Security protection system and method for terminal device, and computer readable medium

Abstract

A security protection system and method for a terminal device, and a computer readable medium. The system comprises: a terminal trusted platform which comprises a terminal root-of-trust module, wherein the terminal root-of-trust module stores fingerprint information of a terminal device, a terminal fingerprint private key TF KEY, a terminal fingerprint public key certificate TF CERT and a trusted execution environment (TEE); the fingerprint information is used for uniquely identifying the terminal device; the terminal fingerprint private key TF KEY is used for signing the fingerprint information; the terminal fingerprint public key certificate TF CERT is used for verifying the validity of the signature of the fingerprint information; and the TEE is used for providing an isolated data processing environment for the terminal trusted platform; and a secure monitor service module, which comprises a secure monitor client, wherein the secure monitor client is used for monitoring the terminal root-of-trust module. Whether a terminal device has been unauthorizedly tampered with can be accurately identified, thereby improving the security of and the security protection effect for the terminal device.

Description

Terminal device security protection system, method and computer-readable medium Technical Field

[0001] The present application mainly relates to the field of Internet of Things technology, and specifically to a security protection system, method and computer-readable medium for terminal equipment. Background Art

[0002] The commercial Internet of Things (IoT) serves as a critical bridge between businesses and consumers. By providing intelligent products and services, it aims to enhance the customer experience, improve operational decision-making efficiency, and precisely match supply and demand. As an intelligent service system, it is the core link connecting consumer demand and supply. The IoT encompasses a wide range of terminal devices, including smart financial POS (Point of Sales) machines, Android cash registers, handheld devices, smart cameras, barcode scanners, smart routers, electronic price tags, commercial displays, and kitchen displays. These devices are widely used in various industries, including catering, retail, supermarkets, and local life, encompassing diverse scenarios such as cashiering, invoicing, store tax management, ordering queues, and food delivery. However, due to the high price of IoT devices and the significant value of the business data they generate, they have become a prime target for attacks within the black market. Attackers exploit methods such as tampering with device serial numbers, device programs, and device configuration information to profit from illicit activities. This poses a threat to industry security and requires effective countermeasures.

[0003] Existing technology uses a device fingerprint tampering detection method to determine the security of terminal devices. This method collects and organizes the collection indicators of real terminal devices, identifies and detects whether the content of the actual collected indicator items has been tampered with, and performs weighted calculations on the detection results of the tampering of the actual collected indicator items to obtain a probability factor for the actual collected indicator items being tampered with. This probability factor is applied to other fingerprint algorithms of the device. The current method mainly relies on the operating system application layer to implement tampering detection of device fingerprints. However, the operating system application layer has low permissions and limited protection methods. This technology cannot effectively resist security attacks from attackers on commercial IoT devices. After obtaining the device, the attacker may use hacking tools to tamper with the device directly from the application layer, system layer, and hardware layer, resulting in an inability to effectively prevent and detect illegal tampering of commercial IoT devices. In addition, the current technology uses a probabilistic judgment method, which has low security performance and can also lead to a large number of misjudgments and inaccurate identification problems, and has low accuracy.

[0004] Currently, there is no complete security protection system for terminal devices. There is a lack of protection solutions for the local system of terminal devices to directly monitor security, and there is a lack of protection solutions for cloud platforms to monitor the security of cloud services for terminal devices. There is a problem of being unable to accurately identify information tampering of terminal devices, and the security protection effect of terminal devices is poor. Summary of the Invention

[0005] The technical problem to be solved by this application is to provide a security protection system, method and computer-readable medium for terminal devices, which can accurately identify whether the terminal device has been illegally tampered with through the local system of the terminal device and the cloud platform, thereby improving the security and security protection effect of the terminal device.

[0006] The technical solution adopted by the present application to solve the above-mentioned technical problems is a security protection system for terminal devices, including: a terminal trusted platform, including a terminal trusted root module, in which the terminal trusted root module stores the fingerprint information of the terminal device, the terminal fingerprint private key TF KEY, the terminal fingerprint public key certificate TF CERT and the trusted execution environment TEE; the fingerprint information is used to uniquely identify the terminal device; the terminal fingerprint private key TF KEY is used to sign the fingerprint information; the terminal fingerprint public key certificate TF CERT is used to verify the legitimacy of the signature of the fingerprint information; the trusted execution environment TEE is used to provide an isolated data processing environment for the terminal trusted platform; a security monitoring service module, including a security monitoring client, and the security monitoring client is used to monitor the terminal trusted root module.

