Biological recognition security enhancement method and electronic equipment

Abstract

The invention relates to the technical field of virtualization frameworks, in particular to a biological recognition security enhancement method and electronic equipment. The upper-layer application sends a biological recognition request to the secure virtual machine; the security virtual machine displays a biological information acquisition interface after receiving the biological recognition request, and sends a biological information acquisition request to the rich execution environment; the rich execution environment receives the biological information obtaining request, obtains biological information and sends the biological information to the trusted execution environment; the trusted execution environment verifies the biological information, obtains and stores a verification result, and sends the verification result to the secure virtual machine through the rich execution environment; and the security virtual machine sends the verification result to the upper-layer application. And the risk that the existing offline biological recognition result is possibly hijacked and attacked in the non-secure environment transmission process is solved, so that the biological recognition security is further improved.

Description

A biometric security enhancement method and electronic device Technical Field

[0001] This invention relates to the field of user authentication, and more particularly to a biometric security enhancement method and electronic device. Background Technology

[0002] In related technologies, such as the Android system, biometric interfaces are often provided for upper-layer applications, such as face recognition, fingerprint recognition, and iris recognition. Through these system-provided interfaces, upper-layer applications can directly call or forward calls to the system's basic biometric interfaces via pre-packaged SDKs (Software Development Kits) for authentication. However, these biometric methods essentially trigger biometric information collection, input, and authentication results within a REE (Rich Execution Environment). Information collection and input can be intercepted due to attacks on the REE environment, and results can be obtained through deception due to REE attacks. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a biometric security enhancement method to prevent biometric verification results from being tampered with or forged by attacks on the REE layer during transmission to upper-layer applications, thereby improving the security of the identity verification process.

[0004] To address the aforementioned technical problems, the present invention provides a biometric security enhancement method applied to an Android system. The Android system runs a rich execution environment (REX), a secure virtual machine (VM), and a trusted execution environment (TEX). An upper-layer application runs on the REX. The method includes: the upper-layer application sending a biometric request to the VM; the VM receiving the biometric request displaying a biometric information collection interface and sending a request to the REX to acquire biometric information; the REX receiving the request and acquiring the biometric information, then sending the biometric information to the TEX; the TEX verifying the biometric information, obtaining and storing the verification result, and simultaneously sending the verification result to the VM through the REX; and the VM sending the verification result to the upper-layer application.

[0005] An electronic device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the biometric security enhancement method of claim 1.

[0006] The beneficial effects of this invention are as follows: This application runs a secure virtual machine, an upper-layer application, a rich execution environment (REA), and a trusted execution environment (TEX) on an Android system; the upper-layer application sends a biometric request to the secure virtual machine; after receiving the biometric request, the secure virtual machine displays a biometric information collection interface and sends a request to the REA to obtain biometric information; the REA receives the request to obtain biometric information, obtains the biometric information, and sends the biometric information to the TEX; the TEX verifies the biometric information, obtains and stores the verification result, and simultaneously sends the verification result to the secure virtual machine through the REA; the secure virtual machine sends the verification result to the upper-layer application. By displaying the biometric information collection interface in the secure virtual machine, information hijacking and forgery on the collection side are prevented; and by verifying biometric information in the TEX, secure verification of biometric information is ensured, solving the risk of hijacking attacks that may occur during the transmission of existing offline biometric results in insecure environments (REE), thereby further improving the security of biometrics. Attached Figure Description

[0007] Figure 1 is a flowchart of a biometric security enhancement method provided in an embodiment of the present invention; Figure 2 is a structural schematic diagram of an electronic device provided in an embodiment of the present invention; Figure 3 is a system architecture diagram of a biometric security enhancement method provided in an embodiment of the present invention. Detailed Implementation

[0008] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0009] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0010] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0011] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0012] The following are some terms related to this invention: AVF: Android Virtualization Framework, which provides a secure and private execution environment for code execution. AVF is well-suited for security-oriented use cases that require a higher level of security, or even formally verified isolation guarantees, than those provided by the Android application sandbox.

[0013] Secure Virtual Machine (pVM): A mutually untrusted, isolated execution environment (guest) that runs alongside the main Android operating system (host). pVM provides an isolated execution environment, allowing parts of an application to run with greater confidentiality and integrity than a regular Android environment.

[0014] Rich Execution Environment (REE). The primary operating system environment of the device; in this application, it refers to the Android system.

