ADB one-machine one-password authentication method, system and device based on TEE secure storage, processor and storage medium thereof
By employing a TEE-secure storage method for ADB one-device-one-key authentication in Android devices, a unique ADB access password for each device is dynamically generated and stored. This addresses the security flaws of traditional USB ADB debugging authorization mechanisms, achieving device-level uniqueness and attack resistance, and enhancing system security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-15
- Publication Date
- 2026-03-10
AI Technical Summary
Traditional USB ADB debugging authorization mechanisms suffer from weak authentication mechanisms, insecure key management, lack of device-level isolation, and vulnerability to replay attacks, resulting in insufficient security for Android devices.
The ADB one-device-one-key authentication method based on TEE secure storage is adopted. By storing the master control key ADB_KEY in an immutable secure storage area, a unique ADB access password ADB_PASSWORD is dynamically generated for the device, and its hash value is stored in the Trusted Execution Environment (TEE) for comparison and authentication.
This ensures the uniqueness of the ADB access password for each device, enhances resistance to physical attacks, effectively defends against replay attacks, constructs a full-chain security protection system, and strengthens the overall security of the system.
Smart Images
Figure CN121644073A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of Android device security technology, and more particularly to the field of Android debug bridges. Specifically, it refers to an ADB one-device-one-key authentication method, system, device, processor, and computer-readable storage medium based on TEE secure storage. Background Technology
[0002] The Android Debug Bridge is a general-purpose command-line tool for communicating with Android devices, providing rich device operation and debugging functions. However, the traditional USB ADB debugging authorization mechanism has serious security flaws: 1. Weak authentication mechanism: Traditional methods rely solely on a software switch on the device to "allow USB debugging," lacking strong authentication. Once an attacker physically gains access to the device and enables this option, they can gain full ADB shell access, thereby executing high-risk commands (such as adb root).
[0003] 2. Insecure Key Management: Some existing software encryption schemes store keys or passwords in the device's ordinary file system (such as the / data partition). These keys are easily stolen and copied through memory scanning, firmware extraction, or root privileges.
[0004] 3. Lack of device-level isolation: Existing solutions cannot achieve true "one device, one key". Once a static password or shared key is leaked, it can be used to attack all devices of the same model, lacking effective security isolation.
[0005] 4. Vulnerable to replay attacks: Fixed passwords or soft tokens are easily intercepted and replayed, allowing attackers to reuse stolen credentials at different times or through different channels.
[0006] Therefore, there is an urgent need in this field for an ADB authentication solution that can achieve strong identity authentication, secure key storage, and device uniqueness. Summary of the Invention
[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide an ADB one-machine-one-key authentication method, system, device, processor and computer-readable storage medium based on TEE secure storage.
[0008] To achieve the above objectives, the ADB one-machine-one-key authentication method, system, device, processor, and computer-readable storage medium based on TEE secure storage of the present invention are as follows: The main feature of this ADB one-machine-one-key authentication method based on TEE secure storage is that the method includes the following steps: (1) Key presetting: Securely write the master control key ADB_KEY into the device's immutable secure storage area; (2) Dynamic password generation: Based on the device's unique serial number SN and the master control key ADB_KEY, a unique ADB access password ADB_PASSWORD is dynamically generated for the device using a password generation algorithm; (3) Secure storage: Calculate the hash value of the ADB_PASSWORD and store the hash value in the Trusted Execution Environment (TEE) of the device; (4) Authentication verification: During ADB connection authentication, the hash value of the password entered by the user is compared with the hash value stored in the Trusted Execution Environment (TEE), and the access is authorized based on the comparison result.
[0009] Preferably, the password generation algorithm is generated according to the following formula: ADB_PASSWORD = AES-256-CCM( ADB_KEY, SHA-256(SN) ) AES-256-CCM represents the CCM operation mode based on the AES-256 algorithm, and SHA-256(SN) represents the SHA-256 hash value of the device serial number.
[0010] Preferably, the immutable secure storage area is an eFuse or an OTP memory.
