A one-key login security authentication method and device based on a dual-trusted environment

Abstract

The application provides a one-key login security authentication method and device based on a double trusted environment, and the application comprises the following steps: in response to a login trigger instruction, performing self-checking on a terminal trusted execution environment and performing two-way identity authentication with a SIM card security element, generating a login request credential package containing a dynamic authorization code and a self-adaptive device fingerprint; sending the credential package to an operator gateway for decryption and verification, generating a double-layer token with a digital signature and an encrypted one-time verification code after the verification, verifying the double-layer token and the authorization code in the trusted execution environment, transmitting the encrypted verification code to the SIM card security element for decryption and verification, storing the outer token by the SIM card security element when the verification is consistent, and completing backend authentication of a service based on the inner token and obtaining a session credential. The application combines the trusted execution environment and the SIM card security element, and improves the security of login authentication and the reliability of identity verification.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a one-click login security authentication method and apparatus based on a dual-trust environment. Background Technology

[0002] One-click login, as a core technology for mobile internet identity authentication, is widely used in financial payments and social entertainment. With the digital development of mobile services, related technologies, through the collaborative operation of application SDKs, operator gateways, and business backends, have built a complete system from number pre-fetching to token verification. Specifically, this authentication mechanism covers key aspects such as data collection, signaling interaction, and token distribution, enabling users to quickly and seamlessly access the system.

[0003] However, existing authentication methods primarily rely on software-level encrypted transmission and do not build a hardware-level trusted isolation environment, resulting in insufficient security protection layers. Specifically, malicious programs can exploit system vulnerabilities to steal SIM card identity information or hijack authentication requests, directly forging login credentials. Because device characteristics and user identities are not deeply bound, stolen tokens can easily be reused across devices, leading to serious risks of account hijacking and financial losses, making it difficult to cope with increasingly complex cybercrime attack chains. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] Therefore, the first objective of this invention is to propose a one-click login security authentication method based on a dual-trust environment.

[0006] Another objective of this invention is to propose a one-click login security authentication device based on a dual-trust environment.

[0007] The third objective of this invention is to provide a computer device.

[0008] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0009] To achieve the above objectives, a first aspect of the present invention proposes a one-click login security authentication method based on a dual-trusted environment, comprising:

[0010] S1, in response to the login trigger command, performs an integrity self-check in the terminal trusted execution environment and establishes two-way authentication with the SIM card security element, generating a login request credential packet containing a dynamic authorization code and an adaptive device fingerprint; S2, the login request credential packet is sent to the operator gateway for decryption and legality verification. After the verification is successful, the operator gateway generates a digitally signed two-layer token and an encrypted one-time verification code embedded with the device fingerprint digest. S3, verify the signature validity of the two-layer token and the consistency of the dynamic authorization code in the terminal trusted execution environment, and transmit the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification; S4, when the dual-layer token verification is successful and the device fingerprint matches, the outer token is stored by the SIM card security element and a secure storage instruction is generated. Based on the inner token, the identity authentication of the business backend is completed to obtain the session credentials.

[0011] In one embodiment of the present invention, the step of performing integrity self-checks in the terminal trusted execution environment and establishing two-way authentication with the SIM card security element to generate a login request credential packet containing a dynamic authorization code and an adaptive device fingerprint includes: In the trusted execution environment of the terminal, the integrity hash value of the trusted application itself and the legality of the caller application signature are verified to confirm that the terminal has not been rooted or jailbroken and has no malicious process injection, and an authentication request is sent to the SIM card security element through a secure channel. By using the exclusive public key generated by the terminal trusted execution environment and the exclusive identity private key stored in the SIM card security element, two-way identity verification is completed, establishing a dual-environment trusted state between the terminal trusted execution environment and the SIM card security element; Based on the dual-environment trusted state, a 16-byte random number bound to a second-level timestamp is generated as a dynamic authorization code in the terminal trusted execution environment. The CPU serial number and baseband chip ID are collected and hashed to obtain core hardware features. Combined with a randomly generated dynamic privacy salt, a secondary hash operation is performed to generate an adaptive device fingerprint. The dynamic authorization code, adaptive device fingerprint, application package name, IP address, and timestamp are encapsulated into a login request credential package, and the login request credential package is stored in the secure cache of the terminal's trusted execution environment for encrypted transmission.

[0012] In one embodiment of the present invention, the step of hashing the collected CPU serial number and baseband chip ID to obtain core hardware features, and then performing a secondary hash operation using a randomly generated dynamic privacy salt to generate an adaptive device fingerprint, includes: Read the unalterable original CPU serial number data and the original baseband chip ID data from the terminal's underlying hardware interface, and perform a concatenation operation on the original CPU serial number data and the original baseband chip ID data to form a composite hardware feature string; The composite hardware feature string is subjected to the national cryptographic SM3 hash algorithm to generate a core hardware feature hash value of fixed length, and dynamic privacy salt data is randomly generated for each login update within the terminal trusted execution environment; The core hardware feature hash value is concatenated with the dynamic privacy salt data, and the concatenated data is then processed again using the national cryptographic SM3 hash algorithm to generate an adaptive device fingerprint that ensures both device uniqueness and avoids leakage of the device's original information.