[0015] Trusted Execution Environment (TEE): A secure zone created through hardware isolation technology that coexists with the REE. In this application, it refers to a Trusted system.

[0016] Hardware Abstraction Layer (HAL): HAL is a lightweight embedded runtime environment that provides a simple device driver interface for user applications and underlying hardware.

[0017] TA: Trusted Application, which divides account information into multiple regions (Account Range) and stores shared account information across multiple applications.

[0018] Among related technologies, there are several types of multi-application account sharing solutions. One type is based on account sharing between system applications, such as Huawei's Settings, Music, and Video applications sharing login status. When one application logs in, other applications avoid entering their account login information upon startup. This provides an account sharing mechanism for the system's own applications from a customized system, and other third-party applications cannot share this mechanism. Another type involves third-party applications using the cross-application communication mechanism provided by the Android system to transmit and share logged-in account data across applications. This type of solution is more complex to implement in multiple applications and has insufficient security. It is possible that the shared account information could be intercepted or altered due to attacks on the REE environment.

[0019] In related technologies, biometrics is often used for offline identity verification, such as fingerprint recognition, facial recognition, and iris recognition. Biometric information collection and verification can be completed locally on the terminal. Application account logins are often combined with offline biometrics to facilitate user login or enhance login security. For example, when logging into an application, fingerprint login can replace password input for user convenience. Or, after logging in with an account, the application may need to further verify with fingerprints to enhance login security. However, the results of offline verification are often directly forwarded to the uploading application by the biometric service through the REE layer or directly returned to the upper-layer application by the basic biometric service. Although the TEE can protect biometric information and prevent its leakage, the REE is an insecure environment and may be subject to hijacking attacks. This means that the results provided to the upper-layer application by the REE layer service may be inaccurate when the REE system is attacked. This solution further ensures biometric security by implementing biometric collaboration within pVM (MicroDroid OS).

[0020] The following describes a biometric security enhancement method of the present invention, applied to an Android system. The Android system runs a rich execution environment, a secure virtual machine, and a trusted execution environment, on which an upper-layer application runs. In this invention, the collection of privacy information, such as facial images, is done with the individual's consent and is used only for legitimate purposes. A prominent privacy information collection warning is displayed, and the collection of privacy information is used only for legitimate purposes. Referring to Figure 1, the method includes steps 110 to 150: Step 110: The upper-layer application sends a biometric request to the secure virtual machine; wherein, the secure virtual machine refers to pVM, running MicroDroid OS.

[0021] Step 120: After receiving the biometric request, the secure virtual machine displays the biometric information collection interface and sends a request to the rich execution environment (pVM) to obtain biometric information. The biometric collaboration module on the secure virtual machine receives the biometric request and displays the biometric information collection interface, which has multiple collection functions, such as face recognition, fingerprint recognition, and iris recognition. Before displaying the biometric information collection interface, the system needs to obtain explicit consent through a user authorization process. A privacy statement prompt pops up in the secure virtual machine (pVM), requiring the user to confirm the collection behavior.

[0022] Step 130: The Rich Execution Environment (REE) receives and acquires the biometric information request, and sends the biometric information to the Trusted Execution Environment (REE). Step 140: The REE verifies the biometric information, obtains and stores the verification result, and simultaneously sends the verification result to the Secure Virtual Machine (VM) via the REE. Specifically, the REE sends the biometric identification parameters (TAs) of the REE to the biometric module on the REE, and then the biometric module (REE) sends the verification result to the biometric collaboration module on the Secure VM. Optionally, if verification fails, the verification result also includes the reason for the failure.

[0023] Step 150: The secure virtual machine sends the verification result to the upper-layer application. As described above, in this embodiment, the upper-layer application sends a biometric request to the secure virtual machine. After receiving the biometric request, the secure virtual machine displays a biometric information acquisition interface and sends a request to the rich execution environment (REA) to obtain biometric information. The REA receives the request and acquires the biometric information, then sends it to the trusted execution environment (REA). The REA verifies the biometric information, obtains and stores the verification result, and simultaneously sends the verification result to the secure virtual machine through the REA. The secure virtual machine then sends the verification result to the upper-layer application. By displaying the biometric information acquisition interface in the secure virtual machine, information hijacking and forgery on the acquisition side are prevented. Verifying biometric information in the REA ensures secure verification of biometric information, mitigating the risk of hijacking attacks on existing offline biometric results during transmission in an insecure environment (REE), thereby further enhancing the security of biometrics.

