. Only if the calling permissions of the first proxy application TA are verified can the target data be transmitted to the second trusted application TA. In other words, the second proxy application TA only transmits the target data to the smart sensor hub through the second trusted application TA if the first proxy application has the access permissions of the second trusted application TA. In this way, the second proxy application TA can selectively open the transmission channel between the smart sensor hub to some or all trusted applications TA, which can improve the flexibility and security of communication between the trusted application TA and the smart sensor hub.

[0022] In conjunction with the first aspect, in one possible implementation, the second proxy application TA filters the target data if the calling permissions of the first proxy application TA fail to pass verification.

[0023] In this embodiment of the application, if the second proxy application TA fails to verify the calling permission of the first proxy application TA, the second proxy application TA filters the target data. This can improve the data transmission security between trusted applications TA and reduce the waste of network resources between the proxy application TA and the trusted application TA.

[0024] In conjunction with the first aspect, in one possible implementation, the first trusted application (TA) responds to the first information by transmitting target data of the first trusted application (TA) to the smart sensor hub, including:

[0025] The first trusted application (TA) responds to the first information and transmits the target data of the first trusted application (TA) to the client application (CA); the client application (CA) transmits the target data of the first trusted application (TA) to the smart sensor hub.

[0026] In this embodiment, the first trusted application (TA) can transmit target data to the smart sensor hub through the client application (CA). Generally, a trusted application (TA) has one or more corresponding client application (CA). In other words, this embodiment can forward the target data through the existing client application (CA), which can improve the convenience of transmitting data between the trusted application (TA) and the smart sensor hub.

[0027] In conjunction with the first aspect, in one possible implementation, the insecure environment REE includes a hardware abstraction layer (HAL) service for the smart sensor hub. The smart sensor hub HAL is configured with a second interface for communicating with the smart sensor hub. Then, the client application CA transmits the target data of the first trusted application TA to the smart sensor hub HAL. Subsequently, the smart sensor hub HAL transmits the target data of the first trusted application TA to the smart sensor hub through the second interface.

[0028] In conjunction with the first aspect, in one possible implementation, before the first trusted application (TA) transmits the target data of the first trusted application (TA) to the client application (CA), the following steps are also included:

[0029] The first trusted application (TA) encrypts the target data of the first trusted application (TA) to obtain the encrypted target data.

[0030] In this embodiment of the application, the first trusted application (TA) can encrypt the target data, thereby improving the security of the target data when it is transmitted to the smart sensor hub.

[0031] In conjunction with the first aspect, in one possible implementation, the client application CA transmits target data of the first trusted application TA to the smart sensor hub, including:

[0032] The client application CA calls the intelligent sensor hub HAL to decrypt the encrypted target data, obtains the decrypted target data, and transmits the decrypted target data to the intelligent sensor hub through the intelligent sensor hub HAL.

[0033] In this embodiment, before transmitting target data to the smart sensor hub, the smart sensor hub decrypts the target data. The smart sensor hub then receives the decrypted target data, allowing the target data in the smart sensor hub to be used directly, thus improving the efficiency of the smart sensor hub in using the target data.

[0034] In conjunction with the first aspect, in one possible implementation, the data transmission method further includes:

[0035] The intelligent sensor hub (HAL) generates a key and transmits the key to the client application (CA); the client application (CA) then transmits the key to the first trusted application (TA).

[0036] Accordingly, the first trusted application (TA) encrypts the target data of the first trusted application (TA), including:

[0037] The First Trusted Application (TA) encrypts the target data of the First Trusted Application (TA) based on the key.

[0038] Correspondingly, the intelligent sensor hub HAL decrypts the encrypted target data, including:

[0039] The HAL intelligent sensor hub decrypts encrypted target data based on a key.

[0040] In this embodiment, encryption and decryption are performed using a key generated by the intelligent sensor hub HAL. The key then flows between the insecure environment REE and the secure environment TEE, which improves the security of key transmission and, consequently, the security of encryption and decryption of the target data.

[0041] In conjunction with the first aspect, in one possible implementation, the target data includes target biometric data, the electronic device also includes a settings application running in a non-secure environment (REE), and the method further includes:

[0042] In response to a biometric data entry operation, the application collects first biometric data via an electronic device. In an insecure environment (REE), if the first biometric data meets data quality requirements, the REE instructs the client application (CA) to provide second information, which instructs the storage of the first biometric data. In response to the second information, the client application (CA) instructs the first trusted application (TA) to provide third information and the first biometric data, with the third information instructing the storage of the first biometric data. In response to the third information, the first trusted application (TA) stores the first biometric data as the target biometric data.

[0043] In this embodiment of the application, by determining that the first biometric data meets the data quality requirements before allowing the first trusted application (TA) to store the first biometric data, the effectiveness of the biometric data stored by the first trusted application (TA) can be improved.

[0044] In conjunction with the first aspect, in one possible implementation, the insecure environment REE includes a smart sensor hub HAL, and the method further includes:

[0045] The HAL (Hybrid Analog and Sensor Hub) determines whether the first biometric data meets the data quality requirements.

[0046] In conjunction with the first aspect, in one possible implementation, the data transmission method also includes:

[0047] In an insecure environment, if the first biometric data does not meet the data quality requirements, the REE extracts and stores the first biometric value based on the first biometric data. The client application CA receives the second biometric data collected by the electronic device. The REE extracts the second biometric value based on the second biometric data and matches the second biometric value with the first biometric value. If the second biometric value matches the first biometric value successfully and the second biometric data meets the data quality requirements, the REE in the insecure environment instructs the client application CA to provide fourth information, which instructs the storage of the second biometric data. In response to the fourth information, the client application CA instructs the first trusted application TA to provide fifth information and the second biometric data, which instructs the storage of the second biometric data. In response to the fifth information, the first trusted application TA stores the second biometric data as the target biometric data.

[0048] In this embodiment, the intelligent sensor hub (HAL) extracts and stores a first biometric value based on the first biometric data. This allows for data comparison to be performed even without storing the first biometric data, thereby improving the flexibility of data comparison. For example, if the biometric data is facial data, the biometric value is the facial feature value; similarly, if the biometric data is fingerprint data, the biometric value is the fingerprint feature value.

[0049] In conjunction with the first aspect, in one possible implementation, the non-secure environment REE includes a smart sensor hub HAL, and the secure environment REE extracts a second biometric value based on the second biometric data and matches the second biometric value with the first biometric value, including:

[0050] The intelligent sensor hub (HAL) extracts a second biometric value based on the second biometric data and matches the second biometric value with the first biometric value. Furthermore, the non-secure environment REE pre-integrates feature comparison algorithms, etc., allowing feature comparison and data quality requirement judgment through the REE. This eliminates the need to configure algorithms in the TEE, thus reducing the system resources required to create the TEE.