[0013] In one embodiment of the present invention, the step of sending the login request credential packet to the operator gateway for decryption and validity verification, and after successful verification, the operator gateway generates a digitally signed two-layer token and an encrypted one-time verification code embedded with the device fingerprint digest, including: The operator gateway receives the login request credential packet protected by both SM2 asymmetric encryption and SM4 symmetric encryption. It then uses the operator's private key to decrypt the SM2 ciphertext and the negotiated key to decrypt the SM4 ciphertext, thus restoring the plaintext login request credential packet containing the dynamic authorization code and the adaptive device fingerprint. The restored login request credential packet plaintext is subjected to timestamp anti-replay verification, IP address location and operator network matching verification, application package name and filing information consistency verification, and the validity of the SIM card identity certificate is verified by using the root certificate chain composed of the public key corresponding to the operator's root key. After all verifications pass, an inner token containing a mobile phone number mask, dynamic authorization code, and validity period is generated. The inner token, device fingerprint digest, and operator signature information are then encapsulated into an outer token. The operator's business private key is used to perform a national cryptographic SM2 signature on the two-layer token to generate a signed token. Extract the adaptive device fingerprint from the request to generate a 6-digit dynamic one-time verification code. Embed the device fingerprint digest into the dynamic one-time verification code through an XOR operation. Then, encrypt the embedded one-time verification code using the SIM card's exclusive identity public key to generate an encrypted one-time verification code.

[0014] In one embodiment of the present invention, the step of verifying the signature validity of the two-layer token and the consistency of the dynamic authorization code in the trusted execution environment of the terminal, and transmitting the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification, includes: In the trusted execution environment of the terminal, the trusted application uses the pre-set operator business public key to perform the national cryptographic SM2 verification operation on the received signature token. After the verification is successful, the dynamic authorization code in the inner token is parsed out and compared with the dynamic authorization code stored in the security cache to ensure consistency. When the dynamic authorization code matches, the trusted application will transmit the encrypted one-time verification code received through the secure channel to the SIM card security element. The SIM card security element will then use its internally stored and non-exportable exclusive identity private key to decrypt the encrypted one-time verification code. The SIM card security element extracts the embedded device fingerprint digest from the decrypted one-time verification code, calls the locally generated adaptive device fingerprint and calculates its digest, matches and verifies the extracted device fingerprint digest with the locally calculated device fingerprint digest, and verifies the timeliness of the one-time verification code to prevent interception and tampering.

[0015] In one embodiment of the present invention, it further includes: In response to the login command that is triggered again, the device completes its own integrity verification and two-way identity verification with the SIM card security element in the terminal trusted execution environment. After confirming that the dual security environment is trusted, the device sends a token read request carrying the current device fingerprint digest and the terminal trusted execution environment signature to the SIM card security element. After the SIM card security element verification signature is passed, the outer token is read from the dedicated security file and decrypted and returned to the terminal trusted execution environment. The terminal trusted execution environment verifies the validity period of the outer token and extracts the device fingerprint digest from it, and compares it with the currently generated adaptive device fingerprint to allow privacy salt differences under the premise of consistent core features. When the comparison is successful, the terminal trusted execution environment generates a new dynamic authorization code, encapsulates a subsequent login request information packet containing the current device fingerprint, the new dynamic authorization code, the outer token digest, the application package name and the timestamp, signs it after it is signed by the terminal trusted execution environment, sends it to the application software development kit and submits it to the business backend; The business backend performs a preliminary verification based on the historical verification information stored locally. If the preliminary verification passes, the login is completed directly and a session credential is returned. If a login from a different location or a slight difference in device information is detected, a secondary verification request is sent to the operator gateway along with a subsequent login request packet. Based on the verification result, a new inner token with an updated validity period is generated and the quick login is completed.

[0016] In one embodiment of the present invention, it further includes: If integrity is found to be compromised during the self-test of the terminal trusted execution environment, or if the two-way identity verification between the terminal trusted execution environment and the SIM card security element fails, the current login process will be terminated immediately, all credentials in the security cache will be cleared, and an untrusted device alarm will be reported to the business backend. If an anomaly is detected during device fingerprint comparison, signature verification, or signature verification, the current login process will be terminated and an anomaly log containing a timestamp, device fingerprint, and error code will be recorded. If such anomalies are detected three times in a row, the login information in the SIM card's secure storage area will be locked, and the user will be forced to unlock the device using a combination of SMS verification code and facial recognition. If a storage anomaly occurs during the reading or writing of the dedicated security file on the SIM card, a key renegotiation process between the terminal's trusted execution environment and the SIM card's secure element is triggered. If the renegotiation fails, the system automatically switches to the traditional SMS verification login mode and reports the issue to the operator for device security checks.