[0007] In one embodiment of the present application, a certificate authority CA is provided in the trusted execution environment TEE, and the certificate authority CA is used to verify the security of data.

[0008] In one embodiment of the present application, the security monitoring client includes an anomaly analysis module, which includes a security verification submodule and an information local comparison submodule; the security verification submodule is used to verify the security of the terminal fingerprint public key certificate TF CERT; the information local comparison submodule is used to compare the consistency between the fingerprint information obtained by the security monitoring client and the fingerprint information in the terminal fingerprint public key certificate TF CERT.

[0009] In one embodiment of the present application, the security monitoring client periodically calls the anomaly analysis module according to a preset time interval to monitor anomalies in the fingerprint information of the terminal device.

[0010] In one embodiment of the present application, the terminal trusted platform further includes a secure storage area, in which fingerprint information of the terminal device is stored.

[0011] In one embodiment of the present application, the terminal fingerprint public key certificate TF CERT is constructed based on the X.509 certificate.

[0012] In one embodiment of the present application, the fingerprint information includes one or any combination of device model, device product number, device unique serial number, Flash ID, CPU ID, MAC address, IMEI number, system firmware identification number, and system configuration identification number.

[0013] In one embodiment of the present application, the security protection system of the terminal device also includes a cloud-based trusted platform, the cloud-based trusted platform includes a cloud-based trusted root module, and the cloud-based trusted root module stores an instruction private key CMD KEY. The instruction private key CMD KEY is used to sign the trusted control instructions issued by the cloud-based trusted platform, and the trusted control instructions are used to control the terminal device.

[0014] In one embodiment of the present application, the security monitoring service module also includes a security monitoring server, which is used to monitor the cloud-based trusted root module and transmit trusted control instructions to the security monitoring client; the terminal trusted root module also stores an instruction public key certificate CMD CERT, which is used to verify the legitimacy of the signature of the trusted control instruction.

[0015] In one embodiment of the present application, the cloud trusted platform further includes a terminal fingerprint database, and the terminal fingerprint database stores a terminal fingerprint public key certificate TF CERT.

[0016] In one embodiment of the present application, the trusted control instruction includes controlling the terminal device to lock the device and / or clearing the terminal fingerprint private key TF KEY.

[0017] In order to solve the above-mentioned technical problems, the present application also proposes a security protection method for a terminal device, which uses the security protection system of the terminal device as above, including: step Sb1: the security monitoring client collects the fingerprint information of the terminal device; step Sb2: the security monitoring client sends the fingerprint information to the security program of the trusted execution environment TEE; step Sb3: the security program of the trusted execution environment TEE verifies whether the fingerprint information is safe. If the fingerprint information is safe, a security value is returned to the security monitoring client, and the execution of the security protection method is terminated; if the fingerprint information is unsafe, an abnormal value is returned to the security monitoring client, and the execution of step Sb4 is switched; step Sb4: the security monitoring client performs an emergency disposal operation on the terminal device, and the execution of the security protection method is terminated.

[0018] In one embodiment of the present application, the security program of the trusted execution environment TEE is a security monitoring trusted application TA; in step Sb3, the step of the security program of the trusted execution environment TEE verifying whether the fingerprint information is secure includes: step Sb3a: the security monitoring trusted application TA uses the built-in certificate authority CA to verify whether the terminal fingerprint public key certificate TF CERT is secure. If the terminal fingerprint public key certificate TF CERT is not secure, it returns an abnormal value to the security monitoring client and switches to executing step Sb4; if the terminal fingerprint public key certificate TF CERT is secure, it switches to executing step Sb3b; step Sb3b: the security monitoring trusted application TA compares the fingerprint information sent by the security monitoring client with the fingerprint information in the terminal fingerprint public key certificate TF CERT to see if they are consistent. If the comparison is consistent, it indicates that the fingerprint information is secure; if the comparison is inconsistent, it indicates that the fingerprint information is insecure.