[0051] Among them, the intelligent sensor hub (HAL) can be configured with algorithms for determining whether data quality requirements are met, algorithms for extracting biometric values, and algorithms for comparing biometric values.

[0052] In conjunction with the first aspect, in one possible implementation, the target data includes target biometric data, and the electronic device further includes a notification application running in an insecure environment REE, the notification application being configured to enable a smart display function, and after the first trusted application TA transmits the target data of the first trusted application TA to the smart sensor hub in response to the first information, it further includes:

[0053] When an electronic device receives a message, the smart sensor hub compares the biometric data to be compared collected by the electronic device with the target biometric data. If the comparison between the biometric data to be compared and the target biometric data is successful, the smart sensor hub indicates a sixth message to the notification application; if the comparison between the biometric data to be compared and the target biometric data fails, the smart sensor hub indicates a seventh message to the notification application. The sixth message is used to indicate a display message, and the seventh message is used to indicate a hidden message. The notification application displays the message based on the received sixth message, or hides the message based on the received seventh message.

[0054] In this embodiment, when the electronic device receives a message, the smart sensor hub compares the biometric data to be compared collected by the electronic device with the target biometric data. The message is only displayed if the comparison is successful. That is, the electronic device only displays the message when the user facing the screen of the electronic device is the target user who entered the biometric data, thereby improving the privacy of message notifications. Simultaneously, since the smart sensor hub stores the target biometric data, it directly compares the biometric data to be compared with the target biometric data, eliminating the need to retrieve the target biometric data from the TEE. This improves the efficiency of data comparison and, consequently, the efficiency of determining whether to display a message.

[0055] Secondly, embodiments of this application provide a data transmission device, which can be an electronic device, or a chip or chip system within an electronic device. The data transmission device may include a display unit and a processing unit. When the data transmission device is an electronic device, the display unit may be a display screen. The display unit is used to perform display steps to enable the electronic device to implement a data transmission method described in the first aspect or any possible implementation of the first aspect. When the data transmission device is an electronic device, the processing unit may be a processor. The data transmission device may further include a storage unit, which may be a memory. The storage unit is used to store instructions, and the processing unit executes the instructions stored in the storage unit to enable the electronic device to implement a data transmission method described in the first aspect or any possible implementation of the first aspect. When the data transmission device is a chip or chip system within an electronic device, the processing unit may be a processor. The processing unit executes the instructions stored in the storage unit to enable the electronic device to implement a data transmission method described in the first aspect or any possible implementation of the first aspect. The storage unit may be a storage unit within the chip (e.g., a register, cache, etc.), or a storage unit located outside the chip within the electronic device (e.g., a read-only memory, random access memory, etc.).

[0056] Thirdly, embodiments of this application provide an electronic device including a processor and a memory, the memory for storing code instructions, and the processor for running the code instructions to perform the methods described in the first aspect or any possible implementation of the first aspect.

[0057] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program or instructions that, when executed on a computer, cause the computer to perform the methods described in the first aspect or any possible implementation thereof.

[0058] Fifthly, embodiments of this application provide a computer program product including a computer program, which, when run on a computer, causes the computer to perform the methods described in the first aspect or any possible implementation thereof.

[0059] Sixthly, this application provides a chip or chip system including at least one processor and a communication interface. The communication interface and the at least one processor are interconnected via a circuit. The at least one processor is used to run computer programs or instructions to perform the methods described in the first aspect or any possible implementation of the first aspect. The communication interface in the chip can be an input / output interface, pins, or circuits, etc.

[0060] In one possible implementation, the chip or chip system described above in this application further includes at least one memory storing instructions. The memory can be an internal storage unit of the chip, such as a register or cache, or it can be a storage unit of the chip itself (e.g., read-only memory, random access memory, etc.).

[0061] It should be understood that the second to sixth aspects of this application correspond to the technical solutions of the first aspect of this application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation are similar, and will not be repeated here. Attached Figure Description

[0062] Figure 1 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application;

[0063] Figure 2 A schematic diagram of the software structure of an electronic device provided in an embodiment of this application;

[0064] Figure 3A This is a schematic diagram illustrating a trusted application (TA) transmitting face data to a sensor hub, as provided in an embodiment of this application.

[0065] Figure 3B This is a schematic diagram illustrating another trusted application TA transmitting face data to a sensor hub, as provided in an embodiment of this application.

[0066] Figure 4 A flowchart illustrating a data transmission method provided in an embodiment of this application;

[0067] Figure 5 A flowchart illustrating another data transmission method provided in an embodiment of this application;

[0068] Figure 6 A flowchart illustrating another data transmission method provided in an embodiment of this application;

[0069] Figure 7 This is a schematic diagram illustrating a scenario where an electronic device displays messages, as provided in an embodiment of this application.

[0070] Figure 8 A schematic diagram illustrating a scenario where an electronic device hides messages, provided as an embodiment of this application.

[0071] Figure 9 This is a schematic diagram of the structure of a chip provided in an embodiment of this application. Detailed Implementation

[0072] To facilitate a clear description of the technical solutions in the embodiments of this application, some terms and technologies involved in the embodiments of this application will be briefly introduced below:

[0073] 1. REE can be called a general execution environment. The rich execution environment operating system (REE OS) on a general-purpose processor and the client application CA can run in REE.

[0074] 2. A TEE can be called a secure execution environment, which can run a trusted execution environment operating system (TEE OS). The TEE can also provide trusted security services to CAs (such as fingerprint verification, password verification, facial recognition, and secure payment services). These security services can run in the TEE OS as trusted applications (TAs). In some embodiments, the TEE can be an execution region built using the secure area of ​​the processor in the terminal device. The trusted execution environment can provide a secure operating environment for services.

[0075] 3. The main functions of a sensor hub include: real-time control of sensors to reduce power consumption; connecting and processing data from various sensors; and fusing data from different types of sensors to achieve functions that require combining data from multiple sensors. It should be noted that a sensor hub is a low-power processor, which can also be understood as a small core. The services processed by a sensor hub can be understood as low-power services. For example, processing facial recognition data on a sensor hub can be understood as low-power facial recognition data processing.

[0076] 4. Other terms

[0077] In the embodiments of this application, terms such as "first" and "second" are used to distinguish identical or similar items with substantially the same function and purpose. For example, "first chip" and "second chip" are used only to distinguish different chips and do not limit their order of execution. Those skilled in the art will understand that terms such as "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply that they are different.

[0078] It should be noted that, in the embodiments of this application, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0079] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, a--c, bc, or abc, where a, b, and c can be single or multiple.

[0080] 5. Electronic equipment

[0081] The electronic devices in this application embodiment may include handheld devices, vehicle-mounted devices, etc., that have data acquisition functions (such as acquiring face data, fingerprint data, voiceprint data, and iris data). For example, some electronic devices include: mobile phones, tablets, PDAs, laptops, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in 5G networks, or future evolution of public land mobile communication networks. Terminal devices in a network (PLMN), etc., are not limited to this in the embodiments of this application.