[0017] To achieve the above objectives, a second aspect of the present invention provides a one-click login security authentication device based on a dual-trust environment, comprising: The login authentication module is used to respond to login trigger commands, perform integrity self-checks in the terminal trusted execution environment, establish two-way authentication with the SIM card security element, and generate a login request credential package containing a dynamic authorization code and an adaptive device fingerprint; The credential verification module is used to send the login request credential package to the operator gateway for decryption and legality verification. After the verification is successful, the operator gateway generates a digitally signed double-layer token and an encrypted one-time verification code embedded with the device fingerprint digest. The token verification module is used to verify the signature legality and dynamic authorization code consistency of the two-layer token in the terminal trusted execution environment, and transmit the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification; The security authentication module is used to store the outer token and generate a security storage instruction by the SIM card security element when the two-layer token verification is successful and the device fingerprint matches. Based on the inner token, the module completes the identity authentication of the business backend to obtain session credentials.

[0018] This invention discloses a one-click login security authentication method and apparatus based on a dual-trusted environment. It constructs a dual hardware trusted protection system consisting of a SIM card SE and a terminal TEE, effectively blocking malicious software from stealing, tampering with, and reusing authentication credentials across devices. Through a deep binding mechanism of national cryptographic layered keys and dynamic device fingerprints, it significantly improves the identity authentication security and anti-hijacking capability of the one-click login process while ensuring user privacy compliance.

[0019] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement a one-click login security authentication method based on a dual-trusted environment as described in the first aspect embodiment.

[0020] To achieve the above objectives, the fourth aspect of this application proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a one-click login security authentication method based on a dual-trusted environment as described in the first aspect embodiment.

[0021] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0022] Figure 1 This is a flowchart of a one-click login security authentication method based on a dual-trusted environment according to an embodiment of the present invention; Figure 2 This is an overall core process interaction diagram according to an embodiment of the present invention; Figure 3 This is a flowchart of the subsequent one-click login process according to an embodiment of the present invention; Figure 4 This is a structural diagram of a one-click login security authentication device based on a dual-trust environment according to an embodiment of the present invention; Figure 5 It is a computer device according to an embodiment of the present invention. Detailed Implementation

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] The following description, with reference to the accompanying drawings, describes a one-click login security authentication method and apparatus based on a dual-trusted environment according to an embodiment of the present invention.

[0026] Figure 1 This is a flowchart of a one-click login security authentication method based on a dual-trusted environment according to an embodiment of the present invention, such as... Figure 1 As shown, it includes: S1, in response to the login trigger command, performs an integrity self-check in the terminal trusted execution environment and establishes two-way authentication with the SIM card security element, generating a login request credential packet containing a dynamic authorization code and an adaptive device fingerprint; S2, the login request credential packet is sent to the operator gateway for decryption and legality verification. After the verification is successful, the operator gateway generates a digitally signed two-layer token and an encrypted one-time verification code embedded with the device fingerprint digest. S3, verify the signature validity of the two-layer token and the consistency of the dynamic authorization code in the terminal trusted execution environment, and transmit the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification; S4, when the dual-layer token verification is successful and the device fingerprint matches, the outer token is stored by the SIM card security element and a secure storage instruction is generated. Based on the inner token, the identity authentication of the business backend is completed to obtain the session credentials.

[0027] In one embodiment of the present invention, system initialization and key layering are preset. The key system layering establishment includes: On the operator side: generating two levels of SM2 key pairs, the first level being the root key pair (SK_Op_Root private key, PK_Op_Root public key). SK_Op_Root serves as the "trusted root" of the entire key system. Its core function is to provide basic protection for key issuance and identity authentication. It is stored in the operator's core HSM (hardware security module). The root key supports cross-generation key rotation. The new root key is signed by the old root key to form a trusted root trust chain, realizing the self-evolution of the key lifecycle. The second level consists of a business key pair (SK_Op_Svc private key and PK_Op_Svc public key), which is issued by SK_Op_Root (ensuring the legality and reliable traceability of the business key). SK_Op_Svc is stored in the operator's business gateway HSM and is only used for business-level operations such as decryption of login requests and token signing. PK_Op_Svc public key and corresponding business key certificate will be used for subsequent encryption and signature verification on the terminal side. They are pre-installed in the secure storage area of ​​the user's SIM card and simultaneously pre-installed in the secure storage area of ​​the terminal's TEE.

[0028] Furthermore, on the SIM card side: a "dedicated identity key pair + session key" is generated at the factory. ① Dedicated identity key pair (SK_SIM_ID private key, PK_SIM_ID public key). SK_SIM_ID is stored in the SIM card's non-exportable secure element (SE) and is used for self-identity verification, OTP decryption, and other operations. PK_SIM_ID public key is used for identity registration and two-way verification. ② Session encryption key K_SIM_Sess (SM4 key), which is randomly generated by the SIM card SE, cannot be exported, is valid for a single session, and is updated upon login. It is used for local secure communication with the TEE.

[0029] Further, SIM card key registration: After the SIM card generates the PK_SIM_ID public key, it is sent to the operator's core HSM through a hardware-level encrypted channel to complete the registration. Upon receiving the core HSM, it signs the PK_SIM_ID using the first-level root key SK_Op_Root private key to generate a SIM card identity certificate (containing PK_SIM_ID, signature information, unique SIM card identifier, and validity period). This certificate is then returned to the SIM card SE through an encrypted channel and stored in a dedicated secure file. It serves as the core verification basis for the legitimacy of the SIM card identity in subsequent login processes, forming a trusted link of "root key - SIM card identity".