[0011] Preferably, in step (2), the calculation of the ADB access password ADB_PASSWORD is performed by the hardware encryption engine.
[0012] Preferably, the hardware encryption engine includes an AES / SHA256 module for performing encryption operations.
[0013] Preferably, in step (4), the comparison of the password hash values is performed within the Trusted Execution Environment (TEE).
[0014] The ADB one-machine-one-key authentication system based on TEE secure storage, implemented according to the method described above, is characterized by the following: A secure key storage module is used to physically and securely store the master control key ADB_KEY; The Trusted Execution Environment module is used to provide a secure execution environment and secure storage to store the hash value of the ADB_PASSWORD and perform password verification comparison. The hardware encryption engine module is used to provide hardware acceleration for encryption operations of the password generation algorithm. The ADB interface and authentication logic module runs on the device's main operating system. It is used to process ADB connection requests and coordinate the interaction with the Trusted Execution Environment module and the hardware encryption engine module to complete the authentication process.
[0015] Preferably, the security key storage module is an eFuse or an OTP memory.
[0016] Preferably, the Trusted Execution Environment module is isolated from the device's main operating system and runs trusted applications that conform to the GlobalPlatform standard.
[0017] The main feature of this ADB one-machine-one-key authentication device based on TEE secure storage is that the device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the ADB one-machine-one-key authentication method based on TEE secure storage described above.
[0018] The ADB one-machine-one-key authentication processor based on TEE secure storage is characterized in that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the steps of the ADB one-machine-one-key authentication method based on TEE secure storage described above are implemented.
[0019] The main feature of this computer-readable storage medium is that it stores a computer program that can be executed by a processor to implement the steps of the ADB one-machine-one-key authentication method based on TEE secure storage described above.
[0020] The ADB one-machine-one-key authentication method, system, device, processor, and computer-readable storage medium based on TEE secure storage of the present invention have the following significant advantages compared with the prior art: 1. Achieve true one-device-one-password: Since the password ADB_PASSWORD is dynamically generated by the device's unique SN and hardware-bound ADB_KEY, it ensures that the ADB access password of each device is different, thus achieving secure isolation.
[0021] 2. Enhanced resistance to physical attacks: The core key ADB_KEY is stored in a hardware security zone such as eFuse, while the dynamic password ADB_PASSWORD itself is not stored; its hash value is stored in the TEE. Even if the device is disassembled, attackers cannot directly extract the valid plaintext password.
[0022] 3. Effectively resists replay attacks: The password is strongly bound to the device's hardware features, and the generation process involves encryption operations, making the password unique and random. Intercepted passwords cannot be used on other devices.
[0023] 4. Enhance overall system security: Through the collaboration between TEE and hardware security modules, a full-chain security protection system is built, from key storage and password generation to verification and comparison, which greatly improves the security threshold of the ADB debugging interface. Attached Figure Description
[0024] Figure 1 This is a schematic diagram of the security architecture of the ADB one-machine-one-key authentication system based on TEE secure storage according to the present invention.
[0025] Figure 2 This is a timing diagram of the ADB authentication process of the ADB one-machine-one-key authentication method based on TEE secure storage according to the present invention.
[0026] Figure 3 This is a schematic diagram of the hierarchical key architecture of the ADB one-machine-one-key authentication system based on TEE secure storage according to the present invention.
[0027] Figure 4 This is a schematic diagram of the session flow of communication between CA and TA in a specific embodiment of the ADB one-machine-one-key authentication method based on TEE secure storage of the present invention. Detailed Implementation
[0028] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.
[0029] Before describing the embodiments of the present invention in detail, it should be noted that, in the following, the terms “comprising,” “including,” or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus.
[0030] This ADB one-machine-one-key authentication method based on TEE secure storage includes the following steps: Key presetting and binding: During the device manufacturing stage, a 256-bit master control key ADB_KEY is written into the device's immutable secure storage area; at the same time, the device's unique serial number SN is obtained.