[0082] By way of example and not limitation, in this embodiment, the electronic device can also be a wearable device. Wearable devices, also known as wearable smart devices, are a general term for devices that utilize wearable technology to intelligently design and develop everyday wearables, such as glasses, gloves, watches, clothing, and shoes. Wearable devices are portable devices that are worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not merely hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include those that are feature-rich, large in size, and can achieve complete or partial functions without relying on a smartphone, such as smartwatches or smart glasses, as well as those that focus on a specific type of application function and require the use of other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.

[0083] Furthermore, in this embodiment of the application, the electronic device can also be a terminal device in the Internet of Things (IoT) system. IoT is an important part of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network of human-machine interconnection and object-to-object interconnection.

[0084] The electronic devices in the embodiments of this application may also be referred to as: terminal equipment, user equipment (UE), mobile station (MS), mobile terminal (MT), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent, or user device, etc.

[0085] In this embodiment, the electronic device or various network devices include a hardware layer, an operating system layer running on top of the hardware layer, and an application layer running on top of the operating system layer. The hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also called main memory). The operating system can be any one or more computer operating systems that implement business processing through processes, such as Linux, Unix, Android, iOS, or Windows. The application layer includes applications such as browsers, address books, word processing software, and instant messaging software.

[0086] The following examples illustrate the scenarios for this solution.

[0087] In some example scenarios, electronic devices collect and store the target user's facial data. When the electronic device needs to unlock, it collects the user's facial data facing the device's display screen and compares the target facial data with the facial data to be verified. If the facial data match, the electronic device unlocks; if the facial data match fails, the electronic device is refused to unlock.

[0088] In other example scenarios, when an electronic device needs to intelligently display pop-up notification messages, it compares the face data to be verified with the target face data. If the face data match successfully, the pop-up notification message is displayed; if the face data match fails, the pop-up notification message is hidden.

[0089] In other scenarios, when an electronic device needs to make a payment, the facial data to be verified is compared with the target facial data. If the facial data matches successfully, the payment is made; if the facial data matches unsuccessfully, the payment is rejected.

[0090] It is understood that the solution in this embodiment is not limited to the above scenarios, and the solution in this application embodiment can be used in scenarios that require data comparison or data verification. In addition, the data to be compared is not limited to facial data, but can also be biometric data such as fingerprint data, voiceprint data, and iris data, which are not limited here.

[0091] To improve the security of target facial data, electronic devices store this data in a TEE (Transparent Environment Execution Unit). When data comparison is needed, the application processor retrieves the target data from the TEE for comparison. However, retrieving target data from the TEE is slow, resulting in slow data comparison efficiency. To ensure the security of the target data while improving comparison efficiency, the target data can be stored in a sensor hub, allowing the sensor hub to directly compare the stored target data with the data to be verified.

[0092] However, the current communication methods of TA are not rich enough, and there is no communication method between TA and sensorhub. Therefore, there is an urgent need for a way for TA and sensorhub to communicate, so as to transmit target data from TA to sensorhub.

[0093] In view of this, embodiments of this application provide a data transmission method and related apparatus, which can transmit target data of a first trusted application (TA) to a smart sensor hub, thereby enriching the communication methods of the trusted application (TA).

[0094] To better understand the embodiments of this application, the structure of the electronic device of this application is described below:

[0095] Figure 1 A schematic diagram of the hardware structure of the electronic device 100 is shown.

[0096] Electronic device 100 may include processor 110, external memory interface 120, internal memory 121, universal serial bus (USB) interface 130, charging management module 140, power management module 141, battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, subscriber identification module (SIM) card interface 195, and smart sensor hub 196, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0097] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0098] Processor 110 may include one or more processing units, such as application processors (APs), modem processors, graphics processing units (GPUs), image signal processors (ISPs), controllers, video codecs, digital signal processors (DSPs), baseband processors, and / or neural network processing units (NPUs). These different processing units may be independent devices or integrated into one or more processors.

[0099] The controller can generate operation control signals based on the instruction opcode and timing signals to complete the control of instruction fetching and execution.

[0100] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system. The application processor may be deployed with an REE and TEEs that are independent of the REE. Optionally, the application processor may include one or more TEEs. When more than two TEEs are included, they may be a first TEE (TEE1), a second TEE (TEE2), etc., but are not limited to two TEEs.

[0101] In this embodiment, the display screen 194 can be used to display facial data, display messages, or collect fingerprint data via a fingerprint acquisition module disposed on the display screen 194. The camera 193 can be used to collect at least one of facial data and iris data. The microphone 170C can be used to collect voiceprint data.

[0102] The following examples, using the scenario of collecting facial data, illustrate the workflow of electronic device hardware.

[0103] The facial and iris data collected by camera 193, the voiceprint data collected by microphone 170C, and the fingerprint data collected by display screen 194, etc., can be saved as target data to TA in TEE environment. Then, the target data is transmitted from TA in TEE environment to smart sensor hub 196 and stored in smart sensor hub 196. Then, smart sensor hub 196 can verify the data to be verified based on the target data stored in it.

[0104] Figure 2 A schematic diagram of the software structure of the electronic device 100 is shown.

[0105] The software system of electronic device 100 can adopt a layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture. This embodiment of the invention uses the layered architecture Android system as an example to exemplify the software structure of electronic device 100.

[0106] Figure 2This is a software structure block diagram of the electronic device 100 according to an embodiment of the present invention. The layered architecture in this embodiment can be deployed in an REE. The electronic device may also include multiple TEEs. Each TEE may run a trusted application TA (also known as a service TA). Optionally, at least one trusted application TA is configured with a proxy application TA (also known as a proxy TA), so that trusted applications TAs can communicate with each other through the proxy application TA. For example, a first trusted application TA is configured with a first proxy application TA, and a second trusted application TA is configured with a second proxy application TA. Optionally, trusted applications TAs and proxy applications can share data through shared memory.

[0107] A layered architecture divides software into several layers, each with a clear role and function. Layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into multiple layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system libraries, the hardware abstraction layer, and the kernel layer.

[0108] The application layer can include a series of application packages.

[0109] like Figure 2 As shown, the application package may include applications such as Settings, Notifications, Camera, Gallery, Calendar, Calls, Maps, Navigation, WLAN, Bluetooth, Music, Video, and SMS.

[0110] The application framework layer provides application programming interfaces (APIs) and a programming framework for applications in the application layer. The application framework layer includes some predefined functions.

[0111] like Figure 2 As shown, the application framework layer may include a window manager, content provider, view system, phone manager, resource manager, notification manager, etc.