[0030] Furthermore, on the terminal TEE side: ① Pre-install the operator's business public key PK_Op_Svc and the SIM card identity certificate verification chain (used to verify the legality of the SIM card identity) and the PK_Op_Root public key (used for signature verification); ② Generate a TEE-specific key pair (SK_TEE private key, PK_TEE public key). SK_TEE is stored in the TEE secure storage area and is used for TEE's own identity verification, signature request, and other operations. PK_TEE public key is used for two-way signature verification with the SIM card and the operator.

[0031] Furthermore, TEE key registration: After generating the PK_TEE public key, the TEE sends it to the operator's service gateway (HSM) through the secure channel of the SIM card SE (rather than the ordinary system channel) to complete the registration. The service gateway (HSM) uses the secondary service key SK_Op_Svc private key to sign and verify the PK_TEE. After confirming the legitimacy of the TEE's identity, it associates and stores the PK_TEE, terminal device information, and SIM card's unique identifier, forming a trusted link of "service key - TEE identity - SIM identity," providing the foundation for subsequent two-way signature verification between the TEE and the SIM card, and encrypted communication with the operator.

[0032] In one embodiment of the present invention, the layered key verification includes: after the key layer is established, a linkage verification is required to confirm the legality of the interaction of the three-level keys: the TEE uses the PK_Op_Root public key to verify the SIM card identity certificate, confirming the SIM card's trustworthiness; the SIM card uses the PK_Op_Svc public key to verify the TEE's signature information, confirming the TEE's trustworthiness; the operator's service gateway verifies the legality of the TEE and SIM card's identities using PK_TEE and PK_SIM_ID respectively. After successful verification, a third-party trusted status credential is generated and cached in the TEE and SIM card to ensure smooth linkage of the entire key system. After successful verification, the key system officially takes effect and enters a standby state, providing support for the full-process security protection of subsequent first logins and subsequent logins.

[0033] In one embodiment of the present invention, the flowchart for the initial one-click login and trusted identity binding is as follows: Figure 2 As shown. Client-TEE-SIM card collaborative interaction, user triggers one-click login: When a user triggers one-click login on a terminal device that supports both TEE and SIM card SE, the App automatically calls the TEE Trusted Application (TA) and initiates the security verification process. Trusted environment self-check and credential generation: TEE environment self-check: The TA verifies its own integrity (through hash verification) and the App's signature validity, confirming that the terminal has not been rooted / jailbroken and that no malicious processes have been injected; simultaneously, it sends an authentication request to the SIM card SE through a secure channel, using PK_TEE and the SIM card's SK_SIM_ID to complete two-way identity verification, ensuring the trustworthiness of the "TEE-SIM card" dual environment. Two-way verification is a combination of two independent verification processes: "TEE verifying SIM card identity" and "SIM card verifying TEE identity," adhering to the core cryptographic rule: signing uses a private key, and verification uses a public key.

[0034] In one embodiment of the present invention, the first step is as follows: The TEE initiates authentication with the SIM card SE (the TEE proves its legitimacy). The TEE sends an "authentication request" to the SIM card SE through a secure channel. The request contains two core pieces of information: the TEE's PK_TEE (public key, which can be publicly transmitted and used by the SIM card to verify the TEE's identity); and the TEE's signature information (the TEE uses its own private key SK_TEE to perform an SM2 signature on "PK_TEE + current timestamp" to prevent PK_TEE from being forged). After receiving the request, the SIM card SE performs a verification operation: first, it verifies the legitimacy of the TEE's signature using the preset "operator service public key PK_Op_Svc" (confirming that the signature was generated by SK_TEE, i.e., the current TEE is legitimate and has not been tampered with); after successful verification, it confirms that "the TEE that initiated the request is a trusted hardware security environment," allowing subsequent interactions.

[0035] In one embodiment of the present invention, the second step is as follows: The SIM card SE returns a verification response to the TEE (the SIM card proves its legitimacy). After verifying the legitimacy of the TEE, the SIM card SE returns a "verification response" to the TEE. The response contains two core pieces of information: the SIM card's PK_SIM_ID (public key, which can be transmitted externally and is used by the TEE to verify the SIM card's identity); and the SIM card's signature information (the SIM card uses its own private key SK_SIM_ID to perform an SM2 signature on "PK_SIM_ID + current timestamp" to prevent PK_SIM_ID from being forged). After receiving the response, the TEE performs a verification operation: first, it verifies the legitimacy of the SIM card signature using the pre-set "operator root public key PK_Op_Root" (which is pre-set to the TEE in scheme 7.1.3.1) (confirming that the signature is generated by SK_SIM_ID, i.e., the current SIM card SE is legitimate and has not been forged); after successful verification, it confirms that "the responding SIM card SE is a trusted hardware security environment".