[0024] In one embodiment of this application, step 150, in which the secure virtual machine sends the verification result to the upper-layer application, includes: Step 210: The secure virtual machine sends a query request to the trusted execution environment and receives a copy of the verification result corresponding to the query request; Step 220: The secure virtual machine verifies whether the content of the verification result received from the trusted execution environment is consistent with the content of the copy of the verification result. If the content is consistent, it is determined that the verification has not been altered and has passed. The secure virtual machine then sends the verification result to the upper-layer application. For example, if the binary status of the verification result is 1 (indicating successful authentication), the binary status of the copy of the verification result is also 1. Because they are the same, it indicates that the content has not been tampered with, and the verification has passed. If the binary status of the verification result is 1, and the binary status of the copy of the verification result is 0, it indicates that the content has been tampered with, and the verification has failed.

[0025] As described above, this embodiment obtains a copy of the verification result from the trusted execution environment (REE) through a secure virtual machine and compares it with the verification result received from the rich execution environment (REA). After verification, the verification result is sent to the upper-layer application. The upper-layer application, through unified authentication with the pVM, changes from directly obtaining the result from the REE to obtaining the result from the pVM, thus avoiding obtaining a result that has been attacked and tampered with. This embodiment implements a dual verification mechanism, obtaining verification results from both the REA and the trusted execution environment, effectively preventing the verification result from being tampered with during transmission, ensuring the integrity and credibility of the verification result corresponding to the biometric information, and further enhancing the security of the verification process through the trusted execution environment.

[0026] In one embodiment of this application, step 140, where the trusted execution environment verifies the biometric information, obtains the verification result, and stores it, includes: Step 310: The trusted execution environment verifies the biometric information and obtains the verification result; specifically, the biometric TAs on the TEE verify the biometric information and obtain the verification result. The verification result refers to the judgment result generated by the TEE after performing feature extraction and matching calculation on the biometric information (such as fingerprints, faces, irises), for example: a binary state (e.g., "1" indicates successful verification, "0" indicates failed verification). Optionally, the verification result can also be structured data including detailed identity identifiers.

[0027] Step 320: The Trusted Execution Environment (TEE) copies and stores the verification result as a new file, serving as a copy of the verification result; that is, the TEE stores the verification result in the Unified Identity (TA) within the TEE.

[0028] In step 210, the secure virtual machine sends a query request to the trusted execution environment and receives a copy of the verification result corresponding to the query request. This includes: the secure virtual machine sending a query request to the trusted execution environment; the trusted execution environment reading the stored copy of the verification result and sending it to the secure virtual machine. As described above, in this embodiment, after verifying bioinformation through the trusted execution environment, a verification result is generated and a copy of the verification result is created and stored in the trusted execution environment. When the secure virtual machine sends a query request, the trusted execution environment directly reads and returns the copy of the verification result, thus achieving isolated storage and secure transmission of bioinformation verification results. This avoids malicious tampering of the original verification data and ensures data consistency and reliability of the verification results during cross-environment transmission through the copy mechanism.

[0029] In one embodiment of this application, in step 130, the rich execution environment receives a request to acquire biometric information and acquires the biometric information, including: step 410: after receiving the request to acquire biometric information, the rich execution environment sends a collection request to the hardware abstraction layer of the Android system; wherein, the biometric module on the REE calls the corresponding basic biometric services, such as: face recognition basic service / fingerprint recognition basic service / iris recognition basic service.

[0030] Step 420: The rich execution environment receives the biometric information corresponding to the acquisition request collected by the hardware abstraction layer; specifically, the biometric basic service communicates with the HAL layer and collects the corresponding biometric information. Biometric information refers to raw biometric data collected from the hardware abstraction layer (HAL), such as face images, fingerprint grayscale images, or iris feature points.

[0031] As described above, this embodiment receives a request to acquire biometric information through a rich execution environment. The biometric module then calls a specific biometric basic service to send a collection request to the Android system hardware abstraction layer. Biometric information is collected through communication and interaction between the biometric basic service and the hardware abstraction layer. This achieves unified interface support for different types of biometric features (such as face, fingerprint, and iris), improves the compatibility and scalability of the biometric system, and reduces system coupling through modular design.