[0019] In one embodiment of the present application, in step Sb4, the step of the security monitoring client performing an emergency disposal operation on the terminal device includes: the security monitoring client notifying the terminal device to stop working.

[0020] In order to solve the above technical problems, the present application also proposes a security protection system for terminal devices, including: a terminal trusted platform, including a terminal trusted root module, the terminal trusted root module stores the fingerprint information of the terminal device, the terminal fingerprint private key TF KEY, the terminal fingerprint public key certificate TF CERT and the instruction public key certificate CMD CERT; the fingerprint information is used to uniquely identify the terminal device; the terminal fingerprint private key TF KEY is used to sign the fingerprint information; the terminal fingerprint public key certificate TF CERT is used to verify the legitimacy of the signature of the fingerprint information; a cloud trusted platform, including a cloud trusted root module, the cloud trusted root module stores the instruction private key CMD KEY, the instruction private key CMD KEY is used to sign the trusted control instructions issued by the cloud trusted platform; the instruction public key certificate CMD CERT is used to verify the legitimacy of the signature of the trusted control instructions; a security monitoring service module, including a security monitoring client and a security monitoring server, the security monitoring client is used to monitor the terminal trusted root module and report the terminal monitoring information to the security monitoring server; the security monitoring server is used to monitor the cloud trusted root module and transmit the trusted control instructions to the security monitoring client, and the trusted control instructions are used to control the terminal device.

[0021] In order to solve the above technical problems, the present application also proposes a security protection method for terminal devices, which uses the security protection system of the terminal device as above, including: step Sy1: the security monitoring client initiates a communication connection to the security monitoring server to establish secure communication; step Sy2: the security monitoring client collects the fingerprint information of the terminal device and sends heartbeat data to the security monitoring server, where the heartbeat data includes the fingerprint information; step Sy3: the security monitoring server verifies whether the signature of the heartbeat data is legal. If the verification is legal, it proceeds to execute step Sy4; if the verification is illegal, it proceeds to execute step Sy6; step Sy4: the security monitoring server determines whether the parameter operation value in the heartbeat data has changed. If it is determined that there is no change, it proceeds to execute step Sy5; if it is determined that there is a change, it proceeds to execute step Sy6; step Sy5: the security monitoring server sends an instruction to disconnect the communication connection to the security monitoring client, thereby terminating the execution of the security protection method; step Sy6: the security monitoring server performs an emergency disposal operation on the terminal device, and sends an instruction to disconnect the communication connection to the security monitoring client, thereby terminating the execution of the security protection method.

[0022] In one embodiment of the present application, in step Sy1, the communication connection includes a TLS communication connection; after the security monitoring client initiates a communication connection to the security monitoring server, it also includes: the security monitoring client unilaterally authenticates the legitimacy of the security monitoring server.

[0023] In one embodiment of the present application, the heartbeat data includes the device's unique serial number SN; in step Sy3, the security monitoring server verifies whether the signature of the heartbeat data is legal, including: the security monitoring server parses the heartbeat data to obtain the device's unique serial number SN, and queries the terminal fingerprint public key certificate TF CERT from the terminal fingerprint database based on the device's unique serial number SN; the security monitoring server uses the terminal fingerprint public key certificate TF CERT to verify the legality of the signature of the heartbeat data.

[0024] In one embodiment of the present application, the parameter operation value in the heartbeat data is the secure hash algorithm operation value of the fingerprint information; in step Sy4, the step of the security monitoring server determining whether the parameter operation value in the heartbeat data has changed includes: the security monitoring server comparing the secure hash algorithm operation value of the fingerprint information and the value in the terminal fingerprint public key certificate TF CERT to see if they are consistent, if they are consistent, it indicates that no change has occurred; if they are inconsistent, it indicates that a change has occurred.

