A digital wallet security creation method and device and electronic equipment

Abstract

This invention relates to the field of virtualization framework technology, and more particularly to a secure digital wallet creation method, apparatus, and electronic device. The method includes: responding to a received wallet creation request, creating and starting a protected virtual machine, and configuring the protected virtual machine to disable network connectivity; performing environment initialization operations within the protected virtual machine; generating a mnemonic phrase within the protected virtual machine, obtaining a mnemonic phrase sequence composed of the mnemonic phrase, and displaying a mnemonic phrase verification interface; responding to a successful verification result from the mnemonic phrase verification interface, generating a key seed based on the mnemonic phrase sequence; performing fragmented encryption on the key seed, storing the encrypted seed fragments in a trusted execution environment, an independent storage area of ​​the protected virtual machine, and an application private sandbox within a rich execution environment; and completing the digital wallet creation process using the seed fragments. This enhances the security of the wallet creation and usage process, and ensures the security of wallet data such as private keys and mnemonic phrases.

Description

Technical Field

[0001] This invention relates to the field of virtualization framework technology, and in particular to a method, apparatus and electronic device for securely creating a digital wallet. Background Technology

[0002] With the booming development of the cryptocurrency and digital currency market, existing technical solutions mainly divide wallets into decentralized wallets and centralized wallets based on the custodian entity. Among them, mainstream decentralized software wallets mostly use the main operating system of mobile phones or computers, namely the Rich Execution Environment (REE), as the core running carrier. The key operations of wallet such as private key or mnemonic phrase generation, seed encryption storage, and transaction signing are all completed in the REE layer. Specifically, the mnemonic phrase is generated by the device hardware random number generator, and after the master seed is derived, it is encrypted and stored in the app's private sandbox directory. The interaction is completed by the input and UI rendering components of the REE layer. The protection is only improved by software means such as disabling system screenshots, detecting root permissions or jailbreak status, and local password encryption, without involving hardware-level isolation.

[0003] However, this solution suffers from an irreconcilable technical contradiction: while the openness of the REE layer satisfies the ease-of-use requirements for wallet multi-chain adaptation and decentralized application (DApp) interaction, its highly shared system resources mean that relying solely on software protection cannot eliminate security risks. The root of the problem lies in the lack of necessary isolation mechanisms within the REE layer as an open environment. This leads to vulnerabilities in the underlying system, such as input interception (e.g., malicious input methods stealing mnemonic phrases), interface hijacking (e.g., overlay spoofing input interfaces), and the theft of storage files on rooted devices (e.g., privilege escalation processes reading encrypted seeds). These vulnerabilities make private keys and signature data extremely vulnerable to attacks during processing, seriously threatening the security of digital assets. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a secure digital wallet creation method, device and electronic device to enhance the security of the wallet creation and use process, protect the security of wallet data such as private keys and mnemonic phrases, and avoid leakage of critical data.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A secure digital wallet creation method, applied to an electronic device, wherein a rich execution environment and a trusted execution environment run on the electronic device, the method comprising: In response to the received wallet creation request, a protected virtual machine is created and started, and the protected virtual machine is configured to disable network connectivity; Perform environment initialization operations in the protected virtual machine, including disabling the system input method, clipboard, and screen capture / recording functions; Generate a mnemonic phrase in the protected virtual machine, obtain the mnemonic phrase sequence composed of the mnemonic phrase, and display the mnemonic phrase verification interface; In response to the successful verification result of the mnemonic phrase verification interface, a key seed is generated based on the mnemonic phrase sequence; The key seed is fragmented and encrypted, and the encrypted seed fragments are stored in the trusted execution environment, the independent storage area of ​​the protected virtual machine, and the application private sandbox of the rich execution environment, respectively. The digital wallet creation process is completed using the seed fragment ciphertext.

[0006] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A secure digital wallet creation device, comprising: The rich execution environment module is used to respond to the received wallet creation request, request the creation and start of a protected virtual machine, and receive user interaction instructions or wallet creation status information for display. The protected virtual machine side module runs in the protected virtual machine and is used to perform environment initialization operations, including disabling the system input method, clipboard, and screen recording functions; generating mnemonic phrases, obtaining the order of mnemonic phrases and displaying the mnemonic phrase verification interface; and generating a key seed based on the verified mnemonic phrases. The key storage processing module is used to perform fragmented encryption processing on the key seed, and store the encrypted seed fragments in the trusted execution environment, the independent storage area of ​​the protected virtual machine, and the application private sandbox of the rich execution environment.

[0007] An electronic device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the digital wallet secure creation method of claim 1.