[0031] Dynamic password generation: When ADB authentication needs to be enabled or performed, the system dynamically calculates a unique ADB access password ADB_PASSWORD for the device based on the unique serial number SN and the master control key ADB_KEY using a preset password generation algorithm.
[0032] As a preferred embodiment of the present invention, the password generation algorithm is as follows: ADB_PASSWORD = AES-256-CCM(ADB_KEY, SHA-256(SN)).
[0033] That is, first perform a SHA-256 hash operation on the device serial number SN, then use ADB_KEY as the key to encrypt the hash value in AES-256-CCM mode to generate the final dynamic password.
[0034] Secure Storage: The generated ADB_PASSWORD is never stored directly in the ordinary file system. Instead, when the device is first configured or the password is updated, a hash value of the ADB_PASSWORD (e.g., TEE_STORED_HASH = SHA-256(ADB_PASSWORD)) is calculated and this hash value is securely stored in a secure storage area within the device's trusted execution environment.
[0035] Authentication and verification: When a user or debug host attempts to connect to the device via ADB: a. The Android system on the device requests the hash value (i.e., SHA-256(SN)) of the device's unique identifier from the TEE.
[0036] b. The Android system uses the obtained SHA-256(SN) and the preset master control key ADB_KEY (accessed via a secure path) to calculate the expected ADB_PASSWORD according to the password generation algorithm described above.
[0037] c. After the user enters the password, the Android system sends the hash value of the entered password to the TEE.
[0038] d. The TEE compares the received input password hash with the securely stored TEE_STORED_HASH.
[0039] e. If both match, the TEE returns a successful authentication signal, and the Android system authorizes the ADB debugging session; otherwise, it returns an authentication failure signal and denies access.
[0040] The authentication system used to implement the above method includes: Secure key storage module: Employing eFuse or one-time programmable memory (OTP), this module physically and securely stores the master control key ADB_KEY. Once written to, this area cannot be directly read or modified by software, providing tamper-proof characteristics.
[0041] Trusted Execution Environment (TEE): This is a secure execution zone isolated from the device's main operating system. Trusted applications run within the TEE, responsible for performing password hash comparison operations and providing secure storage to protect the TEE_STORED_HASH.
[0042] Hardware encryption engine module: This is a dedicated encryption hardware module integrated into the device's main control chip. It includes hardware acceleration modules for algorithms such as AES and SHA-256, used to efficiently and securely execute encryption and hash operations in the password generation algorithm.
[0043] ADB Interface and Authentication Logic Module: Located in the Android system, it is responsible for handling ADB connection requests, coordinating communication with TEE, and executing the control logic of the authentication process.
[0044] As a preferred embodiment of the present invention, this embodiment follows the GlobalPlatform TEE standard. The system architecture is as follows: Figure 1 As shown, it includes the main control chip, Android system (including ADB interface), TEE, hardware encryption engine and eFuse secure area.
[0045] ●System initialization and key preset: Before the device leaves the factory, the 256-bit ADB_KEY is burned into the eFuse secure area. At the same time, space is reserved in the TEE's secure storage to store TEE_STORED_HASH.
[0046] ●ADB authentication process (in conjunction with) Figure 2 ): 1. ADB Connection Request: The user device connects via USB and initiates an ADB debugging connection.
[0047] 2. Obtaining SN_HASH: The ADB authentication service in the Android system calls the TA (Trusted Application) in the TEE through the CA (Client Application) to request the hash value of the device SN (Serial Number), SN_HASH = SHA-256(SN). This SN can be read by the TEE from the secure area or provided by the Android system and then verified by the TEE.
[0048] 3. Calculate the expected password: The ADB authentication service uses the SN_HASH obtained from the TEE and accesses the hardware encryption engine through a secure API. Using the ADB_KEY in the eFuse, it performs the AES-256-CCM(ADB_KEY, SN_HASH) operation to obtain the expected ADB_PASSWORD. This step can also be completed within the TEE to enhance security.
