A hardware-level camera microphone physical power-off anti-eavesdropping and anti-stealing system

Abstract

The application discloses a kind of hardware level camera microphone physical power-off anti-eavesdropping, anti-peeping system, belong to mobile terminal privacy security protection technical field.This system sets up dual-domain partition power supply framework, terminal power supply is divided into normal standby power domain and complete power-off safety domain including camera, microphone, motion sensor, baseband acquisition circuit;Mainboard is laid camera microphone independent shunt hardware power-off circuit, is matched with entity button, software instruction double-path hardware cut-off module;Rely on TEE trusted execution environment chip to realize soft and hard collaborative control, built-in dual-mode shutdown mechanism, distinguish ordinary standby mode and hardware level safety power-off mode;Under safety mode, TEE bottom layer intercepts gyroscope, accelerometer and other sensor raw data reporting channel, blocks side channel vibration eavesdropping vulnerability.The application realizes privacy peripheral complete power-off isolation from hardware circuit level, avoids software permission hijacking, shutdown standby remote wake-up eavesdropping, sensor side channel espionage and other industry pain points;Control logic is isolated in TEE safety partition, upper system, kernel cannot tamper with protection state, while generating tamper-proof security audit log;Overall modification cost is low, adapts to mobile phone, tablet computer all kinds of intelligent terminals, can be widely applied to government affairs confidential, anti-fraud law enforcement, business security, personal high privacy protection scene.

Description

Technical Field

[0001] This invention relates to the field of trusted hardware security protection technology for mobile terminals, and is particularly applicable to portable smart terminals such as smartphones and tablets. Specifically, it is a camera and microphone full-domain privacy anti-eavesdropping and anti-spy camera system with hardware physical power-off isolation and sensor side-channel interception capabilities. Background Technology

[0002] Currently, privacy protection for smart terminal cameras and microphones relies entirely on upper-level software permission control within the operating system, coupled with passive protection methods such as lens occluders and protective cases. This results in four fundamental security flaws at the underlying level: Software permission verification is extremely easy to bypass and hijack. Terminal system vulnerabilities, kernel privilege escalation, firmware backdoor implantation, and low-level penetration by malicious applications can all bypass permission control, allowing cameras and microphones to be silently started in the background to secretly take photos and record audio. Pure software protection has no hardware fallback mechanism, making the security boundary extremely easy to breach.

[0003] Traditional shutdown only provides low-power standby, leaving peripherals with continuous low power supply, which poses a risk of eavesdropping. Conventional shutdown does not cut off power to the microphone, motion sensor, and baseband peripheral circuitry. Attackers can remotely wake up the device via the baseband and trigger audio / video capture via underlying firmware commands, enabling covert eavesdropping even when the device is powered off. There is no mature hardware solution in the industry to prevent this.

[0004] Sensor-side channel eavesdropping has long been a blind spot in protection. Existing protection only controls cameras and microphones, without restricting gyroscopes, accelerometers, and vibration sensors. Attackers collect minute vibration data from the devices and use algorithms to reconstruct ambient sounds and conversations, forming an invisible eavesdropping channel without the involvement of cameras or microphones.

[0005] Traditional passive protection methods are weak. Lens blocking only physically covers the aperture, which cannot cut off the power supply to the circuit and cannot resist firmware and low-level hardware attacks. The industry lacks native dual-domain partition hardware power-off and TEE software and hardware collaborative full-domain protection architecture, which is difficult to meet the high-security requirements of government, classified and law enforcement terminals.