[0032] In one embodiment of this application, the secure virtual machine displays a biometric information collection interface after receiving a biometric request, including: step 510: the secure virtual machine receives a biometric request; step 520: the secure virtual machine performs permission verification on the upper-layer application, and if the permission verification is successful, displays the biometric information collection interface; specifically, the unified identity recognition API module in the pVM, after receiving the biometric request, The permission management module verifies whether the upper-layer application has the necessary permissions to access biometric data. If the permission verification is successful, the biometric collaboration module responds and executes the biometric request selected by the user. Based on the user's biometric request, different biometric information collection pages are displayed, such as face collection, fingerprint collection, and iris collection.

[0033] As described above, this embodiment implements pre-access control for biometric operations, effectively preventing unauthorized applications from illegally accessing biometric data. At the same time, it ensures flexible adaptation to various biometric methods and unified interface management through a modular collaboration mechanism.

[0034] In one embodiment of this application, in step 120, the secure virtual machine performs permission verification on the upper-layer application. If the permission verification is successful, the biometric information collection interface is displayed. This includes: Step 610: The secure virtual machine sends an authentication request to the trusted execution environment. The authentication request includes a signature certificate and an application identity identifier. Step 620: The trusted execution environment compares the signature certificate in the authentication request with the pre-stored administrator signature certificate corresponding to the application identity identifier. If they match, the trusted execution environment sends the application identity of the upper-layer application to the secure virtual machine as the administrator application corresponding to the application identity identifier. Step 630: The secure virtual machine verifies the calling permission of the administrator application. If the permission verification is successful, the biometric information collection interface is displayed. As can be seen from the above description, this embodiment sends an authentication request containing a signature certificate and an application identity identifier to the trusted execution environment through the secure virtual machine. The trusted execution environment compares and verifies the signature certificate with the pre-stored administrator signature certificate. After confirming the application identity, it returns the administrator application identifier. The secure virtual machine verifies the calling permission based on this identifier and then displays the biometric information collection interface. This realizes a dual identity authentication mechanism based on digital certificates, ensuring that only administrator applications verified by the trusted environment can trigger the biometric information collection process, effectively improving the security access level.

[0035] In one embodiment of this application, after the rich execution environment receives the request to acquire biometric information and acquires the biometric information in step 130, the method further includes: step 710: the rich execution environment sends the acquired biometric information to the secure virtual machine; step 720: the secure virtual machine updates the biometric information acquisition interface according to the received biometric information; specifically, the acquired biometric information is transmitted by the biometric module of the rich execution environment to the biometric collaboration module of the secure virtual machine, and the biometric information acquisition interface is updated according to the acquired biometric information, such as a face preview interface / fingerprint matching interface.

[0036] As described above, this embodiment transmits the collected biometric information to the biometric collaboration module of the secure virtual machine through a rich execution environment, and updates the biometric information collection interface in real time according to the received biometric information, so that users can view the collection status immediately, effectively improving the real-time interactivity of the biometric process.

[0037] In one embodiment of this application, the method further includes: step 810: the upper-layer application establishes a secure channel from the upper-layer application to the secure virtual machine; step 820: the upper-layer application sends a biometric request to the secure virtual machine through the secure channel; as described above, this embodiment establishes a secure channel from the upper-layer application to the secure virtual machine and transmits the biometric request through the secure channel, thereby realizing an encrypted communication link between the application layer and the secure virtual machine, preventing the biometric request from being stolen or tampered with during transmission, and improving security and data transmission reliability.

[0038] In one embodiment of this application, step 810, where the upper-layer application establishes a secure channel to the secure virtual machine, includes: step 910: the upper-layer application sends a virtual machine authentication request to the secure virtual machine through the rich execution environment; step 920: the secure virtual machine uses its private key to digitally sign the virtual machine authentication request, generating a digital signature; step 930: the secure virtual machine combines the virtual machine authentication request and the digital signature to generate an identity credential and sends it to the rich execution environment; specifically, the unified identity recognition management module in the pVM receives the request, uses the private key created when the pVM was created, and signs the "request content + timestamp + random number" to generate an identity credential. The credentials include: a unique identifier for the pVM, a timestamp of the request, a random number, and the version information of the Microdroid OS; Step 940: After receiving the identity credentials, the rich execution environment uses the public key of the secure virtual machine to verify the legality of the digital signature in the identity credentials. If it is legal, it determines whether the virtual machine authentication request in the identity credentials is the same as the generated virtual machine authentication request. If so, a secure channel is established; As described above, this embodiment sends an authentication request to the secure virtual machine through the rich execution environment via the upper-layer application. The secure virtual machine uses its private key to digitally sign the request content containing the timestamp and random number to generate an identity credential containing a unique identifier and system version information. The rich execution environment uses its public key to verify the legality of the signature and establishes a secure channel after comparing the consistency of the request. This realizes a two-way identity authentication mechanism based on asymmetric encryption. The combination of timestamp and random number effectively prevents replay attacks, ensures the authenticity of the identities of both communicating parties and the tamper-proof nature of the channel establishment process, and improves the security level of cross-environment communication.