[0025] In one embodiment of the present application, in step Sy6, the step of the security monitoring server performing an emergency disposal operation on the terminal device includes: step Sy6a: the security monitoring server sends a request instruction for obtaining fingerprint information to the security monitoring client; step Sy6b: the security monitoring client uses the instruction public key certificate CMD CERT to verify the legitimacy of the signature of the request instruction and compares the random number in the request instruction. If the signature of the request instruction is illegal or the random number in the request instruction is inconsistent, the execution of the security protection method is terminated; if the signature of the request instruction is legal and the random number in the request instruction is consistent, step Sy6c is executed; step Sy6c: the security monitoring client sends fingerprint information to the security monitoring server; step Sy6d: the security monitoring server uses the terminal fingerprint public key certificate TF CERT to verify whether the signature of the fingerprint information is legal. If the verification is legal, the fingerprint information is stored; if the verification is illegal, the fingerprint information is discarded; step Sy6e: the security monitoring server sends a trusted control instruction to the security monitoring client. The trusted control instruction is used to perform emergency disposal on the terminal device.

[0026] In one embodiment of the present application, after step Sy6e, it also includes: step Sy6f: the security monitoring client uses the instruction public key certificate CMD CERT to verify the legitimacy of the signature of the trusted control instruction and compares the random number in the trusted control instruction. If the signature of the trusted control instruction is illegal or the random number in the trusted control instruction is inconsistent, the execution of the security protection method is terminated; if the signature of the trusted control instruction is legal and the random number in the trusted control instruction is consistent, step Sy6g is executed; step Sy6g: the security monitoring client confirms the execution of the trusted control instruction and returns the execution result to the security monitoring server; step Sy6h: the security monitoring server uses the terminal fingerprint public key certificate TF CERT to verify whether the signature of the execution result is legal. If the verification is legal, an instruction to disconnect the communication connection is sent to the security monitoring client; if the verification is illegal, step Sy6h is repeated within a preset time period.

[0027] In order to solve the above technical problems, the present application also proposes a computer-readable medium storing computer program code, which implements the above security protection method for terminal devices when executed by a processor.

[0028] The technical solution of the present application can protect the fingerprint integrity of commercial IoT devices. By setting up a terminal trusted platform, the fingerprint information of the terminal device can be stored and generated (the fingerprint information can be used as an unalterable characteristic identifier). The terminal trusted root module can provide each terminal device with a unique and unmodifiable device fingerprint certificate, effectively preventing the terminal device from being illegally tampered with; the terminal trusted root module of the present application is equivalent to a trusted computing module. Running and storing core security programs and sensitive data in the trusted execution environment TEE of the trusted computing module can effectively resist various attacks. The trusted computing module greatly enhances the security and stability of the system by securely storing terminal fingerprints and fingerprint keys, and providing secure computing functions; by setting up a security monitoring service module, the security monitoring client can monitor the terminal device in a timely manner. Once an abnormality is found, it can automatically issue an alarm signal and take emergency measures for the terminal device in a timely manner, which can effectively protect the information integrity of the terminal device and the security of user data.

[0029] This application can strengthen the security monitoring and alarm functions of terminal devices by setting up a cloud-based trusted platform, a cloud-based trusted root module, and establishing a terminal security monitoring cloud service. The terminal trusted root module and cloud-based trusted root module of this application can be considered equivalent to a trusted computing module. Running and storing core security programs and sensitive data in the trusted computing module can effectively resist various attacks. By setting up a security monitoring service module, the security monitoring server can receive and compare the heartbeat data sent by the security monitoring client in real time. Once an abnormality is found, it will automatically issue an alarm signal, so that the cloud-based trusted platform can issue trusted control instructions in a timely manner to control the terminal device. This application also strengthens the local security monitoring function of the terminal device and the cloud-based security monitoring function of the terminal device.

[0030] This application provides a complete security protection system for terminal devices. The terminal devices can be directly monitored locally based on the security protection system, or they can be monitored in the cloud, so that they can quickly and accurately identify whether the terminal devices have been illegally tampered with. This application adopts a cryptographic design, and assists in determining whether the terminal devices have been tampered with by issuing certificates, verifying certificates, and other means; it adopts cryptographic-based identity authentication and data encryption technology, combined with the high security of the underlying trusted computing module, and accurately identifies whether the terminal devices have been illegally tampered with through the terminal trusted platform, the cloud trusted platform, and the security monitoring service module, thereby improving the efficiency of information tampering identification and the security and security protection effect of the terminal devices.