[0036] In one embodiment of the present invention, dynamic credential generation is performed as follows: ① Dynamic authorization code: A 16-byte random number is generated in the TEE, bound to a timestamp (accurate to the second), with a validity period of 60 seconds, stored in the TEE secure cache, and strongly bound to the session ID; ② Adaptive device fingerprint: A dual-layer privacy device fingerprint is generated using "core hardware features + dynamic privacy salt". The core hardware features include immutable features such as CPU serial number and baseband chip ID (hash processing). The dynamic privacy salt is randomly generated by the TEE and updated with each login. The final device fingerprint is a secondary hash value of "hardware feature hash + privacy salt", which ensures uniqueness and avoids device information leakage; ③ Credential encapsulation: The TA encapsulates the dynamic authorization code, adaptive device fingerprint, application package name, IP address, and timestamp into a "login request credential package". Secure transmission encryption: The TA uses the operator's public key PK_Op_Svc to perform SM2 asymmetric encryption on the "login request credential package", and then transmits it to the AppSDK through SM4 symmetric encryption (the key is negotiated and generated by the TEE and the SIM card). The SDK sends it to the operator's business gateway through a normal channel.

[0037] In one embodiment of the present invention, the operator gateway employs multi-layered verification, including layered decryption and legitimacy checks: The operator gateway first decrypts the SM2 ciphertext using the SK_Op_Svc private key, then decrypts it using the negotiated SM4 key to obtain the "login request credential packet"; it verifies the timestamp to prevent replay (allowing ±30 seconds error), the IP address's location and the operator's network compatibility, and the consistency of the application package name with the registration information; simultaneously, it verifies the validity of the SIM card identity certificate (verified using the root certificate chain formed by the public key PK_Op_Root corresponding to SK_Op_Root, ensuring the SIM card identity has not been forged). Trusted Token Generation and Signing: After successful verification, the operator gateway generates a "two-layer token": ① Inner Token: Contains a phone number mask, dynamic authorization code, and validity period (e.g., 30 minutes), used for service login verification; ② Outer Token: Contains the inner Token, device fingerprint digest, and operator signature information, used for secure storage and subsequent verification. The SK_Op_Svc private key is used to perform an SM2 signature on the two-layer token to generate a "signed token". Device fingerprint binding and OTP encryption: The operator gateway extracts the adaptive device fingerprint from the request, generates a dynamic OTP (6-digit dynamic code + device fingerprint digest + session ID + timestamp, valid for 30 seconds), embeds the device fingerprint digest into the OTP (implemented through XOR operation), and encrypts the OTP using the SIM card's PK_SIM_ID to generate an "encrypted OTP". Response data encapsulation: The operator gateway encapsulates the "signature token" and "encrypted OTP" into a response packet, encrypts it using SM4 (the key is negotiated between the gateway and the TEE), and sends it to the client.

[0038] In one embodiment of the present invention, the client performs dual security environment verification. The TEE verifies the signature token: the TA uses the PK_Op_Svc public key to verify the signature validity of the "signature token," parses the dynamic authorization code in the inner token, and compares it with the authorization code in the TEE's secure cache to ensure consistency. The SIM card verifies the encrypted OTP: the TA sends the "encrypted OTP" to the SIM card SE through a secure channel. The SE uses the SK_SIM_ID private key to decrypt and obtain the OTP, device fingerprint digest, and session ID, verifying the triple consistency of the device fingerprint digest, session ID, and timestamp; it also verifies the validity of the OTP to prevent interception and tampering. Secure storage instruction generation: After successful dual verification, the TA generates a "secure storage instruction," encrypting the outer token, device fingerprint, validity period, and other information using the K_SIM_Sess key, signing it with the SK_TEE private key, and sending it to the SIM card SE.

[0039] In one embodiment of the present invention, SIM card secure storage and service login are performed as follows: SIM card storage verification: The SE uses the PK_TEE public key to verify the storage instruction signature, decrypts it, and stores the information in a dedicated security file (EF_SAFE_LOGIN). The permissions are configured as "only trusted TEE applications can read / modify after signature verification," and a storage log (including timestamp and operation subject) is recorded. Service backend login: The TA sends the inner token to the client, which submits it to the service backend. The service backend carries the inner token to the operator gateway to obtain a real mobile phone number (via SM2 encrypted communication). The operator gateway verifies the token's validity and returns the mobile phone number. The service backend performs a risk assessment based on the mobile phone number and device fingerprint (comparing it to the historical login device fingerprint database). Upon successful assessment, login is completed, and a session credential (such as a JWT token) is returned.