[0008] The beneficial effects of this invention are as follows: In response to a wallet creation request, this invention creates and starts a protected virtual machine configured to disable network connectivity. This protected virtual machine constructs a closed, isolated execution environment, cutting off connection to the external network. Compared to existing technologies that run directly at the REE layer, this invention achieves environmental isolation at the runtime level, effectively blocking network-side attack paths and significantly improving the security of the runtime environment. This invention performs environment initialization operations within the protected virtual machine, disabling system input methods, clipboard, and screen recording / screenshot functions. This setting closes the data leakage channel at the system level, effectively preventing malicious input methods from stealing mnemonic phrases and malicious programs from obtaining sensitive information through screen recording / screenshots. Compared to existing technologies that rely solely on software for protection, this invention eliminates security risks during interface interaction through access control of the virtualized environment. This invention generates mnemonic phrases within the protected virtual machine and generates key seeds based on these phrases. Because the protected virtual machine has isolation properties, the generation process of critical data is within a protected space, preventing malicious processes at the REE layer from reading or tampering with memory data, ensuring the security of the private key source generation. Existing technologies typically store the encryption seed in an application-private sandbox within the REE layer, making the file vulnerable to theft when root access is gained. This invention employs fragmented encryption of the key seed, storing the encrypted seed fragments separately in a trusted execution environment (TEA), a protected virtual machine's independent storage area, and the REE's application-private sandbox. Compared to existing technologies that rely solely on software encryption within the REE sandbox, this invention ensures that even if the REE layer suffers a root privilege escalation attack leading to the theft of the sandbox file, the attacker cannot access the fragments stored in the TEA and the protected virtual machine, thus preventing the reconstruction of the complete key seed. This achieves secure storage of the private key and signature data within the REE layer, enhancing the security of wallet creation and usage, protecting wallet data such as the private key and mnemonic phrase, and preventing the leakage of critical data. Attached Figure Description

[0009] Figure 1 A flowchart illustrating the steps of a secure digital wallet creation method provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0010] Figure 3 This is a system architecture diagram of a secure digital wallet creation method provided in an embodiment of the present invention.

[0011] Figure 4 This is a timing diagram of a secure digital wallet creation method provided in an embodiment of the present invention.

[0012] Figure 5 This invention provides a process for generating, verifying, and encrypting the mnemonic phrase for a secure digital wallet creation method.

[0013] Figure 6 This is an example diagram of a mnemonic phrase generation interface for a secure digital wallet creation method provided in an embodiment of the present invention.

[0014] Figure 7 This is an example diagram of a mnemonic phrase backup interface for a digital wallet secure creation method provided in an embodiment of the present invention.

[0015] Figure 8 This is an example diagram of a mnemonic phrase verification interface for a digital wallet secure creation method provided in an embodiment of the present invention. Detailed Implementation

[0016] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0017] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0018] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0019] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0020] The following describes the relevant terms used in this invention: AVF: The Android Virtualization Framework (AVF) provides a secure and private execution environment for code execution. AVF is well-suited for security-oriented use cases that require a higher level of security, or even formally validated isolation guarantees, than those provided by the Android application sandbox.

[0021] Protected Virtual Machine (pVM): A mutually untrusted, isolated execution environment (guest) that runs alongside the main Android operating system (host). pVM provides an isolated execution environment, allowing parts of an application to run with greater confidentiality and integrity than a regular Android environment.

[0022] Rich Execution Environment (REE). The primary operating system environment of the device; in this application, it refers to the Android system.

[0023] Trusted Execution Environment (TEE): A secure zone created through hardware isolation technology that coexists with the REE. In this application, it refers to a Trusted system.

[0024] pVM Wallet Isolation Sandbox: The pVM Wallet Isolation Sandbox is a highly isolated and secure container running within Protected VM (pVM), specifically designed to provide code and data security protection for wallet applications (such as payment apps and cryptocurrency wallets).

[0025] Independent Storage Area: The independent storage area of ​​a protected virtual machine (pVM) is an encrypted, isolated, persistent storage space allocated and managed by the Android Virtualization Framework (AVF) for each pVM instance. It belongs exclusively to and can only be accessed by the corresponding pVM instance. It is part of the pVM runtime environment and is used to provide secure local data storage for applications within the pVM. This storage area is independent of the Rich Execution Environment (REE), other pVM instances, other processes within the same pVM, and other wallet applications. The AVF mechanism ensures its independence from the host system and other pVMs, while also achieving isolation from other processes and wallets within the same pVM through wallet ID identification and access control.

[0026] SE stands for Secure Element, an independent hardware security module that provides hardware-level isolation and tamper-proof protection for storing highly sensitive data such as keys and payment credentials.

[0027] Linux Container: An operating system-level virtualization technology that allows multiple independent Linux systems (containers) to run on a single Linux host. It achieves process and resource isolation through features such as kernel namespaces and control groups (cgroups), giving each container its own independent file system, network, process space, etc., but sharing the host kernel, making it more lightweight and faster to start than traditional virtual machines.