[0112] The notification manager allows applications to display notifications in the status bar. These notifications can be used to deliver informational messages and can disappear automatically after a short pause, requiring no user interaction. For example, the notification manager can be used to notify users of completed downloads or message alerts. The notification manager can also display notifications as icons or scrolling text in the top status bar, such as notifications from background applications, or as dialog boxes on the screen. Examples include displaying text messages in the status bar, emitting sounds, vibrating electronic devices, and flashing indicator lights.

[0113] The Android Runtime consists of core libraries and a virtual machine. The Android runtime is responsible for the scheduling and management of the Android system.

[0114] The core library consists of two parts: one part is the functionalities that need to be called by the Java language, and the other part is the Android core library.

[0115] The application layer and application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and application framework layer as binary files. The virtual machine is used to perform functions such as object lifecycle management, stack management, thread management, security and exception management, and garbage collection.

[0116] System libraries can include multiple functional modules. For example: surface manager, media libraries, 3D graphics processing libraries (e.g., OpenGL ES), 2D graphics engines (e.g., SGL), etc.

[0117] The Hardware Abstraction Layer (HAL) is an interface layer located between the operating system kernel and upper-level software, its purpose being to abstract hardware. The HAL is the abstract interface for device kernel drivers, used to provide application programming interfaces for accessing the underlying device to higher-level Java API frameworks. The HAL contains multiple library modules, such as the business CA corresponding to the business TA, the smart sensor hub HAL, the camera HAL, and the display HAL. Among these, the TA can include the face TA, and the face TA corresponds to the face CA.

[0118] Each library module implements an interface for a specific type of hardware component. For example, the Smart Sensor Hub (HAL) provides an interface to access hardware components such as the sensor hub; the Camera HAL provides an interface to the Camera Firewall (FWK) to access hardware components such as the camera; and the Display HAL provides an interface to the Display Firewall (FWK) to access hardware components such as the display. When the system framework layer API requires access to the portable device's hardware, the Android operating system loads the library module for that hardware component.

[0119] The kernel layer is the layer between hardware and software. At a minimum, the kernel layer contains display drivers, camera drivers, audio drivers, and sensor drivers. For example, the camera driver controls the camera to capture facial data.

[0120] The following examples, using the scenario of collecting facial data, illustrate the workflow of electronic device software.

[0121] For example, when the touch sensor in the terminal device receives a touch operation, the corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into a raw input event (including touch coordinates, touch pressure, touch operation timestamp, etc.). The raw input event is stored in the kernel layer. The application framework layer obtains the raw input event from the kernel layer and identifies the button corresponding to the input event. Taking the touch operation as a face data enrollment operation, and the virtual button corresponding to the face data enrollment operation as the "Settings Application" face enrollment virtual button as an example, the settings application calls the interface of the application framework layer, and then calls the kernel layer to start the display driver, displaying the function interface for collecting face data, and providing face collection instructions in the function interface. At the same time, it calls the camera access interface in the application framework layer to start the face data collection function of the settings application. Based on the camera driver in the kernel layer, one or more cameras are driven to collect one or more frames of face image data in real time. After the camera collects the face data, it can be fed back to the CA through the kernel layer and system library. The CA can transmit the face data to the TA, and the TA can store the face data.

[0122] Then, when the smart display function of the "Notification Application" is enabled, the CA of the HAL layer is called through the framework layer and system layer. The CA notifies the TA to transmit face data to the smart sensor hub, and the face data can be stored in the storage area of ​​the smart sensor hub.

[0123] Understandably, the method for triggering the CA to notify the TA to transmit face data to the sensor hub can be configured as needed and is not limited here.

[0124] The following description uses the specific implementation of this application as an example.

[0125] In this application embodiment, the method by which the TA transmits face data to the sensor hub may include, but is not limited to, the following methods:

[0126] The first method: such as Figure 3A As shown, the first trusted application (TA) in the first security environment TEE transmits target data to the smart sensor hub through TAs in other security environment TEEs (e.g., the second trusted application (TA) in the second security environment TEE).

[0127] For example, the first trusted application TA in the first security environment TEE calls the first agent application TA to transmit target data to the second agent application TA in the second security environment TEE, and the second agent application TA then transmits the target data to the storage area of ​​the smart sensor hub through the second trusted application TA.

[0128] The second method: such as Figure 3BAs shown, the first trusted application TA transmits target data to the smart sensor hub via REE.

[0129] For example, the first trusted application (TA) in the first security environment (TEE) transmits target data to the client application (CA) (also known as the business CA) in the REE, and then transmits the target data to the smart sensor hub (HAL) through the smart sensor hub.

[0130] The following embodiments, based on any of the above embodiments, describe several ways in which the first trusted application (TA) transmits target data to the smart sensor hub.

[0131] The following embodiments will first illustrate the transmission of target data from a first trusted application (TA) in a first secure environment (TEE) to a smart sensor hub through other secure environments.

[0132] Please see Figure 4 , Figure 4 This is a schematic flowchart illustrating another data transmission method provided in an embodiment of this application. This embodiment uses face data as an example for illustration. Figure 4 The methods shown may include:

[0133] The S410 intelligent sensor hub sends a face data transmission request to the client application CA.

[0134] The intelligent sensor hub can either instruct the client application CA to transmit face data when the electronic device receives a message, or periodically instruct the client CA to transmit face data. Optionally, after receiving the target face data, the intelligent sensor hub can store it indefinitely until the electronic device is powered off.

[0135] S420, the client application CA indicates the first information to the first trusted application TA.

[0136] The steps in this embodiment can be referred to in the description of S310, and will not be repeated here.

[0137] S430, the first trusted application TA responds to the first information and transmits the target face data of the first trusted application TA to the first agent application TA.

[0138] In this context, the first proxy application (TA) can be understood as the interface for data transmission between the first trusted application (TA) and the second trusted application (TA). The proxy application can monitor and detect information on the network, control access to the intranet, and perform network address translation, among other things. In this embodiment, the proxy application (TA) can isolate the trusted application (TA) from direct communication with the external network, thereby protecting the trusted application (TA).

[0139] S440, the first agent application TA transmits the target face data to the second agent application TA.

[0140] The second agent application TA can be understood as the interface for data transmission between the second trusted application TA and the first trusted application TA.

[0141] S450, the second agent application TA verifies the calling permissions of the first agent application TA.

[0142] S460: If the first agent application TA passes the permission verification, the second agent application TA transmits the target face data to the second trusted application TA.

[0143] If the first agent application TA has the permission to call the second trusted application TA, it means that the first agent application TA can access the second trusted application TA, that is, the first agent application TA can transmit data to the second trusted application TA.

[0144] Optionally, the second proxy application TA can be configured with a first mapping relationship between the proxy application and permissions. The first mapping relationship includes the first proxy application TA and the permissions it has. The second proxy application TA can then query the first mapping relationship to verify the calling permissions of the first proxy application TA.

[0145] The permissions possessed by the first proxy application (TA) may or may not include the permission to call the second trusted application (TA). The first mapping relationship can be, for example, a passlist or a blocklist.