[0040] In one embodiment of the present invention, the subsequent one-click login flowchart is as follows: Figure 3As shown, login triggering and environment verification: When the user triggers one-click login again, the App calls TEETA. The TA completes its own integrity verification and two-way identity verification with the SIM card SE to confirm the trustworthiness of the dual security environment. Secure Token Reading: The TA sends a Token read request to the SIM card SE (carrying the current device fingerprint digest, TEE signature, and session ID). After the SE verifies the signature, it reads the outer Token in EF_SAFE_LOGIN, decrypts it, and returns it to the TA. Dynamic Verification and Request Information Generation: The TA verifies the validity period of the outer Token. If valid, it extracts the device fingerprint digest and compares it with the currently generated adaptive device fingerprint (allowing privacy salt differences under the premise of consistent core features); at the same time, it generates a new dynamic authorization code, encapsulates "current device fingerprint + new authorization code + outer Token digest + application package name + timestamp + session ID" into a "subsequent login request information packet", signs it with TEE, and sends it to the App SDK. The business backend leads the verification and login process: The AppSDK submits the "subsequent login request information package" to the business backend; the business backend first performs preliminary verification based on locally stored historical verification information (such as token expiration). If the preliminary verification passes, login can be completed directly; if further confirmation of identity legitimacy is required (such as login from a different location, slight differences in device information, etc.), a secondary verification request is initiated to the operator gateway along with the "subsequent login request information package"; after the operator gateway verifies and returns a confirmation result, the business backend generates a new inner token (with updated expiration) based on the result, completes the quick login, and returns the session credentials. If the token expires or verification fails, the second stage of the initial login process is automatically triggered, and the local credentials are automatically and securely destroyed.

[0041] In one embodiment of the present invention, anomaly handling and security auditing are implemented as follows: Environmental anomalies: If the TEE self-test fails (e.g., integrity is compromised) or the SIM card two-way signature verification fails, the process is immediately terminated, all credentials in the security cache are cleared, and a "device untrusted" alarm is reported to the business backend. Verification anomalies: If device fingerprint comparison or signature / verification fails, the process is terminated, and an anomaly log (including timestamp, device fingerprint, and error code) is recorded. If three consecutive anomalies occur, the login information in the SIM card's secure storage area is locked, requiring the user to unlock via SMS verification code + facial recognition. Storage anomalies: If the SIM card fails to read / write the secure file, a key renegotiation process is triggered. If renegotiation fails, traditional SMS verification login is switched to, and the operator is notified for device security investigation. Full-process auditing: The operator gateway, TEE, and SIM card SE all record key operation logs (including key usage, credential generation, and verification results). Logs are retained for 90 days, supporting security auditing and traceability.

[0042] This invention also offers the following technical advantages: It establishes a "SIM card SE-TEE dual trusted root" security architecture, achieving deep collaboration between the SIM card security element (SE) and the terminal TEE trusted execution environment, constructing a dual hardware-level security isolation protection system. The entire process of credential generation, signature verification, and data storage is completed within a hardware security environment, resisting malware interception and tampering. It designs a three-tiered key system driven by national cryptographic standards to achieve trusted traceability and isolation: An innovative three-tiered architecture of "root key - service key - terminal key" is proposed, constructing a full-link key transfer mechanism based on the SM2 national cryptographic algorithm. The first-level root key, as the trusted foundation, is stored in the operator's core HSM and is responsible for issuing the second-level service key; the second-level service key is used for encrypted communication between the terminal and the operator; the terminal-side SIM card and TEE each generate their own exclusive, non-exportable key, forming a full-process control of "issuance-pre-setting-use-traceability". This design solves the problems of existing key systems being simple, lacking isolation, and difficult to trace, ensuring the security of the key throughout its entire lifecycle. A dynamic credential and composite device fingerprint fusion mechanism is proposed: a trusted combination of "dynamic authorization code + composite device fingerprint" is generated within the TEE. The device fingerprint is generated using "multi-feature salted hashing," balancing uniqueness, stability, and privacy protection, thus addressing the pain points of easy forgery of device identifiers and privacy leaks. A full-link credential control system of "dynamic credentials + multi-layer verification" is constructed: addressing the problem of easy theft and abuse of existing tokens and OTPs, an innovative multi-dimensional credential system of "dynamic authorization code + dual-layer token + embedded fingerprint OTP" is designed. The dynamic authorization code is bound to a second-level timestamp (60-second validity period) to prevent replay; the dual-layer token achieves separation of "business verification (inner layer) + secure storage (outer layer)," with the outer token stored in the SIM card SE's dedicated security area and accessible only to TEE signature verification; the OTP embeds the device fingerprint digest, which can only be used after decryption and verification by the SIM card SE. Simultaneously, the verification process is led by the business backend, supporting flexible triggering of secondary verification by the operator based on risk scenarios, forming a full-link credential security control system. The "trusted reuse + full-scenario anomaly handling" mechanism has been optimized to improve deployment compatibility and robustness: First, an efficient verification process of "initial binding - subsequent reuse" has been innovatively designed. Subsequent logins can directly read the outer token securely stored on the SIM card, and quickly complete the login after dynamic verification, balancing security and efficiency. Second, a full-scenario anomaly handling system has been built to cover extreme scenarios such as environmental anomalies, verification anomalies, and storage anomalies. At the same time, a full-process security audit log has been established to improve the solution's resistance to attacks. Third, it is compatible with the existing one-click login standard process of operators, adapts to mainstream terminal TEE and super SIM cards, and achieves a smooth transition for existing users through software upgrades and OTA key pre-configuration, reducing deployment costs.