[0031] Summary of the Figures

[0032] In order to make the above-mentioned objects, features and advantages of the present application more clearly understood, the specific embodiments of the present application are described in detail below with reference to the accompanying drawings, wherein:

[0033] FIG1 is a schematic diagram of a security protection system for a terminal device according to an embodiment of the present application;

[0034] FIG2 is a schematic diagram of a security monitoring client in an embodiment of the present application;

[0035] FIG3 is a schematic diagram of a security protection system for a terminal device according to another embodiment of the present application;

[0036] FIG4 is a schematic diagram of a security protection system for a terminal device according to another embodiment of the present application;

[0037] FIG5 is a schematic diagram of the defense mechanism of the security protection system of the terminal device of the present application;

[0038] FIG6 is a schematic diagram of a security protection system for a terminal device according to another embodiment of the present application;

[0039] FIG7 is a flowchart of constructing fingerprint information of a terminal device in one embodiment of the present application;

[0040] 8 is a flowchart of the working stages of production terminal equipment, maintenance terminal equipment, and security protection system in one embodiment of the present application;

[0041] FIG9 is an exemplary flow chart of a security protection method for a terminal device according to an embodiment of the present application;

[0042] 10 is a schematic diagram of a security protection system for a terminal device according to another embodiment of the present application;

[0043] FIG11 is an exemplary flow chart of a security protection method for a terminal device according to yet another embodiment of the present application;

[0044] FIG12 is a flowchart of the interaction between the security monitoring client and the security monitoring server in one embodiment of the present application.

[0045] Preferred embodiments of the present invention

[0046] In order to make the above-mentioned objectives, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are described in detail below with reference to the accompanying drawings.

[0047] In the following description, many specific details are set forth to facilitate a full understanding of the present application. However, the present application may also be implemented in other ways different from those described herein. Therefore, the present application is not limited to the specific embodiments disclosed below.

[0048] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0049] Flowcharts are used in this application to illustrate the operations performed by systems according to embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the various steps may be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0050] The present application proposes a security protection system for terminal devices, which can provide security protection for terminal devices in commercial Internet of Things scenarios (such as smart financial POS machines, Android cash registers, etc.). For example, the security protection system of the entire terminal device can be set in the terminal device; or the terminal trusted platform can be set in the terminal device, and the security monitoring service module can be set in the processor of the computer; or the security monitoring service module can be set in the terminal device and the cloud platform respectively, and this application does not impose any restrictions. In some application scenarios, the cloud trusted platform can be set in the cloud platform, which may include private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, interconnected cloud and multiple clouds, etc. or any combination thereof. Data between terminal devices, cloud platforms, and computers can interact through wireless networks.

[0051] The various modules and components in the security protection system of the terminal device of the present application can be implemented by a computer hardware device composed of a processor and a memory. Specifically, the above-mentioned modules and components are stored in the memory as program units, and the processor executes the program units stored in the memory to realize thread control.

[0052] For explanations of some technical terms in the following text of this application, please refer to Table 1.

[0053] Table 1 Explanation of technical terms in this application

[0054] The security protection system of the terminal device of the present application will be first introduced below, and the security protection method of the terminal device of the present application will be introduced later.

[0055] Figure 1 is a schematic diagram of a security protection system for a terminal device according to an embodiment of the present application. Referring to Figure 1 , the security protection system 100 for the terminal device according to this embodiment includes: a terminal trusted platform 110, including a terminal trusted root module 111, in which the terminal trusted root module 111 stores the fingerprint information 1110 of the terminal device, the terminal fingerprint private key TF KEY, the terminal fingerprint public key certificate TF CERT and the trusted execution environment TEE; the fingerprint information is used to uniquely identify the terminal device; the terminal fingerprint private key TF KEY is used to sign the fingerprint information; the terminal fingerprint public key certificate TF CERT is used to verify the legitimacy of the signature of the fingerprint information; the trusted execution environment TEE is used to provide an isolated data processing environment for the terminal trusted platform 110; a security monitoring service module 130, including a security monitoring client 131 (SecureMonitor Client), and the security monitoring client 131 is used to monitor the terminal trusted root module 111.

[0056] Exemplarily, the core of the security protection system 100 of the terminal device shown in Figure 1 of the present application lies in the terminal trusted root module 111. The terminal trusted root module 111 is implemented based on the bottom layer of the operating system and Flash (Flash EEPROM Memory). Based on the hardware characteristics, the terminal trusted root module 111 can be tamper-proof, thereby effectively protecting the data in the trusted root module. The trusted execution environment TEE of the present application constructs a data security area based on software and hardware (such as Flash), thereby ensuring that the programs and data (such as fingerprint data, certificates, etc.) loaded inside the trusted execution environment TEE are protected in terms of confidentiality and integrity.