[0146] In this embodiment of the application, the first mapping relationship can be configured in the second security environment (TEE) to reduce the risk of the first mapping relationship being tampered with. This can improve the accuracy of the verification of calling permissions and thus enhance the security of data transmission.

[0147] S470: If the first agent application TA fails to pass the permission verification, the second agent application TA filters the target face data.

[0148] Filtering target facial data can refer to not transmitting the target facial data to a second trusted application (TA).

[0149] S480, the second trusted application TA transmits the target face data of the first trusted application TA to the smart sensor hub.

[0150] The second trusted application (TA) can be the same as or different from the first trusted application (TA). For example, assuming the first trusted application (TA) is a face TA, the second trusted application (TA) can be a face TA or any other TA besides a face TA.

[0151] It should be noted that the data transmitted between TEEs can be encrypted or unencrypted, and there are no restrictions here.

[0152] In another possible implementation, in the case of restarting an electronic device after it has been powered off, the smart sensor hub may indicate a data transmission request to the client CA after the electronic device is powered on again.

[0153] In one possible implementation, data can be transmitted directly between the first trusted application (TA) and the second trusted application (TA), without going through a proxy application. In response to the first information, the first trusted application (TA) transmits its target face data to the second trusted application (TA), and the second trusted application (TA) then transmits the first trusted application's target face data to the smart sensor hub. This improves data transmission efficiency.

[0154] In one possible implementation, the second agent application TA could directly receive the target face data from the first agent application TA. This would reduce the time required to verify access permissions and improve data transmission efficiency.

[0155] In one possible implementation, the second secure environment (TEE) includes a first memory area, and the second agent application (TA) transmits target face data to the second trusted application (TA), including:

[0156] The second agent application TA writes the target face data to the first memory area, and the second trusted application TA retrieves the target face data from the first memory area.

[0157] The second agent application (TA) can write the received target face data into the first memory area. Then, the second trusted application (TA) can periodically retrieve the target face data from the first memory area and transmit it to the smart sensor hub. The memory area can be of a fixed size or dynamically allocated, for example, dynamically allocated based on the size of the data to be transmitted.

[0158] In this embodiment, the second agent application TA writes target face data to the first memory area, and the second trusted application can obtain the target face data from the first memory area. After the second agent application TA writes one or more target face data within a certain time period into the first memory area, the second trusted application TA can obtain the written one or more target face data at once, and then transmit one or more target face data together to the smart sensor hub. This can improve the efficiency of data transmission.

[0159] In another possible implementation, the second agent application TA could directly transmit the target face data to the second trusted application TA.

[0160] It should be noted that, based on the Virtual Machine Monitor (VMM) and TrustZone mechanisms, multiple TEE systems can run simultaneously. A VMM, also known as a hypervisor, is an intermediate software layer that runs between the underlying physical server and the operating system, allowing multiple operating systems and applications to share hardware.

[0161] The following embodiments, based on any of the above embodiments, illustrate how the first trusted application TA transmits target face data to the smart sensor hub via REE.

[0162] Please see Figure 5 , Figure 5 This is a flowchart illustrating another data transmission method provided in an embodiment of this application. Figure 5 The methods shown may include:

[0163] S510, Electronic device powered on.

[0164] The S520 intelligent sensor hub (HAL) generates a key and transmits the key to the client application (CA).

[0165] In this context, a key is a parameter input into algorithms that convert plaintext to ciphertext or vice versa. Keys are categorized as symmetric or asymmetric. In this embodiment, the intelligent sensor hub (HAL) can be configured with various encryption and decryption algorithms. The key in this embodiment can be dynamically allocated to enhance data encryption security.

[0166] It should be noted that the key can be transmitted periodically so that it can be updated periodically; in addition, it can also be generated and transmitted by the application layer when the function related to the target face data is triggered, and the application calls the smart sensor hub HAL to generate the key.

[0167] S530: The client application CA transmits the key to the first trusted application TA.

[0168] The S540 intelligent sensor hub sends a request for face data transmission to the client application CA.

[0169] S540 can be referred to in the description of S410, and will not be repeated here.

[0170] S550, the client application CA instructs the first trusted application TA to provide the first information.

[0171] In the embodiments, S540 can refer to the description of any of the above embodiments, and will not be repeated here.

[0172] S560, the first trusted application TA responds to the first information, and the first trusted application TA encrypts the target face data of the first trusted application TA based on the key to obtain the encrypted target face data.

[0173] S570, the first trusted application TA transmits encrypted target face data to the client application CA.

[0174] S580, client application CA calls smart sensor hub HAL.

[0175] The S590 and HAL intelligent sensor hub decrypt the encrypted target face data based on the key pair to obtain the decrypted target face data.

[0176] The S600 and HAL intelligent sensor hub transmit decrypted target face data to the intelligent sensor hub.

[0177] In one possible implementation, it may not be necessary to encrypt the target face data. That is, in the embodiments of this application, the first trusted application TA may transmit unencrypted target face data to the client application CA, and then the client application CA may transmit unencrypted target face data to the smart sensor hub.

[0178] In another possible implementation, the smart sensor hub (HAL) and the first trusted application (TA) are pre-configured with keys. In this case, the first trusted application (TA) can encrypt the data based on the pre-configured keys, and the smart sensor hub (HAL) can decrypt the data based on the pre-configured keys.

[0179] In another possible implementation, the data can be decrypted by other modules, such as a smart sensor hub decrypting the received data.

[0180] In one possible implementation, the first secure environment (TEE) includes a second memory area for storing target face data of a first trusted application (TA). In response to first information, the first trusted application (TA) transmits the target face data to the intelligent sensor hub, including:

[0181] In response to the first information, the first trusted application (TA) writes the target face data into the second memory area. The target face data stored in the second memory area is used to transmit to the smart sensor hub.

[0182] In this embodiment, the target face data can be stored in a second memory area for management, and the first trusted application (TA) can store multiple target face data in the second memory area, thereby reading multiple target face data at once from the second memory area. Furthermore, since the second memory area is located within the first secure environment (TEE), the storage security of the target face data is also guaranteed.

[0183] It should be noted that if the first trusted application TA transmits the target face data to the second trusted application TA through the first agent application TA, the first agent application TA will retrieve the data from the second memory area.

[0184] It is understandable that the first data transmission path of the second secure environment TEE and the second data transmission path of the non-secure environment REE can coexist, thereby improving the success rate of data transmission.

[0185] It should be noted that the triggering condition for the transmission of target face data from the first secure environment (TEE) to the intelligent sensor hub can also be that the intelligent sensor hub requests the first trusted application (TA) to transmit the data when it needs to perform a data comparison or verification task. For example, if the intelligent sensor hub transmits a request to the client CA through the intelligent sensor hub HAL, the client CA will then indicate first information to the first trusted application (TA) based on the request.