[0039] Please refer to Figure 3 to apply the above-mentioned biometric security enhancement method to a real-world scenario, including steps a to j: Step a: The upper-layer application requests the required login method, biometrics (face recognition / fingerprint recognition / iris recognition, etc.), through the unified identity recognition API module's unified identity recognition interface.

[0040] Step b: The application initiates a call request through the Unified Identity API module (located in REE), or directly from the Unified Identity API module (located in pVM). This corresponds to step 110.

[0041] Step c: After receiving a biometric request, the Unified Identity API module (located in pVM) verifies whether the application has permission to invoke biometrics through the permission management module.

[0042] Step d: If the permission verification is successful, the biometrics collaboration module will respond and execute the biometrics request selected by the user.

[0043] Step e: The biometric collaboration module (pVM), upon receiving a biometric request, displays a biometric information collection interface, such as face collection / fingerprint collection / iris collection. This corresponds to step 120.

[0044] Step f: The biometric collaboration module (pVM) requests biometrics from the biometric module (REE). The biometric module (REE) invokes the corresponding basic biometric services (face recognition basic service / fingerprint recognition basic service / iris recognition basic service) to initiate the biometric request. The basic biometric services communicate with the HAL layer to collect the corresponding biometric information. This corresponds to step 130.

[0045] Step g: The collected biometric information is transmitted from the biometric module (REE) to the biometric system module, and the biometric information collection interface is updated based on the acquired data (such as the face preview interface / fingerprint matching interface).

[0046] Step h: The system's basic biometric service (REE) interacts with the TEE's biometric TAs according to the identified information and existing procedures to complete the biometric verification. The TEE sends the biometric authentication result to the unified identity TA. The TEE's biometric TAs return the verification result to the TEE's biometric module. The biometric module sends the result back to the biometric collaboration module (pVM). This corresponds to step 140.

[0047] Step i: After receiving the identification result forwarded by the biometric module, the biometric collaboration module (pVM) interacts with the unified identity identification TA (located in the TEE) to query whether the result obtained by the unified identity identification TA is consistent. This ensures that the result returned by the REE biometric basic service has not been tampered with.

[0048] Step j: The biometric collaboration module (pVM) returns the result to the upper-layer application through the secure channel from the upper-layer application to the pVM. This corresponds to step 150.

[0049] Referring to Figure 2, the present invention also provides an electronic device 400, including a memory 402 and a processor 401, and a computer program stored in the memory 402 and running on the processor 401. When the processor 401 executes the computer program, it implements the various steps in the biometric security enhancement method described above.

[0050] The beneficial effects of the electronic device of the present invention are the same as those of the method described above, and will not be repeated here.

[0051] In summary, this invention provides a biometric security enhancement method and electronic device. An upper-layer application sends a biometric request to a secure virtual machine (VM). Upon receiving the biometric request, the VM displays a biometric information acquisition interface and sends a request to a rich execution environment (REA) to acquire biometric information. The REA receives the request, acquires the biometric information, and sends it to a trusted execution environment (REA). The REA verifies the biometric information, obtains and stores the verification result, and simultaneously sends the verification result back to the VM via the REA. The secure VM then sends the verification result back to the upper-layer application. By displaying the biometric information acquisition interface in the secure VM, information hijacking and forgery on the acquisition side are prevented. Verifying biometric information in the REA ensures secure verification of biometric information and addresses the risk of hijacking attacks during transmission of existing offline biometric results in insecure environments (REEs), thereby further enhancing biometric security. After verifying biometric information through a trusted execution environment (TEA), a verification result is generated and a copy of the result is stored in the TEA. When a secure virtual machine sends a query request, the TEA directly reads and returns the copy of the verification result. This achieves isolated storage and secure transmission of biometric verification results, preventing malicious tampering of the original verification data. Simultaneously, the copy mechanism ensures data consistency and reliability during cross-environment transmission of the verification results. This allows the implementation of key logic such as facial recognition data acquisition and verification using native Android mechanisms, and also helps prevent information hijacking and forgery on the acquisition side through collaboration.