[0057] In some embodiments, the terminal fingerprint public key certificate TF CERT is constructed based on an X.509 certificate. For example, some fields of the terminal fingerprint public key certificate TF CERT constructed based on an X.509 digital certificate in this application are shown in Table 2 below:

[0058] Table 2 Partial fields of the terminal fingerprint public key certificate TF CERT

[0059] This application expands the fields of the X.509 digital certificate, as shown in Table 3 below:

[0060] Table 3: Extension fields for X.509 digital certificates in this application

[0061] In some embodiments, a certificate authority (CA) is provided in the Trusted Execution Environment (TEE) to verify the security of data. For example, during the data verification process, the CA can be used to verify the security of the terminal's fingerprint public key certificate (TF CERT). If the verification is unsafe, it indicates that the certificate may have been tampered with, allowing for timely emergency response.

[0062] FIG2 is a schematic diagram of a security monitoring client in an embodiment of the present application. Referring to FIG2 , in some embodiments, the security monitoring client 131 includes an anomaly analysis module 1310, which includes a security verification submodule 1311 and an information local comparison submodule 1312; the security verification submodule 1311 is used to verify the security of the terminal fingerprint public key certificate TF CERT; the information local comparison submodule 1312 is used to compare the consistency between the fingerprint information obtained by the security monitoring client 131 and the fingerprint information in the terminal fingerprint public key certificate TF CERT. For example, the anomaly analysis module 1310 can be set to perform step Sb3 of the security protection method described below, and the security verification submodule 1311 can further be set to perform step Sb3a described below, and the information local comparison submodule 1312 can perform step Sb3b described below. By setting the anomaly analysis module 1310, the present application can effectively detect whether the data of the terminal device (such as fingerprint information, certificate information, etc.) has been tampered with, thereby improving the security of the terminal device.

[0063] Continuing with FIG. 2 , in some embodiments, the security monitoring client 131 periodically calls the anomaly analysis module 1310 at a preset time interval to monitor for anomalies in the terminal device's fingerprint information. For example, the preset time interval can be set to half an hour, one hour, two hours, etc., though this application does not impose any limitations. By regularly calling the anomaly analysis module 1310 to monitor anomalies in the terminal device, relevant anomaly information can be obtained in a timely manner, facilitating timely emergency response and improving the security protection of the terminal device.

[0064] In some embodiments, the terminal trusted platform 110 further includes a secure storage area (not shown) in which the fingerprint information of the terminal device is stored. For example, the secure storage area can be configured as a tamper-proof storage chip (e.g., Flash). By storing the fingerprint information in the secure storage area, the fingerprint information can be guaranteed not to be tampered with, making it easier to subsequently use the correct fingerprint information to verify fingerprint information at risk of being tampered with.

[0065] The technical solution of the present application can protect the fingerprint integrity of commercial IoT devices. By setting up a terminal trusted platform 110, the fingerprint information of the terminal device can be stored and generated (the fingerprint information can be used as an unalterable characteristic identifier). The terminal trusted root module 111 can provide each terminal device with a unique, unmodifiable device fingerprint certificate, effectively preventing the terminal device from being illegally tampered with; the terminal trusted root module 111 of the present application is equivalent to a trusted computing module. Running and storing core security programs and sensitive data in the trusted execution environment TEE of the trusted computing module can effectively resist various attacks. The trusted computing module greatly enhances the security and stability of the system by securely storing terminal fingerprints and fingerprint keys, and providing secure computing functions; by setting up a security monitoring service module 130, the security monitoring client 131 can monitor the terminal device in a timely manner. Once an abnormality is found, it can automatically issue an alarm signal and take emergency measures for the terminal device in a timely manner, which can effectively protect the information integrity of the terminal device and the security of user data. The present application strengthens the local security monitoring function of the terminal device.