[0186] In the above embodiments, the data transmission method of this scheme is described under the condition that the target data is already stored in the first security environment TEE.

[0187] Therefore, the following embodiments, based on any of the above embodiments, explain how the target data is collected and how the target data is stored in the first security environment (TEE).

[0188] Please see Figure 6 , Figure 6This is a schematic flowchart illustrating another data transmission method provided in an embodiment of this application. This embodiment uses biometric data as an example to illustrate the target data. Biometric data may include, but is not limited to, at least one of facial data, fingerprint data, voiceprint data, and iris data, which can reflect biometric characteristics. Facial data and iris data can be collected via a camera, while voiceprint data can be collected via a fingerprint data acquisition module or a display screen integrated with a fingerprint data acquisition module. Voiceprint data can be collected via a microphone.

[0189] like Figure 6 The methods shown may include:

[0190] S602. Configure the application to respond to the face registration operation and transmit a data acquisition request to the data acquisition module of the electronic device.

[0191] The "Settings app" can be an application used to trigger face registration. It can be a pre-installed system application on the electronic device or an application installed by the user. Face registration refers to any operation that triggers the electronic device to collect facial data, including but not limited to at least one of touch operations (e.g., click operations) and voice control operations. For example, the electronic device's "Settings app" displays a first interface, which includes a face registration button. When the electronic device detects a click operation on the face registration button, the "Settings app" controls the hardware of the electronic device to collect first facial data through the framework layer, system layer, and driver layer.

[0192] S604. The data acquisition module responds to the data acquisition request, starts and acquires the first face data.

[0193] In another possible implementation, the data acquisition module can be started periodically or in real time to quickly collect facial data when needed.

[0194] S606 The data acquisition module transmits the first face data to the intelligent sensor hub HAL through the client application CA.

[0195] S608, the intelligent sensor hub HAL determines whether the first face data meets the data quality requirements.

[0196] The data quality requirements for different types of facial data can be different or the same. For example, for facial data, the data quality requirement could be that the facial data is complete and there are no issues such as blinking that could affect recognition. For fingerprint data, the data quality requirement could be that 90% of the fingerprint is captured and the fingerprint data is clear. These requirements can be set according to the actual situation and are not limited here.

[0197] S610 and HAL (Smart Sensor Hub) determine that the first face data meets the data quality requirements, and then send the second information to the client application CA (Card Alignment).

[0198] The second information is used to indicate the storage of the first facial data. Optionally, the second information may include a data storage instruction.

[0199] S612, the client application CA responds to the second information and indicates the third information and the first face data to the first trusted application TA.

[0200] The third information is used to indicate the storage of the first facial data. Optionally, the third information may include a data storage instruction.

[0201] S614. The first trusted application (TA) responds to the third information and stores the first face data as the target face data.

[0202] S616, the intelligent sensor hub HAL, when it is determined that the first face data does not meet the data quality requirements, extracts and stores the first face feature value based on the first face data.

[0203] The first facial feature value can reflect the face to a certain extent and can be used as a benchmark facial feature value for comparison, for example, by comparing it with the second facial feature value. In other words, the first and second facial data belong to the same user, but the second facial data has better data quality. For example, facial feature values ​​can indicate the contour features, facial features, etc. If it is fingerprint data, the corresponding fingerprint feature value can indicate parts of the fingerprint, etc.

[0204] Optionally, since the complete first face data cannot be reconstructed based on the first face feature value, this can both compare the second face feature value of the second face data to confirm the legality of the second face data and reduce the risk of leakage of the first face data caused by storing the first face feature value in an insecure environment REE.

[0205] It should be noted that in this embodiment, if it is determined that the first face data does not meet the data quality requirements, the first face data can be stored or not stored, and can be set as needed.

[0206] S618, The data acquisition module starts and acquires the second face data.

[0207] The second facial data can be collected periodically, when the electronic device detects the presence of a living being, or when the electronic device detects a triggering operation related to facial data collection (such as unlocking or payment). After collecting the second facial data, the electronic device transmits it to the client application (CA).

[0208] It should be noted that regardless of whether the first face data is stored, the second face data can continue to be collected.

[0209] Optionally, if first face data is stored, the data quality of second face data and first face data can be compared. If the data quality of second face data is higher, then second face data is stored.

[0210] S620: The data acquisition module transmits the second face data to the intelligent sensor hub HAL through the client application CA.

[0211] S622, the intelligent sensor hub HAL extracts the second face feature value based on the second face data and matches the second face feature value with the first face feature value.

[0212] Matching can involve comparing facial features. If the similarity between facial feature values ​​is greater than a similarity threshold, the match is considered successful; otherwise, the match fails.

[0213] S624. When the second face feature value is successfully matched with the first face feature value, the intelligent sensor hub (HAL) determines whether the second face data meets the data quality requirements.

[0214] S626, the intelligent sensor hub HAL, when the second face data meets the data quality requirements, sends the fourth information to the client application CA.

[0215] The fourth piece of information is used to indicate the storage of the second face data. In this embodiment, the intelligent sensor hub (HAL) only instructs the client application (CA) to provide the fourth piece of information when the second face feature value successfully matches the first face feature value and the second face data meets the data quality requirements.

[0216] It should be noted that if the second face feature value does not match the first face feature value, or if the second face data does not meet the data quality requirements, the second face data will be filtered.

[0217] S628, the client application CA responds to the fourth information and indicates the fifth information and the second face data to the first trusted application TA.

[0218] The fifth piece of information is used to indicate the storage of the second facial data.

[0219] S630, the first trusted application TA responds to the fifth information and stores the second face data as the target face data.

[0220] In one possible implementation, the first face data could be stored directly.

[0221] In one possible implementation, other modules in the non-secure REE environment can also be used to determine if data quality requirements are not met, extract facial feature values, and match facial feature values.

[0222] In another possible implementation, it is also possible to choose not to perform matching between the first and second facial feature values, or not to determine whether the second facial data meets the data quality requirements.

[0223] It is understood that, in the embodiments of this application, the target face data may also be replaced with other data, such as at least one of fingerprint data, voiceprint data, and iris data.

[0224] It is understood that the target data may also include data other than biometric data, such as non-biometric data, which is not limited here.

[0225] The above embodiments illustrate the transmission of target data between the TEE and the smart sensor hub. The following embodiments, based on any of the above embodiments, illustrate how the smart sensor hub uses the target data for comparison.

[0226] Scenario 1: The electronic device is recording user A's facial data. If the electronic device receives a message, the first thing it will do is detect that user A is using the device, and then display the message, such as... Figure 7 As shown.

[0227] In the second moment, if the electronic device detects that user B is using the device, or if the electronic device detects that user A is using the device, but users B and C are also present next to user A, then the electronic device hides the message, such as... Figure 8 As shown.