[0028] The following describes in detail a secure digital wallet creation method of the present invention, applied to electronic devices, on which a rich execution environment and a trusted execution environment are run, as shown in the appendix. Figure 1 ,include: Step 110: In response to the received wallet creation request, create and start a protected virtual machine, and configure the protected virtual machine to disable network connectivity. The wallet creation request is generated when the user clicks "Create New Wallet" in the rich execution environment (REE) of the wallet app. The rich execution environment is a regular execution environment (REE) that runs the non-sensitive parts of the wallet app. The trusted execution environment (TEE) is a secure execution environment that provides hardware-level security protection. The protected virtual machine is a pVM (secure virtual machine), created via the AVF mechanism and running in an isolated sandbox. Disabling network connectivity means that no network configuration is added during pVM creation, preventing pVM from connecting to the network. Optionally, in response to the received wallet creation request, create and start a virtual container; perform environment initialization operations within the virtual container (e.g., LXC, Linux Container).

[0029] Step 120: Perform environment initialization operations in the protected virtual machine. These operations include disabling the system input method, clipboard, and screen capture / recording functions. This environment initialization is performed within the pVM to enhance security. It disables the sandbox isolation via the pVM wallet and disables pVM-layer interference items, including disabling the system input method, floating window, clipboard, and system screenshot / recording.

[0030] Step 130: Generate a mnemonic phrase in the protected virtual machine, obtain the mnemonic phrase sequence, and display the mnemonic phrase verification interface. The mnemonic phrase is a sequence of words generated by random numbers, used for wallet backup and recovery, for example, 12 words in random order. The mnemonic phrase sequence is a sequence of mnemonic phrases arranged in order. The mnemonic phrase verification interface is used to verify whether the user has correctly backed up the mnemonic phrase, displaying the randomized mnemonic phrase for user verification.

[0031] Step 140: In response to the successful verification result of the mnemonic phrase verification interface, a key seed is generated based on the mnemonic phrase sequence. The key seed is generated from the mnemonic phrase using key derivation technology and is used to derive the key seed, public and private keys, and address from the mnemonic phrase. Key derivation technologies include the BIP39 / BIP32 / BIP44 standards. The derivation is performed within the cryptographic module of the AVF encrypted memory.

[0032] Step 150: The key seed is fragmented and encrypted. The encrypted seed fragment ciphertext is stored separately in the Trusted Execution Environment (TVM), the independent storage area of ​​the protected virtual machine (pVM), and the application private sandbox of the Rich Execution Environment (REE). Based on the seed fragment ciphertext, the wallet private key is derived. The wallet private key is used for wallet recovery or transaction signature verification. The fragment encryption process involves splitting the key seed into multiple fragments and encrypting each fragment. The seed fragment ciphertext is the encrypted seed fragment. The TVM is used to store the encrypted seed fragment ciphertext. The application private sandbox of the REE is the private storage area of ​​the wallet app on the REE side, used to store the seed fragment ciphertext bound to the trusted root. The independent storage area of ​​the protected virtual machine (pVM) is an encrypted, isolated, persistent storage space allocated and managed by the Android Virtualization Framework (AVF) for each pVM instance.

[0033] Step 160: Complete the digital wallet creation process using the seed fragment ciphertext; the digital wallet creation process involves creating the wallet, including generating a mnemonic phrase, a key seed, and storing the fragments.

[0034] As described above, in response to a wallet creation request, this embodiment creates and starts a protected virtual machine configured to disable network connectivity. This protected virtual machine constructs a closed, isolated execution environment, cutting off connection to the external network. This embodiment achieves environmental isolation at the runtime level, effectively blocking network-side attack paths and significantly improving the security of the runtime environment. This embodiment performs environment initialization operations within the protected virtual machine, disabling system input methods, clipboard, and screen recording / screenshot functions. This setting closes the data leakage channel at the system level, effectively preventing malicious input methods from stealing mnemonic phrases and malicious programs from obtaining sensitive information through screen recording / screenshots. Through permission control of the virtualized environment, security risks during interface interaction are eliminated. A mnemonic phrase is generated within the protected virtual machine, and a key seed is generated based on it. Because the protected virtual machine has isolation properties, the generation process of critical data is within a protected space, preventing malicious processes at the REE layer from reading or tampering with memory data, ensuring the security of the private key source generation. This invention employs fragmented encryption of the key seed, storing the encrypted seed fragments separately in a trusted execution environment (TEA), a protected virtual machine's independent storage area, and an application-private sandbox within the REE. Even if the REE layer suffers a root privilege escalation attack leading to the theft of the sandbox file, the attacker cannot access the fragments stored in the TEA and the protected virtual machine, thus preventing the reconstruction of the complete key seed. This achieves secure storage of the private key and signature data within the REE layer, effectively safeguarding digital asset security.