[0006] In summary, existing pure software control and passive physical shielding protection modes have low protection levels, many vulnerabilities, and are easily compromised. There is an urgent need for a full-link privacy protection system that includes hardware-level physical power-off, low-level interception of side-channel eavesdropping, and trusted chip collaborative control. Summary of the Invention

[0007] 5.1 Purpose of the Invention To address the shortcomings of existing technologies, this invention provides a hardware-level camera microphone physical power-off anti-eavesdropping and anti-spy camera system, achieving the following objectives: The microphone is completely powered off by an independent hardware power-off circuit, eliminating the possibility of eavesdropping and filming caused by software hijacking and low-level firmware attacks from the source of the circuit. It distinguishes between normal standby and hardware security power-off modes, eliminates the micro power supply defects of peripherals during power-off / standby, and blocks remote wake-up and data theft channels; The underlying intercepts motion sensor data reporting, plugs vibration side-channel eavesdropping vulnerabilities, and achieves full-domain privacy protection; Relying on the TEE trusted chip to isolate all power-off control logic, the upper-layer operating system and kernel have no right to tamper with the protection status, ensuring the trustworthiness and stability of the protection mechanism; The hardware modification only optimizes the motherboard circuitry, resulting in low mass production costs. It is compatible with smart terminals at all price points and various high-security application scenarios.

[0008] A hardware-level camera microphone physical power-off anti-eavesdropping and anti-spy camera system includes a terminal motherboard, main processor, TEE security chip, dual-domain partitioned power supply architecture, peripheral independent power-off hardware circuit, dual-path hardware cut-off module, and motion sensor side channel interception module. The dual-domain partitioned power supply architecture physically isolates the power supply of the entire device into a normal standby power supply domain and a completely power-off security domain. The normal standby power supply domain includes the main processor, screen, internal storage, and general communication modules, supporting daily power-on, message push, and wake-up upon call. The completely power-off security domain includes the camera module, microphone module, gyroscope, accelerometer, vibration sensor, and baseband acquisition peripheral circuits. The TEE security chip retains only its minimum operating power. In security mode, it cuts off all power to the completely power-off security domain, leaving privacy peripherals with zero power and no acquisition capability.

[0009] The peripheral independent power-off hardware circuit motherboard has separate power supply branches for cameras and microphones, which are physically isolated from the main power supply. Each branch is equipped with an independent MOS transistor hardware power-off switch. The MOS switch is controlled by a dedicated hardware cut-off module and is not directly scheduled by the main processor. It supports individual physical power-off of single or multiple cameras and microphones, with no residual current input.

[0010] The hardware cutoff module with both hardware and software paths includes two independent and redundant triggering paths: Path 1: Pure hardware triggering via physical hardware buttons on the device, requiring no operating system intervention, instantly completing the power cutoff; Path 2: Software triggering via underlying system security instructions, supporting one-click stealth and timed automatic safe power cutoff; Failure of a single path does not affect the overall power cutoff protection function.

[0011] The power supply status and security mode switch status of peripheral devices in the TEE trusted chip global control module are stored in an independent security partition of the TEE, which is physically and logically isolated from the main system. Upper-layer applications and system kernels cannot read or modify the security power-off status. All peripheral power-on and power-off operations must be verified by the TEE security, and an immutable encrypted security operation log is generated synchronously for security auditing and behavior tracing.

[0012] The dual-mode shutdown underlying control mechanism has two independent standby shutdown logics: (1) Normal standby shutdown mode: only reduces the power consumption of the whole machine, completely cuts off the power, retains micro power supply in the safety domain, and opens remote wake-up, incoming call and message push functions to adapt to daily use; (2) Hardware-level complete safety power-off mode: the TEE security chip issues hardware power-off command, simultaneously cuts off the power supply of all peripherals in the safety domain, permanently shields the baseband and firmware remote wake-up channel, and external commands cannot activate the microphone and sensor.

[0013] When the sensor side-channel eavesdropping bottom-layer interception module terminal enters the hardware security power-off mode, the TEE security chip intercepts the raw data reporting channels of the gyroscope, accelerometer, and vibration sensor from the bottom layer; even if the sensor has a slight leakage current, the main processor and upper-layer application cannot obtain any vibration sampling data, blocking the side-channel eavesdropping path of reconstructing human voice from vibration signals.