[0228] In this embodiment, the notification application is configured to enable the smart display function. Specifically, when the electronic device receives a message, it invokes the smart sensor hub to compare the biometric data to be compared with the target biometric data collected by the electronic device. If the comparison between the biometric data to be compared and the target biometric data is successful, the smart sensor hub indicates a sixth piece of information to the notification application; if the comparison fails, it indicates a seventh piece of information to the notification application. The sixth piece of information is used to indicate the display of the message, and the seventh piece of information is used to indicate the hiding of the message. The notification application displays the message based on the received sixth piece of information, or hides the message based on the received seventh piece of information.

[0229] In the third moment, if the electronic device detects user A again, it can then display the message again.

[0230] In the fourth step, if the electronic device detects a message clearing operation, it will no longer make a judgment on whether to hide or display the message.

[0231] In this context, "displaying a message" can refer to showing the message content in plaintext. Therefore, a message can mean either no notification is given, or a notification is given but its content is not displayed. The smart sensor hub can be configured with a data comparison algorithm.

[0232] It should be noted that the acquisition and storage of target facial data can be described in any of the above embodiments, and will not be repeated here.

[0233] It should be noted that the intelligent sensor hub can also compare the face data to be compared with the target face data collected by the electronic device in real time, so that the electronic device can quickly obtain the feature data comparison results when it receives a message, and then determine whether to display the message.

[0234] The technical solutions of this application will be described in detail below with specific embodiments. These specific embodiments can be implemented independently or in combination with each other. Identical or similar concepts or processes may not be described again in some embodiments.

[0235] The data transmission method provided in this application includes:

[0236] The client application (CA) instructs the first trusted application (TA) to provide the first information. In response to the first information, the first trusted application (TA) transmits its target data to the smart sensor hub.

[0237] The first information is used to indicate the target data for transmission of the first trusted application (TA). Optionally, the first information may include a data transmission command. The first trusted application (TA) may be a business-related TA, therefore, the trusted application (TA) may also be called a business TA. Optionally, the business TA may be a business TA with certain security requirements for the data, such as a face recognition TA. The client CA may be a CA associated with the first trusted application (TA). For example, if the first trusted application (TA) is a face recognition TA, then the client CA may be a face recognition CA.

[0238] In this embodiment of the application, when a function related to the target data is detected to be triggered, the client application CA is invoked to indicate first information to the first trusted application TA. For example, if the screen unlocking function or the smart notification function is triggered, the client CA is invoked to indicate the first information.

[0239] The target data can be data with certain security and confidentiality requirements, such as at least one of facial data, fingerprint data, voiceprint data, and iris data. The target data of the first trusted application (TA) can be stored in the first secure environment (TEE) where the first trusted application (TA) resides.

[0240] In this embodiment of the application, the client application CA indicates first information to the first trusted application TA, and then the first trusted application TA can transmit target data to the smart sensor hub based on the first information, thus realizing communication between the trusted application TA and the smart sensor hub, thereby enriching the communication methods of the trusted application TA.

[0241] The embodiments of this application can be referred to. Figure 4 The relevant explanations will not be repeated here.

[0242] In this embodiment, the method by which the first trusted application (TA) sends target data to the smart sensor hub can be referred to the description of any of the above embodiments, and will not be repeated here.

[0243] It should be noted that the first trusted application (TA) can also transmit data directly to the smart sensor hub.

[0244] In one possible implementation, the electronic device further includes a second secure environment (TEE) and a second trusted application (TA) running on the second secure environment (TEE). The first trusted application (TA), in response to the first information, transmits target data to the smart sensor hub, which may include:

[0245] In response to the first information, the first trusted application TA transmits the target data of the first trusted application TA to the second trusted application TA; the second trusted application TA transmits the target data of the first trusted application TA to the smart sensor hub through the first interface.

[0246] The data transmission method in this embodiment can be referred to Figure 4 The relevant explanations will not be repeated here.

[0247] In another possible implementation, the first trusted application (TA) responds to the first information by transmitting the target data of the first trusted application (TA) to the smart sensor hub, including:

[0248] The first trusted application (TA) responds to the first information and transmits the target data of the first trusted application (TA) to the client application (CA); the client application (CA) transmits the target data of the first trusted application (TA) to the smart sensor hub.

[0249] In the embodiments of this application, reference can be made to Figure 5 The relevant explanations will not be repeated here.

[0250] It should be noted that the module names involved in the embodiments of this application can all be defined as other names, as long as they can achieve the function of each module, and no specific restrictions are placed on the module names.

[0251] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0252] The data transmission method of the embodiments of this application has been described above. The apparatus for executing the above method provided in the embodiments of this application is described below. Those skilled in the art will understand that the methods and apparatus can be combined and referenced with each other, and the related apparatus provided in the embodiments of this application can execute the steps in the above list sorting method.

[0253] The data transmission method provided in this application can be applied to electronic devices with communication functions. The electronic devices include terminal devices, and the specific device form of the terminal devices can be referred to the above-described related descriptions, which will not be repeated here.

[0254] This application provides a terminal device, which includes a processor and a memory; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, causing the terminal device to perform the above-described method.

[0255] like Figure 9This is a schematic diagram of a chip structure provided in an embodiment of this application. The chip 900 includes one or more processors 901, a communication line 902, a communication interface 903, and a memory 904.

[0256] In some implementations, memory 904 stores elements such as executable modules or data structures, or subsets thereof, or extended sets thereof.

[0257] The methods described in the embodiments of this application can be applied to, or implemented by, processor 901. Processor 901 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware of processor 901 or by instructions in software form. Processor 901 may be a general-purpose processor (e.g., a microprocessor or conventional processor), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates, transistor logic devices, or discrete hardware components. Processor 901 can implement or execute the various processing-related methods, steps, and logic block diagrams disclosed in the embodiments of this application.

[0258] The steps of the method described in the embodiments of this application can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in mature storage media in the art, such as random access memory, read-only memory, programmable read-only memory, or electrically erasable programmable read-only memory (EEPROM). This storage medium is located in memory 904, and processor 901 reads the information in memory 904 and, in conjunction with its hardware, completes the steps of the above method.

[0259] The processor 901, memory 904 and communication interface 903 can communicate with each other via communication line 902.

[0260] In the above embodiments, the instructions stored in the memory for execution by the processor can be implemented in the form of a computer program product. This computer program product can be pre-written into the memory, or it can be downloaded and installed into the memory as software.

[0261] This application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, it implements the methods described above. The methods described in the above embodiments can be implemented wholly or partially by software, hardware, firmware, or any combination thereof. If implemented in software, the functionality can be stored as one or more instructions or code on or transmitted over the computer-readable medium. The computer-readable medium can include computer storage media and communication media, and can also include any medium that can transfer a computer program from one place to another. The storage medium can be any target medium accessible by a computer.