[0035] In one embodiment of this application, step 110, creating and starting the protected virtual machine, includes: Step 210: Create a protected virtual machine; Step 220: Initialize AVF encrypted memory in the protected virtual machine and configure it to be accessible only to the protected virtual machine. AVF encrypted memory is encrypted memory initialized using the AVF mechanism; it is accessible only to the pVM and cannot be read by the REE. Allowing only protected virtual machines to access it is the access permission setting for AVF encrypted memory, ensuring that only the pVM can access it.

[0036] As described above, this embodiment establishes a robust memory isolation barrier between the pVM and the REE by restricting access to AVF encrypted memory to only protected virtual machines. This embodiment cuts off the path for the REE to access pVM memory at the hardware or underlying mechanism level, effectively preventing sensitive data from being illegally read or tampered with at the memory level, thereby significantly improving the data security and confidentiality of the virtual machine runtime environment.

[0037] In one embodiment of this application, step 130, before generating the mnemonic phrase in the protected virtual machine, further includes: Step 310: Write the device's first unique identifier, the protected virtual machine's second unique identifier, and the third unique identifier obtained from the wallet creation request into the trusted execution environment. The device's first unique identifier is its hardware unique identifier, such as CPUID (CPU Identification). The protected virtual machine's second unique identifier is the pVM's unique identifier, such as CID (Context Identifier). The third unique identifier is the wallet ID, generated by a random number hash.

[0038] Step 320: Perform a hash operation on the first unique identifier, the second unique identifier, and the third unique identifier in the trusted execution environment to generate a composite trusted root. The hash operation involves calculating a fixed-length hash value from the input data using a hash function. The composite trusted root is a three-in-one trusted root (composite trusted root) generated by hashing the device unique identifier, the pVM CID, and the wallet ID. The device unique identifier represents the hardware environment, the CID represents the pVM system environment, and the wallet ID refers to the unique identifier of the wallet instance formed by hashing a random number generated by the TEE / SE during wallet creation. Specifically, multiple wallet instances are created within the same wallet app, each with a unique wallet ID. The wallet ID is used to distinguish different wallet accounts under the same wallet app. The first unique identifier, the second unique identifier, and the third unique identifier are combined and a hash value is calculated as the composite trusted root. If any of the three environments change (e.g., the identifier is tampered with), the trusted root verification will fail when performing sensitive operations, requiring the user to re-confirm the environment and update the wallet trusted root. This anchors the legitimate environment and ensures the security of the entire sensitive operation environment.

[0039] Step 330: Store the composite root of trust through a trusted execution environment; As described above, this embodiment generates and stores a composite root of trust containing identifiers for the device, virtual machine, and wallet application. This composite root of trust is verified before mnemonic phrase generation and display, key seed derivation and fragmented encrypted storage, and wallet transaction signing operations. This embodiment ensures that sensitive operations must be performed in a legitimate environment where the hardware, system, and application all match. If any level of the environment identifier changes or is tampered with, the verification of the composite root of trust will fail, effectively preventing security risks caused by environment migration or illegal tampering, and improving the security and trustworthiness of the mnemonic phrase generation and wallet creation process.

[0040] In one embodiment of this application, it further includes: Step 410: Send a random number retrieval request to the Trusted Execution Environment (TEE / SE) through the protected virtual machine; wherein, the random number retrieval request is a request to the TEE / SE to generate random numbers.

[0041] Step 420: Receive a random number returned by the Trusted Execution Environment (TEE) through the protected virtual machine, and perform a hash operation on the random number to generate a third unique identifier; the random number is generated by the TEE / SE. Destroying the random number involves deleting it from the pVM, retaining only the hashed wallet ID.

[0042] Step 430: Store the third unique identifier in the application's private sandbox of the rich execution environment and destroy the random number in the protected virtual machine; where the layer stack is a layer stack managed by SurfaceFlinger and used to display the UI.

[0043] As described above, this embodiment achieves the immediate destruction of sensitive data after use by generating the identifier in a protected virtual machine and then immediately destroying the original random number. This embodiment not only utilizes a trusted execution environment to ensure the entropy and quality of the random number, but also eliminates the possibility of reverse derivation by destroying the original data, effectively preventing the risk of key leakage due to memory snapshots or data residues, and further enhancing the security of wallet identifier generation.