[0043] To achieve the above embodiments, such as Figure 4 As shown, this embodiment also provides a one-click login security authentication device 10 based on a dual-trust environment, including: The login authentication module 100 is used to respond to the login trigger command, perform integrity self-check in the terminal trusted execution environment and establish two-way authentication with the SIM card security element, and generate a login request credential package containing a dynamic authorization code and an adaptive device fingerprint; The credential verification module 200 is used to send the login request credential package to the operator gateway for decryption and legality verification. After the verification is successful, the operator gateway generates a digitally signed double-layer token and an encrypted one-time verification code embedded with the device fingerprint digest. The token verification module 300 is used to verify the signature legality and dynamic authorization code consistency of the two-layer token in the terminal trusted execution environment, and transmit the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification; The security authentication module 400 is used to store the outer token and generate a security storage instruction by the SIM card security element when the dual-layer token verification is successful and the device fingerprint matches. Based on the inner token, the module completes the identity authentication of the business backend to obtain the session credentials.

[0044] This invention discloses a one-click login security authentication device based on a dual-trust environment. It constructs a dual hardware trusted protection system consisting of a SIM card SE and a terminal TEE, effectively blocking malicious software from stealing, tampering with, and reusing authentication credentials across devices. Through a deep binding mechanism of national cryptographic layered keys and dynamic device fingerprints, it significantly improves the identity authentication security and anti-hijacking capability of the one-click login process while ensuring user privacy compliance.

[0045] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 5 As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads the executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the one-click login security authentication method based on a dual-trusted environment described above.

[0046] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a one-click login security authentication method based on a dual-trust environment as described in the foregoing embodiments.

[0047] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0048] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A one-click login security authentication method based on a dual-trusted environment, characterized in that, include: S1, in response to the login trigger command, performs an integrity self-check in the terminal trusted execution environment and establishes two-way authentication with the SIM card security element, generating a login request credential packet containing a dynamic authorization code and an adaptive device fingerprint; S2, the login request credential packet is sent to the operator gateway for decryption and legality verification. After the verification is successful, the operator gateway generates a digitally signed double-layer token and an encrypted one-time verification code embedded with the device fingerprint digest. S3, verify the signature validity of the two-layer token and the consistency of the dynamic authorization code in the terminal trusted execution environment, and transmit the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification; S4, when the dual-layer token verification is successful and the device fingerprint matches, the outer token is stored by the SIM card security element and a secure storage instruction is generated. Based on the inner token, the identity authentication of the business backend is completed to obtain the session credentials.

2. The method as described in claim 1, characterized in that, The process of performing integrity self-checks in the terminal's trusted execution environment and establishing two-way authentication with the SIM card security element to generate a login request credential package containing a dynamic authorization code and an adaptive device fingerprint includes: In the trusted execution environment of the terminal, the integrity hash value of the trusted application itself and the legality of the caller application signature are verified to confirm that the terminal has not been rooted or jailbroken and has no malicious process injection, and an authentication request is sent to the SIM card security element through a secure channel. By using the exclusive public key generated by the terminal trusted execution environment and the exclusive identity private key stored in the SIM card security element, two-way identity verification is completed, establishing a dual-environment trusted state between the terminal trusted execution environment and the SIM card security element; Based on the dual-environment trusted state, a 16-byte random number bound to a second-level timestamp is generated as a dynamic authorization code in the terminal trusted execution environment. The CPU serial number and baseband chip ID are collected and hashed to obtain core hardware features. Combined with a randomly generated dynamic privacy salt, a secondary hash operation is performed to generate an adaptive device fingerprint. The dynamic authorization code, adaptive device fingerprint, application package name, IP address, and timestamp are encapsulated into a login request credential package, and the login request credential package is stored in the secure cache of the terminal's trusted execution environment for encrypted transmission.

3. The method as described in claim 2, characterized in that, The process involves hashing the collected CPU serial number and baseband chip ID to obtain core hardware features, and then performing a secondary hash operation using a randomly generated dynamic privacy salt to generate an adaptive device fingerprint, including: Read the unalterable original CPU serial number data and the original baseband chip ID data from the terminal's underlying hardware interface, and perform a concatenation operation on the original CPU serial number data and the original baseband chip ID data to form a composite hardware feature string; The composite hardware feature string is subjected to the national cryptographic SM3 hash algorithm to generate a core hardware feature hash value of fixed length, and dynamic privacy salt data is randomly generated for each login update within the terminal trusted execution environment; The core hardware feature hash value is concatenated with the dynamic privacy salt data, and the concatenated data is then processed again using the national cryptographic SM3 hash algorithm to generate an adaptive device fingerprint that ensures both device uniqueness and avoids leakage of the device's original information.

4. The method as described in claim 1, characterized in that, The login request credential packet is sent to the operator gateway for decryption and validity verification. After successful verification, the operator gateway generates a digitally signed two-layer token and an encrypted one-time verification code embedded with the device fingerprint digest, including: The operator gateway receives the login request credential packet protected by both SM2 asymmetric encryption and SM4 symmetric encryption. It then uses the operator's private key to decrypt the SM2 ciphertext and the negotiated key to decrypt the SM4 ciphertext, thus restoring the plaintext login request credential packet containing the dynamic authorization code and the adaptive device fingerprint. The restored login request credential packet plaintext is subjected to timestamp anti-replay verification, IP address location and operator network matching verification, application package name and filing information consistency verification, and the validity of the SIM card identity certificate is verified by using the root certificate chain composed of the public key corresponding to the operator's root key. After all verifications pass, an inner token containing a mobile phone number mask, dynamic authorization code, and validity period is generated. The inner token, device fingerprint digest, and operator signature information are then encapsulated into an outer token. The operator's business private key is used to perform a national cryptographic SM2 signature on the two-layer token to generate a signed token. Extract the adaptive device fingerprint from the request to generate a 6-digit dynamic one-time verification code. Embed the device fingerprint digest into the dynamic one-time verification code through an XOR operation. Then, encrypt the embedded one-time verification code using the SIM card's exclusive identity public key to generate an encrypted one-time verification code.