[0049] 4. Password verification: Users enter their ADB password through a secure interface.
[0050] The Android system calculates the SHA-256 hash value INPUT_HASH of the input password.
[0051] The Android system's CA passes INPUT_HASH to the TA in the TEE via the TEEC_InvokeCommand instruction.
[0052] The TA compares the INPUT_HASH with the securely stored TEE_STORED_HASH within the TEE.
[0053] The comparison result is returned to CA via the return value of TEEC_InvokeCommand.
[0054] 5. Authorization Decision: If the TEE returns a successful authentication, the Android system authorizes the ADB debugging session and establishes a complete ADB connection.
[0055] If authentication fails, the Android system logs the failure and denies ADB access.
[0056] ●CA and TA communication process (combined) Figure 4 ): In this embodiment, the interaction between CA and TA follows the GP API standard: 1) CA-side interface: TEEC_InitializeContext: Initializes the Context variable to establish the connection between CA and TEE, and requests a shared memory address from TEE to store data.
[0057] TEEC_OpenSession: Establishes a session between a CA and a TA for communication between the CA and the TA specified by the UUID. It is the starting point for the CA to connect to the TA.
[0058] TEEC_InvokeCommand: Relying on the open session, it sends a command request to the TA and sends the necessary command execution parameters to the TA.
[0059] TEEC_CloseSession: Closes the session and shuts down the channel between CA and TA.
[0060] TEEC_FinalizeContext: Releases the Context, ending the connection between CA and TEE.
[0061] 2) TA side interface: TA_OpenSessionEntryPoint: Establishes an access point for the CA, enabling the TA to be invoked by the CA.
[0062] TA_InvokeCommandEntryPoint: Removes the CA's access point, ending the TA's functionality.
[0063] TA_CloseSessionEntryPoint: Establishes a communication channel between CA and TA, serving as the starting point for CA to connect to TA.
[0064] TA_CloseSessionEntryPoint: Closes the communication channel between CA and TA. TA_InvokeCommandEntryPoint: Receives the instructions and parameters transmitted by the CA and executes them on this TEE side.
[0065] … The TA side processes CA requests through the above interfaces.
[0066] ●Software logic flow for CA and TA communication under the GP standard: 1) First, the CA needs to establish a Context with the Trusted OS. All subsequent communication between the CA and the TEE environment will be based on this Context.
[0067] 2) Then the CA will request the Trusted OS to establish a Session with the requesting TA.
[0068] 3) Once the session between CA and TA is established, CA can send a command to TA.
[0069] 4) The Command and its parameters are passed through shared memory. The TA obtains the CA's request and request parameters from the shared memory.
[0070] 5) TA performs processing in the TEE environment, and the processing results are refilled into the shared memory. CA can then obtain the processing results through the shared memory.
[0071] 6) After obtaining the processing result, if no further requests are needed, the CA will initiate a request to close the Session, the Trusted OS will reclaim the TA-related resources, and finally the CA will initiate a request to destroy the Context, completing a full interaction.
[0072] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.
[0073] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution device.
[0074] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.
[0075] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.
[0076] In the description of this specification, references to terms such as "an embodiment," "some embodiments," "example," "specific example," or "embodiment," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0077] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.
[0078] The ADB one-machine-one-key authentication method, system, device, processor, and computer-readable storage medium based on TEE secure storage of the present invention have the following significant advantages compared with the prior art: 1. Achieve true one-device-one-password: Since the password ADB_PASSWORD is dynamically generated by the device's unique SN and hardware-bound ADB_KEY, it ensures that the ADB access password of each device is different, thus achieving secure isolation.
[0079] 2. Enhanced resistance to physical attacks: The core key ADB_KEY is stored in a hardware security zone such as eFuse, while the dynamic password ADB_PASSWORD itself is not stored; its hash value is stored in the TEE. Even if the device is disassembled, attackers cannot directly extract the valid plaintext password.