[0044] In one embodiment of this application, step 130 involves displaying a mnemonic phrase verification interface, including: Step 510: Query the layer stack in real time through the protected virtual machine; Step 520: If an unprotected virtual machine layer is superimposed on a protected virtual machine layer in the layer stack, or if the mnemonic phrase verification interface loses input focus, it is determined that the mnemonic phrase verification interface has been hijacked, and a warning watermark is displayed on the mnemonic phrase verification interface. The unprotected virtual machine layer is the UI layer of the REE side or other applications. The protected virtual machine layer is the UI layer of the pVM side wallet app. Hijacking of the mnemonic phrase verification interface is determined when a non-pVM layer is superimposed on a pVM layer, or when the mnemonic phrase verification interface loses input focus. The warning watermark is a warning watermark displayed on the interface to remind users that the user interface may have been hijacked. Input focus is the state in which the UI interface receives user input.

[0045] As described above, this embodiment actively monitors the layer stack and input focus through a protected virtual machine, enabling real-time identification of interface hijacking attacks. Upon detecting abnormal layer overlays or focus loss, this embodiment immediately issues a clear warning to the user via a watermark. This effectively prevents users from inputting sensitive information into maliciously hijacked interfaces, improving security and user awareness during the mnemonic phrase verification process.

[0046] In one embodiment of this application, it further includes: Step 610: Display the mnemonic phrases in a randomized order in the protected virtual machine; the randomized mnemonic phrases are displayed after the order of the mnemonic phrases has been shuffled to increase security.

[0047] Step 620: Listen to input signals; wherein, input signals include input signals recorded by "hardware physical buttons" or "non-touch input interfaces", for example, the input signal of the volume button refers to the input signal generated by the user pressing the volume button.

[0048] Step 630: Based on the input signal, sequentially select the target mnemonic word from the randomly arranged mnemonic words for verification; where sequential selection means selecting mnemonic words in order. The target mnemonic word is the correct mnemonic word that the user needs to verify. For example, the user uses the volume + / - buttons, and the sequential selection module allows the user to select the sequence mapped to the target word order by switching the volume keys, thereby avoiding the mnemonic word being intercepted by listening to the click coordinates.

[0049] As described above, this embodiment changes the traditional touchscreen click selection method by displaying the mnemonic phrase in random order and using volume keys as the input medium. This embodiment effectively avoids the risks of input hijacking and eavesdropping based on screen interaction by utilizing hardware button operation and dynamic random arrangement. It enhances the interactive security of the mnemonic phrase verification process and prevents the leakage of sensitive information due to input method defects.

[0050] In one embodiment of this application, step 150 involves fragmenting and encrypting the key seed, storing the encrypted seed fragments in a trusted execution environment, a protected virtual machine's independent storage area, and an application-private sandbox within a rich execution environment, including: Step 710: Split the key seed into multiple seed fragments; where seed fragments are the fragments after splitting the key seed.

[0051] Step 720: Encrypt multiple seed fragments using the user-inputted protection password to obtain seed fragment ciphertext; where the protection password is the password entered by the user and used to encrypt the seed fragments. Encryption is the process of encrypting the seed fragments using the protection password.

[0052] Step 730: The seed fragment ciphertext of the first part is sent to the Trusted Execution Environment for hardware-encrypted storage; the second part of the fragment is stored in the independent storage area of ​​the protected virtual machine; and the third part of the fragment is associated with a pre-generated trusted root and stored in the application's private sandbox of the Rich Execution Environment. The hardware-encrypted storage refers to storing the seed fragment ciphertext in the hardware-encrypted area of ​​the TEE / SE. Each of the first, second, and third parts includes at least one seed fragment ciphertext.

[0053] As described above, this embodiment processes the key seed through fragmentation, encryption, and distributed storage across security domains. The key seed is broken down into multiple encrypted fragments and stored in three independent security domains: a trusted execution environment, a protected virtual machine, and a rich execution environment. An attacker must simultaneously compromise all three domains and obtain the user's password to successfully reconstruct the complete key seed. This significantly increases the difficulty of illegally obtaining the key seed, effectively preventing the overall leakage of critical information due to intrusion into a single storage area, thereby enhancing the long-term storage security and confidentiality of the key seed.

[0054] In one embodiment of this application, before encrypting multiple seed fragments using a user-inputted protection password to obtain seed fragment ciphertext in step 720, the method further includes: Step 810: Generate a scrambled password input keyboard in the protected virtual machine; wherein, the scrambled password input keyboard is a keyboard with randomly arranged numbers generated in pVM to prevent input from being recorded.

[0055] Step 820: In response to the user's operation on the disordered password input keyboard, obtain the protection password; As described above, this embodiment ensures the security of the password input process by dynamically generating a randomized password input keyboard within the protected virtual machine. This embodiment ensures that the keyboard layout is randomized for each input, and the physical position of the user's input is not fixedly associated with logical numbers. This effectively prevents the theft of the user's password through methods such as interface hijacking, touch event monitoring, or screen recording, thereby providing a reliable source of password input for subsequent seed fragment encryption operations and enhancing the security of the overall key management chain.