5. The method as described in claim 1, characterized in that, The step of verifying the signature validity of the two-layer token and the consistency of the dynamic authorization code in the terminal trusted execution environment, and transmitting the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification, includes: In the trusted execution environment of the terminal, the trusted application uses the pre-set operator business public key to perform the national cryptographic SM2 verification operation on the received signature token. After the verification is successful, the dynamic authorization code in the inner token is parsed out and compared with the dynamic authorization code stored in the security cache to ensure consistency. When the dynamic authorization code matches, the trusted application will transmit the encrypted one-time verification code received through the secure channel to the SIM card security element. The SIM card security element will then use its internally stored and non-exportable exclusive identity private key to decrypt the encrypted one-time verification code. The SIM card security element extracts the embedded device fingerprint digest from the decrypted one-time verification code, calls the locally generated adaptive device fingerprint and calculates its digest, matches and verifies the extracted device fingerprint digest with the locally calculated device fingerprint digest, and verifies the timeliness of the one-time verification code to prevent interception and tampering.

6. The method as described in claim 1, characterized in that, The method further includes: In response to the login command that is triggered again, the device completes its own integrity verification and two-way identity verification with the SIM card security element in the terminal trusted execution environment. After confirming that the dual security environment is trusted, the device sends a token read request carrying the current device fingerprint digest and the terminal trusted execution environment signature to the SIM card security element. After the SIM card security element verification signature is passed, the outer token is read from the dedicated security file and decrypted and returned to the terminal trusted execution environment. The terminal trusted execution environment verifies the validity period of the outer token and extracts the device fingerprint digest from it, and compares it with the currently generated adaptive device fingerprint to allow privacy salt differences under the premise of consistent core features. When the comparison is successful, the terminal trusted execution environment generates a new dynamic authorization code, encapsulates a subsequent login request information packet containing the current device fingerprint, the new dynamic authorization code, the outer token digest, the application package name and the timestamp, signs it after it is signed by the terminal trusted execution environment, sends it to the application software development kit and submits it to the business backend; The business backend performs a preliminary verification based on the historical verification information stored locally. If the preliminary verification passes, the login is completed directly and a session credential is returned. If a login from a different location or a slight difference in device information is detected, a secondary verification request is sent to the operator gateway along with a subsequent login request packet. Based on the verification result, a new inner token with an updated validity period is generated and the quick login is completed.

7. The method as described in claim 1, characterized in that, The method further includes: If integrity is found to be compromised during the self-test of the terminal trusted execution environment, or if the two-way identity verification between the terminal trusted execution environment and the SIM card security element fails, the current login process will be terminated immediately, all credentials in the security cache will be cleared, and an untrusted device alarm will be reported to the business backend. If an anomaly is detected during device fingerprint comparison, signature verification, or signature verification, the current login process will be terminated and an anomaly log containing a timestamp, device fingerprint, and error code will be recorded. If such anomalies are detected three times in a row, the login information in the SIM card's secure storage area will be locked, and the user will be forced to unlock the device using a combination of SMS verification code and facial recognition. If a storage anomaly occurs during the reading or writing of the dedicated security file on the SIM card, a key renegotiation process between the terminal's trusted execution environment and the SIM card's secure element is triggered. If the renegotiation fails, the system automatically switches to the traditional SMS verification login mode and reports the issue to the operator for device security checks.

8. A one-click login security authentication device based on a dual-trust environment, characterized in that, include: The login authentication module is used to respond to login trigger commands, perform integrity self-checks in the terminal trusted execution environment, establish two-way authentication with the SIM card security element, and generate a login request credential package containing a dynamic authorization code and an adaptive device fingerprint; The credential verification module is used to send the login request credential package to the operator gateway for decryption and legality verification. After the verification is successful, the operator gateway generates a digitally signed double-layer token and an encrypted one-time verification code embedded with the device fingerprint digest. The token verification module is used to verify the signature legality and dynamic authorization code consistency of the two-layer token in the terminal trusted execution environment, and transmit the encrypted one-time verification code to the SIM card security element for decryption and device fingerprint matching verification; The security authentication module is used to store the outer token and generate a security storage instruction by the SIM card security element when the two-layer token verification is successful and the device fingerprint matches. Based on the inner token, the module completes the identity authentication of the business backend to obtain session credentials.

9. A computer device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement a one-click login security authentication method based on a dual-trusted environment as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements a one-click login security authentication method based on a dual-trusted environment as described in any one of claims 1-7.

Images