[0080] 3. Effectively resists replay attacks: The password is strongly bound to the device's hardware features, and the generation process involves encryption operations, making the password unique and random. Intercepted passwords cannot be used on other devices.
[0081] 4. Enhance overall system security: Through the collaboration between TEE and hardware security modules, a full-chain security protection system is built, from key storage and password generation to verification and comparison, which greatly improves the security threshold of the ADB debugging interface.
[0082] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.
Claims
1. A method for ADB one-device one-time password authentication based on TEE secure storage, characterized in that, The method comprises the following steps: (1) Key pre-setting: securely writing a master key ADB KEY into an immutable secure storage area of a device; (2) Dynamic password generation: dynamically generating a unique ADB access password ADB PASSWORD of the device based on a unique serial number SN of the device and the master key ADB KEY through a password generation algorithm; (3) Secure storage: calculating a hash value of the ADB PASSWORD and storing the hash value in a trusted execution environment TEE of the device; (4) Authentication verification: when ADB connection authentication is performed, comparing a hash value of a user input password with the hash value stored in the trusted execution environment TEE, and determining whether to authorize access according to a comparison result.
2. The TEE-based secure storage ADB one-device-one-password authentication method of claim 1, wherein, The password generation algorithm is generated according to the following formula: ADB_PASSWORD = AES-256-CCM(ADB KEY, SHA-256(SN)) Wherein, AES-256-CCM represents a CCM operation mode based on an AES-256 algorithm, and SHA-256(SN) represents a SHA-256 hash value of a device serial number. 3.The ADB one-device-one-password authentication method based on TEE secure storage according to claim 1 or 2, characterized in that, The immutable secure storage area is an eFuse or an OTP memory.
4. The TEE-based secure storage ADB one-device-one-password authentication method of claim 1, wherein, In step (2), the operation process of calculating the ADB access password ADB PASSWORD is performed by a hardware encryption engine.
5. The TEE-based secure storage ADB one-device-one-password authentication method of claim 4, wherein, The hardware encryption engine comprises an AES / SHA256 module for performing encryption operations.
6. The TEE-based secure storage ADB one-device-one-password authentication method of claim 1, wherein, In step (4), the comparison operation of the password hash value is completed inside the trusted execution environment TEE.
7. An ADB one-machine-one-password authentication system based on TEE secure storage achieved according to the method of any one of claims 1 to 6. The system comprises: a secure key storage module for physically and securely storing the master key ADB KEY; a trusted execution environment module for providing a secure execution environment and a secure storage to store the hash value of the ADB PASSWORD and perform password verification comparison; a hardware encryption engine module for providing encryption operation hardware acceleration for the password generation algorithm; an ADB interface and authentication logic module running on a main operating system of the device, for processing ADB connection requests and coordinating interaction with the trusted execution environment module and the hardware encryption engine module to complete the authentication process. 8.The TEE-based secure storage ADB one-device-one-password authentication system of claim 7, wherein, The secure key storage module is an eFuse or an OTP memory. 9.The TEE-based secure storage ADB one-device-one-password authentication system of claim 7, wherein, The trusted execution environment module is isolated from the main operating system of the device and runs a trusted application program complying with the GlobalPlatform standard.
10. An ADB one-device-one-password authentication device based on TEE secure storage, characterized in that, The apparatus comprises: a processor configured to execute computer executable instructions; a memory storing one or more computer executable instructions, which, when executed by the processor, implement the steps of the TEE-based secure storage ADB one-machine-one-password authentication method according to any one of claims 1 to 6. 11.A TEE-based secure storage-based ADB one-device-one-password authentication processor, characterized in that, The processor is configured to execute computer executable instructions, which, when executed by the processor, implement the steps of the TEE-based secure storage ADB one-machine-one-password authentication method according to any one of claims 1 to 6.
12. A computer-readable storage medium, characterized in that, A computer program is stored on the computer program product, and the computer program can be executed by the processor to implement the steps of the ADB one-device-one-password authentication method based on the TEE security storage according to any one of claims 1 to 6.