[0056] In one embodiment of this application, a digital wallet secure creation apparatus includes: Step 910: The rich execution environment side module is used to respond to the received wallet creation request, request the creation and start of a protected virtual machine, and receive user interaction instructions or wallet creation status information for display. Step 920: The protected virtual machine side module, running in the protected virtual machine, is used to perform environment initialization operations, including disabling the system input method, clipboard, and screen capture / recording functions. Step 930: Generate mnemonic phrases, obtain the order of mnemonic phrases, and display the mnemonic phrase verification interface; Step 940, and generating a key seed based on the verified mnemonic phrase; Step 950, Key storage processing module, used to perform fragmented encryption processing on key seed, and store the encrypted seed fragments in the trusted execution environment, the independent storage area of ​​the protected virtual machine, and the application private sandbox of the rich execution environment respectively. As described above, this embodiment uses a modular architecture to decompose the digital wallet creation process into three security domains: a rich execution environment, a protected virtual machine, and a trusted execution environment, all working collaboratively. By disabling system input methods, clipboard, and screen recording functions in the protected virtual machine, this embodiment fundamentally prevents the leakage of sensitive data such as mnemonic phrases and passwords through input records, copy-paste, or screen capture. Simultaneously, the key seed's fragmented encryption and cross-domain storage mechanism ensures that even if one storage domain is breached, attackers cannot obtain the complete key seed. This achieves end-to-end security protection from user interaction and data processing to key storage, enhancing the overall security and attack resistance of the digital wallet creation process.

[0057] See attached document Figure 4 and attached Figure 5 Appendix Figure 5 Corresponding Appendix Figure 4 The process of generating, verifying, and encrypting the mnemonic phrase in the digital wallet. Applying the above-described secure digital wallet creation method to a real-world scenario includes steps A through F: Step A: The user operates the wallet app on the REE side, clicks "Create New Wallet" and selects the currency; the wallet app uses the wallet creation scheduling module (see attached). Figure 3 The architecture diagram shown indicates that the VirtualizationService initiates a request to create a Protect VM (pVM) and starts MicroDroid OS; this corresponds to step 110 above. The wallet app requests the wallet isolation sandbox to create a wallet isolation environment and starts the wallet isolation sandbox. Based on the independent security of the pVM, the isolation is further strengthened. When creating the pVM, the VirtualizationService disables the network by not adding any network configuration during startup. The AVF isolation environment is started, and the pVM wallet isolation sandbox disables pVM layer interference items, including disabling the system input method, disabling the floating window, disabling the clipboard, and disabling system screenshot / screen recording. It also initializes the AVF encrypted memory, which is accessible only to the AVF and cannot be read by the REE. This corresponds to step 120 above. Step B: The wallet app's trusted root management module verifies whether the AVF isolation environment is effective and whether the network is connected. If effective, it requests the generation of a trusted root. The wallet app's trusted root management module requests a wallet ID random number from the TEE / SE's trusted root management module on the pVM side. The TEE / SE's trusted root management module verifies the wallet app's signature information. After successful verification, it generates a random number and returns it to the wallet app. Then, it hashes the random number and saves it as the wallet ID. The wallet app destroys the random number. The wallet app's trusted root management module sends the wallet ID to the TEE / SE's trusted root management module to request the creation of a trusted root. The TEE / SE obtains the device's unique identifier, such as CPUID, and combines it with CID and wallet ID to perform a hash to generate a three-in-one trusted root (composite trusted root), stores it in the TEE / SE, and returns the trusted root index to the wallet app. (The trusted root index is a reference identifier returned by TEE / SE to the wallet APP. When environment verification is required, the wallet APP submits the current environment parameters and trusted root index to TEE / SE. TEE / SE then uses the trusted root index to find the trusted root data stored in TEE / SE for comparison, so as to quickly locate and call the stored composite trusted root, avoid duplicate creation, and distinguish the trusted root records of different wallets in multi-wallet scenarios, as a credential for verifying the environment legitimacy of subsequent sensitive operations.) Step C: After the wallet app's trusted root management module detects that the composite trusted root has been created or has been successfully created, it verifies the composite trusted root. The mnemonic phrase generation and verification module generates and displays a mnemonic phrase graphic interface for the user to select a mnemonic phrase. The mnemonic phrase generation and verification module runs in a pVM secure isolation environment. It obtains hardware random numbers through the TEE / SE random number module and automatically calculates 12 ordered words, i.e., the mnemonic phrase, according to BIP39. The wallet app (pVM) generates several mnemonic phrases with a determined order, shuffles the order of the mnemonic phrases, and creates a mnemonic phrase order mapping table. This corresponds to step 130 above. Step D: As attached Figure 6 When the user clicks the "Get Correct Mnemonic Phrase Order" button, the mnemonic phrase generation and verification module displays the matching mnemonic phrase order in the mnemonic phrase sequence area based on the displayed mnemonic phrase. The mnemonic phrase sequence area UI occupies a small portion of the interface, which the user can cover as needed. The pVM adds a UI protection module to query the host SurfaceFlinger's layer stack in real time to verify whether there are non-pVM layers superimposed on the pVM layer, preventing the REE-side system or application from forging the mnemonic phrase UI interface. The wallet APP mnemonic phrase generation and verification module queries whether the application is running in the top-level window and exclusively occupying the input focus through the UI protection module. If the focus is lost or the input event is intercepted, it is determined that the interface has been hijacked or covered, and a flashing warning watermark is displayed; this corresponds to step 140 above. Step E: As attached Figure 7The system displays a backup mnemonic phrase page, prompting the user to back up their mnemonic phrase. (See attached image.) Figure 8 After backing up the mnemonic phrase, a mnemonic phrase verification interface is displayed, generating 12 randomly ordered mnemonic words. The order selection UI occupies a small area, which the user can cover as needed. The user selects the order of the words using the volume + / - buttons, allowing the user to toggle the selection using the volume keys to select the target order of the word sequence. This is done to prevent the user from being monitored by clicking on the coordinates of the words. This is used to allow the user to verify whether the recorded mnemonic phrase is correct. This corresponds to step 150 above. Step F: The user enters a protection password. The password input interface can only be accessed via a scrambled keyboard generated by the wallet password input module. The cryptography module, following the BIP39 / BIP32 / BIP44 standards, restores the mnemonic phrase hash fragments into a 512-bit master seed in the AVF encrypted memory, and then derives the master private key, sub-private key, and wallet address according to the BIP39 / BIP32 / BIP44 standards. The key seed processing module splits the master seed into 8 fragments. Each fragment is encrypted using the key entered by the wallet password input module. Two core fragments are passed to the TEE and stored in the hardware encryption area, four fragments are stored in the pVM independent storage directory, and two fragments are bound to a trusted root hash and stored in the wallet APP's private sandbox. The key seed processing module passes non-sensitive information such as the wallet address and currency to the wallet APP's asset query request module on the REE side. The wallet APP's asset query request module on the REE side queries the on-chain node for the asset quantity corresponding to the wallet address and displays it on the UI interface. This corresponds to step 160 above. Please refer to Figure 2 The present invention also provides an electronic device 400, including a memory 402 and a processor 401, and a computer program stored on the memory 402 and running on the processor 401. When the processor 401 executes the computer program, it implements the various steps in the digital wallet secure creation method described above.