[0066] The present application provides a complete security protection system 100 for terminal devices, based on which the terminal devices can directly perform security monitoring locally, thereby being able to quickly and accurately identify whether the terminal devices have been illegally tampered with; the present application adopts a cryptographic design, and assists in determining whether the terminal devices have been tampered with by issuing certificates, verifying certificates, and other means; it adopts cryptographic-based identity authentication and data encryption technology, combined with the high security of the underlying trusted computing module, and accurately identifies whether the terminal devices have been illegally tampered with through the terminal trusted platform 110 and the security monitoring service module 130, thereby improving the efficiency of information tampering identification and the security and security protection effects of the terminal devices.

[0067] FIG3 is a schematic diagram of a security protection system for a terminal device according to another embodiment of the present application. Referring to FIG3 , in some embodiments, the security protection system 100 for the terminal device further includes a cloud-based trusted platform 120, and the cloud-based trusted platform 120 includes a cloud-based trusted root module 121. The cloud-based trusted root module 121 stores a private instruction key CMD KEY, which is used to sign trusted control instructions issued by the cloud-based trusted platform 120. The trusted control instructions are used to control the terminal device. For example, the cloud-based trusted root module 121 and the terminal-based trusted root module 111 of the present application are equivalent to trusted computing modules. In some application scenarios, the present application can detect information tampering of the terminal device through the cooperation of the terminal-based trusted platform 110, the cloud-based trusted platform 120, and the security monitoring service module 130. When it is detected that the information may have been tampered with, the cloud-based trusted platform 120 can issue a trusted control instruction to perform emergency disposal on the terminal device, such as controlling the terminal device to lock the device.

[0068] In some embodiments, the security monitoring service module 130 also includes a security monitoring server 132, which is used to monitor the cloud trusted root module 121 and transmit trusted control instructions to the security monitoring client 131; the terminal trusted root module 111 also stores an instruction public key certificate CMD CERT, which is used to verify the legitimacy of the signature of the trusted control instruction.

[0069] By setting up a cloud-based trusted platform 120 and a cloud-based trusted root module 121, this application can subsequently establish a terminal security monitoring cloud service, which can enhance the cloud-based security monitoring and alarm functions of the terminal device; by setting up a security monitoring service module 130, the security monitoring server 132 can receive and compare the heartbeat data sent by the security monitoring client 131, and automatically issue an alarm signal once an abnormality is found, so that the cloud-based trusted platform 120 can issue trusted control instructions in a timely manner to control the terminal device, which can effectively protect the information integrity of the terminal device and the security of user data.

[0070] FIG4 is a schematic diagram of a security protection system for a terminal device according to another embodiment of the present application. Referring to FIG4 , in some embodiments, the cloud-based trusted platform 120 further includes a terminal fingerprint database 210, in which a terminal fingerprint public key certificate TF CERT is stored. Exemplarily, the terminal fingerprint database 210 can be maintained by performing permission operations and the like through the production tools, maintenance tools, and operation tools of the staff. In some embodiments, the trusted control instruction (such as the trusted control command shown in FIG4 ) includes controlling the terminal device to lock the machine and / or clear the terminal fingerprint private key TF KEY. For example, it can be set to clear part of the TF KEY or all of the TF KEY stored in the terminal trusted root module 111, thereby preventing the client key from being leaked and improving the security of the terminal device.

[0071] Continuing with reference to FIG4 , illustratively, the present application further provides an SE (Secure Element), a secure boot module, and a terminal ID module in the terminal trusted root module 111. The SE is equivalent to a secure subsystem for running a security chip and a program. An encryption machine is also provided in the cloud trusted platform 120. The security monitoring client 131 (SecureMonitor Client) can collect fingerprint information (such as the terminal fingerprint shown in FIG4 ), obtain the terminal trusted service provided by the terminal trusted root module 111, and generate a corresponding trusted terminal report to transmit to the security monitoring server 132 (SecureMonitor Server). The trusted terminal report includes signed terminal fingerprint information. The security monitoring server 132 (SecureMonitor Server) can obtain the cloud trusted service provided by the cloud trusted root module 121, and can compare the existing fingerprint information with the data in the terminal fingerprint database 210 to determine whether exception processing is required; the security monitoring server 132 (SecureMonitor Server) can transmit the trusted control instructions (such as the trusted control commands shown in Figure 4) issued by the cloud trusted platform 120 to the security monitoring client 131 (SecureMonitor Client) to control the terminal device, wherein the trusted control instructions are point-to-point encrypted, have time limits, and are from a trusted source.