[0052] The above are merely embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention's specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A biometric security enhancement method, characterized in that, An application is provided for an Android system, wherein a rich execution environment (REX), a secure virtual machine (VM), and a trusted execution environment (TEX) run on the REX system, and an upper-layer application runs on the REX system. The method includes: the upper-layer application sending a biometric request to the VM; the VM receiving the biometric request and displaying a biometric information collection interface, and sending a request to the REX to obtain biometric information; the REX receiving the request and obtaining the biometric information, and sending the biometric information to the TEX; the TEX verifying the biometric information, obtaining and storing the verification result, and simultaneously sending the verification result to the VM through the REX; and the VM sending the verification result to the upper-layer application.

2. The biometric security enhancement method according to claim 1, characterized in that, The secure virtual machine sends the verification result to the upper-layer application, including: the secure virtual machine sends a query request to the trusted execution environment and receives a copy of the verification result corresponding to the query request; the secure virtual machine verifies whether the content of the verification result received from the rich execution environment is consistent with the content of the verification result copy; if the content is consistent, the verification passes, and the secure virtual machine sends the verification result to the upper-layer application.

3. The biometric security enhancement method according to claim 2, characterized in that, The trusted execution environment verifies the biological information, obtains a verification result, and stores it, including: the trusted execution environment verifies the biological information and obtains a verification result; the trusted execution environment copies and stores the verification result as a new file, serving as a copy of the verification result; the secure virtual machine sends a query request to the trusted execution environment and receives the copy of the verification result corresponding to the query request, including: the secure virtual machine sends a query request to the trusted execution environment; the trusted execution environment reads the stored copy of the verification result and sends it to the secure virtual machine.

4. The biometric security enhancement method according to claim 1, characterized in that, The rich execution environment (REA) receiving the request to acquire biological information and acquiring the biological information includes: after receiving the request to acquire biological information, the REA sends a collection request to the hardware abstraction layer of the Android system; the REA receives the biological information corresponding to the collection request collected by the hardware abstraction layer.

5. The biometric security enhancement method according to claim 1, characterized in that, The secure virtual machine displays a biometric information collection interface after receiving the biometric request, including: the secure virtual machine receiving the biometric request; the secure virtual machine performing permission verification on the upper-layer application, and if the permission verification is successful, displaying the biometric information collection interface.

6. The biometric security enhancement method according to claim 5, characterized in that, The secure virtual machine performs permission verification on the upper-layer application. If the permission verification is successful, a biometric information collection interface is displayed. This includes: the secure virtual machine sending an authentication request to the trusted execution environment, the authentication request including a signature certificate and an application identity identifier; the trusted execution environment comparing the signature certificate in the authentication request with a pre-stored administrator signature certificate corresponding to the application identity identifier; if they match, the trusted execution environment sending the application identity of the upper-layer application to the secure virtual machine as the administrator application corresponding to the application identity identifier; and the secure virtual machine verifying the calling permissions of the administrator application. If the permission verification is successful, a biometric information collection interface is displayed.

7. The biometric security enhancement method according to claim 1, characterized in that, After receiving the request to acquire biological information and acquiring the biological information, the rich execution environment further includes: the rich execution environment sending the acquired biological information to the secure virtual machine; and the secure virtual machine updating the biological information acquisition interface based on the received biological information.

8. The biometric security enhancement method according to claim 1, characterized in that, Also includes: The upper-layer application establishes a secure channel from the upper-layer application to the secure virtual machine; The upper-layer application sends the biometric request to the secure virtual machine through the secure channel.

9. A biometric security enhancement method according to claim 8, characterized in that, The upper-layer application establishes a secure channel to the secure virtual machine, including: the upper-layer application sending a virtual machine authentication request to the secure virtual machine through the rich execution environment; the secure virtual machine using its private key to digitally sign the virtual machine authentication request, generating a digital signature; the secure virtual machine combining the virtual machine authentication request and the digital signature to generate an identity credential and sending it to the rich execution environment; after receiving the identity credential, the rich execution environment using the secure virtual machine's public key to verify the legality of the digital signature in the identity credential; if legal, it determines whether the virtual machine authentication request in the identity credential is the same as the generated virtual machine authentication request; if so, a secure channel is established.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the biometric security enhancement method according to any one of claims 1 to 9.

Images