[0058] The beneficial effects of the electronic device of the present invention are the same as those of the method described above, and will not be repeated here.

[0059] In summary, this invention provides a secure digital wallet creation method and an electronic device. In response to a wallet creation request, this invention creates and starts a protected virtual machine configured to disable network connectivity. This protected virtual machine constructs a closed, isolated execution environment, cutting off connection to external networks. Compared to existing technologies that run directly at the REE layer, this invention achieves environmental isolation at the runtime level, effectively blocking network-side attack paths and significantly improving the security of the runtime environment. This invention performs environment initialization operations within the protected virtual machine, disabling system input methods, clipboard, and screen recording / screenshot functions. This setting closes the data leakage channel at the system level, effectively preventing malicious input methods from stealing mnemonic phrases and malicious programs from obtaining sensitive information through screen recording / screenshots. Compared to existing technologies that rely solely on software for protection, this invention eliminates security risks during interface interaction through permission control of the virtualized environment. This invention generates a mnemonic phrase within the protected virtual machine and generates a key seed based on it. Because the protected virtual machine has isolation properties, the generation process of critical data is conducted within a protected space, preventing malicious processes in the REE layer from reading or tampering with memory data, thus ensuring the security of the private key source generation. Existing technologies typically store the encryption seed in the application's private sandbox within the REE layer, making the file vulnerable to theft when root privileges are obtained. This invention performs fragmented encryption on the key seed, storing the encrypted seed fragments separately in the Trusted Execution Environment (TEE), the independent storage area of ​​the protected virtual machine, and the application's private sandbox within the REE. Compared to existing technologies that rely solely on software encryption for storage in the REE sandbox, even if the REE layer suffers a root privilege escalation attack leading to the theft of the sandbox file, attackers cannot access the fragments stored in the TEE and the protected virtual machine, thus preventing the reconstruction of the complete key seed. This achieves secure storage of the private key and signature data within the REE layer, enhancing the security of wallet creation and usage, protecting wallet data such as the private key and mnemonic phrase, and preventing the leakage of critical data.