[0014] Preferably, the MOSFET hardware power-off switch is an N-channel power MOSFET, with each microphone power supply branch matched with an independent drive pin, and the drive signal is output only by the TEE security chip. Preferably, the physical hardware button is a normally closed hardware switch, which directly pulls down the MOSFET drive level when pressed, without being forwarded through the main processor's I / O port. Preferably, the security operation log is encrypted using the national cryptographic standard SM2 and stored in the TEE security partition. The log cannot be deleted or tampered with, and supports export for government and enterprise security audits. Preferably, the TEE security chip and the main processor use an isolated communication bus, and the main processor can only query the security mode status unidirectionally and cannot issue control commands to modify the power-off logic.

[0015] Complete power-off isolation at the hardware circuit level completely immune to software attacks such as vulnerabilities, kernel privilege escalation, firmware backdoors, and malicious APP hijacking. The protection level is far higher than that of pure software permission control and lens cover stickers. Dual-domain partitioned power supply completely eliminates the hidden dangers of micro-power supply of peripherals when the device is off or in standby mode, blocks all remote wake-up channels, and solves the long-standing pain point of eavesdropping and filming when the device is off in the industry. Simultaneously, it achieves hardware power-off of the camera microphone and low-level data interception of the motion sensor, providing dual protection to block side-channel eavesdropping blind spots and achieve comprehensive privacy protection for the terminal. TEE trusted environment isolation control logic ensures that the upper-layer system cannot tamper with the protection status, and operation logs are encrypted and retained, meeting the compliance audit requirements of classified and law enforcement equipment. Only the motherboard power supply circuit is optimized and the underlying TEE control logic is iterated. No new high-priced components are needed, the transformation cost is low, and it can be adapted to mobile phones and tablets of all price ranges from high-end to low-end, resulting in strong product differentiation and competitiveness. Dual-trigger redundant paths, physical buttons available offline, adaptable to extreme scenarios such as no system response and system crash, providing higher protection reliability.

[0016] A hardware-level smartphone with physical power-off protection for camera and microphone to prevent eavesdropping and unauthorized filming features a dual-domain power supply circuit on the motherboard: A standard standby power supply domain includes the SOC main processor, display, flash memory, and 4G / 5G communication baseband controller; a fully power-off security domain includes the front camera, rear camera, main microphone, secondary microphone, gyroscope, accelerometer, vibration sensor, and baseband audio acquisition peripheral circuitry. Each camera and microphone power supply branch has an independent power MOS power-off switch, with the MOS drive pin connected to the physical security button on the side of the device and the TEE security chip. A short press of the power button powers off the device normally, entering low-power standby mode, while the security domain retains a small power supply. A long press of the independent security button for 3 seconds triggers a power-off command from the TEE chip, simultaneously cutting off power to all peripherals in the security domain and intercepting all motion sensor data reporting at the lower level. All power-on and power-off operations generate SM2 encrypted logs stored in the TEE, which can be exported for auditing by enterprises. In the event of a system crash or freeze, the physical hardware button can still directly cut off the power supply to the camera and microphone, independent of system operation.

[0017] Example 2: Commercial Classified Tablet PC This system is installed on classified tablets and adds a timed secure power-off function: administrators can set a daily timer to automatically enter the hardware secure power-off mode through the underlying security software; the tablet's TEE chip isolates all power-off control logic, and neither upper-layer applications of the Android system nor ROOT permissions can disable the secure power-off mechanism; in secure mode, all remote wake-up commands from the baseband are directly intercepted and discarded by the TEE, making it impossible to wake up any audio or video acquisition peripherals; a built-in side-channel interception module completely blocks the transmission of vibration sensor data to the application layer, eliminating vibration eavesdropping and leakage in meeting scenarios. Attached Figure Description

[0018] Figure 1 shows the overall hardware architecture block diagram (TEE, main processor, dual-domain power supply, camera microphone, sensor, buttons). Figure 2 is a schematic diagram of a dual-domain partitioned power supply circuit. Figure 3 shows the independent MOS power-off switch circuit for a single-channel camera. Figure 4 shows the hardware connection diagram of physical buttons + TEE dual drive. Figure 5 shows the TEE hardware-software collaborative security management process. Figure 6 is a flowchart showing the switching between normal shutdown and hardware safety power-off modes. Figure 7 is a block diagram of the underlying interception and transmission of raw sensor data.