[0262] In one possible implementation, a computer-readable medium may include RAM, ROM, compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage or other magnetic storage devices, or any other medium targeted to carry or to store the required program code in the form of instructions or data structures, and accessible by a computer. Furthermore, any connection is appropriately referred to as a computer-readable medium. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. As used herein, disks and optical discs include optical discs, laser discs, optical discs, Digital Versatile Discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs optically reproduce data using lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0263] This application provides a computer program product, which includes a computer program that, when run, causes a computer to perform the above-described method.

[0264] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing device, generate instructions for implementing the flowchart illustrations. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0265] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data transmission method, characterized in that, The method is applied to an electronic device, the electronic device including a first secure environment TEE, a smart sensor hub, a non-secure environment REE, a client application CA running in the non-secure environment REE, and a first trusted application TA running in the first secure environment TEE, the method including: The client application CA indicates first information to the first trusted application TA, and the first information is used to indicate the target data to be transmitted to the first trusted application TA. In response to the first information, the first trusted application TA transmits the target data of the first trusted application TA to the smart sensor hub. The electronic device further includes a second secure environment (TEE) and a second trusted application (TA) running on the second secure environment (TEE). The first trusted application (TA), in response to the first information, transmits target data to the smart sensor hub, including: In response to the first information, the first trusted application TA transmits the target data of the first trusted application TA to the second trusted application TA; The second trusted application (TA) transmits the target data of the first trusted application (TA) to the smart sensor hub.

2. The method according to claim 1, characterized in that, The electronic device further includes a first agent application (TA) running in the first secure environment TEE and a second agent application (TA) running in the second secure environment TEE. The first trusted application (TA) transmits target data of the first trusted application (TA) to the second trusted application (TA), including: The first trusted application TA transmits the target data of the first trusted application TA to the first agent application TA; The first agent application TA transmits the target data to the second agent application TA; The second agent application TA transmits the target data to the second trusted application TA.

3. The method according to claim 2, characterized in that, Before the second agent application TA transmits the target data to the second trusted application TA, the process also includes: The second proxy application TA verifies the calling permissions of the first proxy application TA, and transmits the target data to the second trusted application TA if the calling permissions of the first proxy application TA pass the verification.

4. The method according to any one of claims 1-3, characterized in that, In response to the first information, the first trusted application (TA) transmits the target data of the first trusted application (TA) to the smart sensor hub, including: In response to the first information, the first trusted application TA transmits the target data of the first trusted application TA to the client application CA; The client application CA transmits the target data of the first trusted application TA to the smart sensor hub.

5. The method according to claim 4, characterized in that, Before the first trusted application (TA) transmits the target data of the first trusted application (TA) to the client application (CA), the process further includes: The first trusted application TA encrypts the target data of the first trusted application TA to obtain the encrypted target data; The insecure environment REE also includes a smart sensor hub HAL, and the client application CA transmits the target data of the first trusted application TA to the smart sensor hub, including: The client application CA calls the smart sensor hub HAL to decrypt the encrypted target data, and obtains the decrypted target data. The intelligent sensor hub HAL transmits the decrypted target data to the intelligent sensor hub.

6. The method according to claim 5, characterized in that, The method further includes: The intelligent sensor hub (HAL) generates a key and transmits the key to the client application (CA). The client application CA transmits the key to the first trusted application TA; The first trusted application (TA) encrypts the target data of the first trusted application (TA), including: The first trusted application (TA) encrypts the target data of the first trusted application (TA) based on the key; The intelligent sensor hub (HAL) decrypts the encrypted target data, including: The intelligent sensor hub HAL decrypts the encrypted target data based on the key.

7. The method according to any one of claims 1-3 and 5-6, characterized in that, The target data includes target biometric data, the electronic device further includes a settings application running in the unsafe environment REE, and the method further includes: The application is configured to respond to biometric input operations and collect first biometric data through electronic devices; In an unsecured environment, if the first biometric data meets the data quality requirements, the REE will instruct the client application CA to provide second information, which is used to instruct the storage of the first biometric data. In response to the second information, the client application CA indicates the third information and the first biometric data to the first trusted application TA, wherein the third information is used to indicate the storage of the first biometric data. In response to the third information, the first trusted application (TA) stores the first biometric data as the target biometric data.

8. The method according to claim 7, characterized in that, The unsafe environment REE includes a smart sensor hub HAL, and the method further includes: The intelligent sensor hub (HAL) determines whether the first biometric data meets the data quality requirements.

9. The method according to claim 7, characterized in that, The method further includes: In the case where the first biometric data does not meet the data quality requirements, the non-safe environment REE extracts and stores the first biometric value based on the first biometric data. The client application CA receives the second biometric data collected by the electronic device; The unsafe environment REE extracts a second biometric value based on the second biometric data and matches the second biometric value with the first biometric value; When the second biometric value and the first biometric value are successfully matched and the second biometric data meet the data quality requirements, the non-secure environment REE indicates fourth information to the client application CA, the fourth information being used to indicate the storage of the second biometric data. In response to the fourth information, the client application CA indicates the fifth information and the second biometric data to the first trusted application TA, wherein the fifth information is used to indicate the storage of the second biometric data; In response to the fifth information, the first trusted application (TA) stores the second biometric data as the target biometric data.

10. The method according to claim 9, characterized in that, The unsecured environment REE includes the intelligent sensor hub HAL. The secure environment REE extracts a second biometric value based on the second biometric data and matches the second biometric value with the first biometric value, including: The intelligent sensor hub HAL extracts a second biometric value based on the second biometric data and matches the second biometric value with the first biometric value.

11. The method according to any one of claims 1-3, 5-6, and 8-10, characterized in that, The target data includes target biometric data. The electronic device also includes a notification application running in the insecure environment REE, the notification application being configured to enable smart display functionality. After the first trusted application TA responds to the first information and transmits the target data of the first trusted application TA to the smart sensor hub, the device further includes: When the electronic device receives a message, the smart sensor hub compares the biometric data to be compared collected by the electronic device with the target biometric data. The intelligent sensor hub indicates a sixth message to the notification application when the biometric data to be compared is successfully compared with the target biometric data, or indicates a seventh message to the notification application when the biometric data to be compared fails to be compared with the target biometric data. The sixth message is used to indicate that the message is displayed, and the seventh message is used to indicate that the message is hidden. The notification application may display the message based on the received sixth information, or hide the message based on the received seventh information.

12. An electronic device, characterized in that, The electronic device includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, and the one or more processors invoking the computer instructions to cause the electronic device to perform the method as described in any one of claims 1 to 11.

13. A chip system, characterized in that, The chip system is applied to an electronic device, the chip system including one or more processors, the one or more processors being used to invoke computer instructions to cause the electronic device to perform the method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer instructions that, when executed on an electronic device, cause the electronic device to perform the method as described in any one of claims 1 to 11.

15. A computer program product, characterized in that, The computer program product includes computer program code that, when run on an electronic device, causes the electronic device to perform the method as described in any one of claims 1 to 11.

Images