[0060] The above are merely embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention's specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A digital wallet security creation method characterized by, Applied to electronic devices, the method for running rich execution environments and trusted execution environments on said electronic devices includes: In response to the received wallet creation request, a protected virtual machine is created and started, and the protected virtual machine is configured to disable network connectivity; Perform environment initialization operations in the protected virtual machine, including disabling the system input method, clipboard, and screen capture / recording functions; Generate a mnemonic phrase in the protected virtual machine, obtain the mnemonic phrase sequence composed of the mnemonic phrase, and display the mnemonic phrase verification interface; In response to the successful verification result of the mnemonic phrase verification interface, a key seed is generated based on the mnemonic phrase sequence; The key seed is fragmented and encrypted, and the encrypted seed fragments are stored in the trusted execution environment, the independent storage area of ​​the protected virtual machine, and the application private sandbox of the rich execution environment, respectively. The digital wallet creation process is completed using the seed fragment ciphertext.

2. The digital wallet secure creation method of claim 1, wherein, The creation and startup of the protected virtual machine includes: Create a protected virtual machine; Initialize AVF encrypted memory in the protected virtual machine and configure the AVF encrypted memory to be accessible only to the protected virtual machine. 3.The digital wallet security creation method of claim 1, wherein, Before generating the mnemonic phrase in the protected virtual machine, the process also includes: Write the device's first unique identifier, the protected virtual machine's second unique identifier, and the third unique identifier obtained from the wallet creation request into the trusted execution environment; In the trusted execution environment, a hash operation is performed on the first unique identifier, the second unique identifier, and the third unique identifier to generate a composite trusted root. The composite root of trust is stored in the trusted execution environment.

4. The secure digital wallet creation method according to claim 3, characterized in that, Also includes: A random number acquisition request is sent to the trusted execution environment through the protected virtual machine; The protected virtual machine receives a random number returned by the trusted execution environment, and performs a hash operation on the random number to generate a third unique identifier; The third unique identifier is stored in the application's private sandbox of the rich execution environment, and the random number is destroyed in the protected virtual machine.

5. The secure digital wallet creation method according to claim 1, characterized in that, The mnemonic phrase verification interface includes: The layer stack is queried in real time through the protected virtual machine; If an unprotected virtual machine layer is superimposed on a protected virtual machine layer in the layer stack, or if the mnemonic phrase verification interface loses input focus, it is determined that the mnemonic phrase verification interface has been hijacked, and a warning watermark is displayed on the mnemonic phrase verification interface.

6. The secure digital wallet creation method according to claim 1, characterized in that, Also includes: Display mnemonic words in a randomized order within the protected virtual machine; Listen to the input signal; Based on the input signal, the target mnemonic word is selected sequentially from the randomly arranged mnemonic words for verification.

7. The method for securely creating a digital wallet according to claim 1, characterized in that, The step of performing fragmented encryption on the key seed, and storing the encrypted seed fragments in a trusted execution environment, a separate storage area of ​​the protected virtual machine, and an application private sandbox in the rich execution environment, includes: The key seed is split into multiple seed fragments; The multiple seed fragments are encrypted using the user-inputted protection password to obtain seed fragment ciphertext; The first part of the seed fragment ciphertext is sent to the trusted execution environment for hardware encryption storage, the second part of the fragment is stored in the independent storage area of ​​the protected virtual machine, and the third part of the fragment is associated with a pre-generated trusted root and stored in the application private sandbox of the rich execution environment.

8. The method for securely creating a digital wallet according to claim 7, characterized in that, Before encrypting the multiple seed fragments using the user-inputted protection password to obtain the seed fragment ciphertext, the method further includes: Generate a scrambled password input keyboard in the protected virtual machine; In response to the user's operation on the disordered password input keyboard, the protection password is obtained.

9. A secure digital wallet creation device, characterized in that, include: The rich execution environment module is used to respond to the received wallet creation request, request the creation and start of a protected virtual machine, and receive user interaction instructions or wallet creation status information for display. The protected virtual machine side module runs in the protected virtual machine and is used to perform environment initialization operations, including disabling the system input method, clipboard, and screen recording functions; generating mnemonic phrases, obtaining the order of mnemonic phrases and displaying the mnemonic phrase verification interface; and generating a key seed based on the verified mnemonic phrases. The key storage processing module is used to perform fragmented encryption processing on the key seed, and store the encrypted seed fragments in the trusted execution environment, the independent storage area of ​​the protected virtual machine, and the application private sandbox of the rich execution environment.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the digital wallet secure creation method according to any one of claims 1 to 8.

Images