Claims

1. A hardware-level camera microphone physical power-off anti-eavesdropping and anti-spy camera system, characterized in that, This includes the terminal motherboard, main processor, TEE security chip, dual-domain partitioned power supply architecture, peripheral independent power-off hardware circuit, dual-path hardware cut-off module, and motion sensor side channel interception module. The dual-domain partitioned power supply architecture physically isolates the power supply of the entire machine into a regular standby power supply domain and a completely power-off safety domain; the regular standby power supply domain includes the main processor, screen, storage, and general communication modules; The complete power-off safety domain includes a camera module, a microphone module, a gyroscope, an accelerometer, a vibration sensor, and baseband acquisition peripheral circuitry. In safe mode, only the minimum operating power supply to the TEE security chip is retained, and all power supply to the completely power-off safety domain is cut off. The peripheral independent power-off hardware circuit is set up on the motherboard as an independent power supply branch for the camera and microphone, which is physically isolated from the main power supply. Each branch is equipped with an independent MOS transistor hardware power-off switch. The MOS transistor is controlled by the hardware cut-off module and is not directly scheduled by the main processor. The dual-path hardware cutoff module includes a physical button hardware trigger path and a low-level software instruction trigger path. The two paths are independent of each other and redundant. The TEE security chip stores the power supply status of peripherals and the security mode switch status. The storage area is logically isolated from the main system. The upper-layer operating system and kernel cannot tamper with the secure power-off status. All power-on and power-off operations are verified by the TEE security and generate an unalterable security operation log. The system has a dual-mode shutdown control mechanism embedded at the bottom layer, which is divided into a normal standby shutdown mode and a hardware-level complete and safe power-off mode. In the normal standby power-off mode, the complete power-off security domain retains a small power supply and supports remote wake-up; in the hardware-level complete power-off mode, the TEE issues a power-off command to cut off the power supply to all peripherals in the security domain and block all remote wake-up channels; the motion sensor side channel interception module is configured inside the TEE security chip. In the hardware-level power-off mode, the underlying layer intercepts the raw data reporting channels of the gyroscope, accelerometer, and vibration sensor, blocking the transmission of vibration data to the main processor and application layer.

2. The system according to claim 1, characterized in that, The MOS transistor hardware power-off switch is an N-channel power MOS transistor, and each microphone power supply branch is matched with an independent drive pin. The drive signal is only output by the TEE safety chip.

3. The system according to claim 1, characterized in that, The physical hardware button is a normally closed hardware switch. When pressed, it directly pulls down the MOS drive level, and the control signal is not forwarded through the main processor I / O port.

4. The system according to claim 1, characterized in that, The security operation log is encrypted using the national cryptographic standard SM2 and stored in a separate secure partition of the TEE. The log cannot be deleted or tampered with, and it supports security audit export.

5. The system according to claim 1, characterized in that, The TEE security chip and the main processor use an isolated communication bus. The main processor can only query the security mode status in one direction and cannot issue control instructions to modify the power-off logic.

6. The system according to claim 1, characterized in that, It supports timed automatic triggering of hardware safety power-off mode. The timing parameters can only be modified in the TEE underlying security configuration interface, and the upper layer system does not have modification permissions.

7. The system according to claim 1, characterized in that, The system is compatible with smartphones, tablets, and portable smart terminals, and is used in government office work, confidential business, anti-fraud law enforcement, and privacy protection scenarios.

Images