[0072] For example, the terminal device security protection system 100 shown in FIG4 also includes a trusted authentication center 220 and a security review service module 230. The trusted authentication center 220 is used to issue a terminal fingerprint public key certificate TF CERT to the terminal trusted platform 110 and a command public key certificate CMD CERT to the cloud trusted platform 120. The security review service module 230 is used to audit system logs and assess system security risks. The trusted authentication center 220 and the security review service module 230 can be used by personnel to maintain the terminal device security protection system 100.

[0073] Figure 5 is a schematic diagram of the defense mechanism of the security protection system for the terminal device of the present application. Referring to Figure 5, the present application can provide a four-layer defense mechanism for terminal feature information (e.g., fingerprint information, firmware, APP, resource package, language package, etc.). First Layer of Defense: The terminal trusted platform can provide terminal security protection, such as local security monitoring and response, authorized device modification control, protection of the terminal's unique key, and a hardware root of trust. This first layer of defense can enhance the terminal's ability to resist attacks. Second Layer of Defense: The cloud-based trusted platform can provide terminal security monitoring cloud services, such as security log analysis, security warning notifications, emergency security response, and business recovery. Upon detecting a terminal anomaly, the second layer of defense can remotely control the terminal to reduce the impact and restore the terminal device to a safe state. Third Layer of Defense: Through regular security reviews by staff (e.g., security log audits and security risk assessments), illegal operations by company internal personnel can be promptly detected. Fourth Layer of Defense: Based on evidence of attacks on terminal devices, external personnel (e.g., hackers) and internal company personnel are held accountable for security issues, such as issuing alarms to deter attackers and reduce potential security threats.

[0074] FIG6 is a schematic diagram of a security protection system for a terminal device according to another embodiment of the present application. Referring to FIG6 , the security protection system 100 for the terminal device shown in FIG6 includes an application layer, a cloud monitoring layer, a terminal protection layer, and supporting tools. For example, the application layer and the supporting tools can provide a visual WEB (World Wide Web) interface (such as the MGT tool shown in FIG6 ). Through the application layer and the supporting tools, users can interact with the cloud monitoring layer and the terminal protection layer. For example, the staff of the terminal device company and the customers using the terminal device can access the data of the private cloud and the public cloud through the application layer, and obtain the data of the cloud monitoring layer through the API (Application Programming Interface); the staff of the terminal device company can produce and repair the information of the terminal device (such as fingerprint information) through the supporting tools, and can issue a digital certificate to the terminal protection layer through the CA (Certificate Authority) in the supporting tools; create, change, and destroy the fingerprint information of the terminal device through the MGT tool; authorize the terminal operation of the terminal protection layer through the terminal operation authorization tool; and transmit signature data to the terminal operation authorization tool through the file signature platform.

[0075] Continuing to refer to FIG6 , illustratively, the terminal protection layer may correspond to the terminal trusted platform 110 and the security monitoring client 131 (SecureMonitor Client) described above. The trusted computing module is capable of managing keys and securely storing data. The trusted computing module is equivalent to the terminal trusted root module 111 described above and will not be described in detail here. The SecureMonitor Client front-end interaction module is capable of generating a terminal fingerprint report based on the terminal fingerprint data and regularly sending the report to the SecureMonitor Server front-end interaction module via end-to-end encrypted communication. The SecureMonitor Client front-end interaction module is capable of transmitting the emergency disposal command sent by the SecureMonitor Server front-end interaction module to the SecureMonitor Client back-end business module, thereby performing emergency disposal on the terminal device. The SecureMonitor Client front-end interaction module is capable of notifying the SecureMonitor Client back-end business module to perform regular local detection. The SecureMonitor Client back-end business module can perform local comparison and anomaly analysis based on the terminal fingerprint data and local information, thereby providing security warnings and emergency disposal when there may be security risks in the terminal device.

[0076] For example, the cloud monitoring layer shown in FIG6 may correspond to the cloud trusted platform 120 and the security monitoring server 132 (SecureMonitor Server) described above. The SecureMonitor Server front-end interaction module can obtain information about the terminal fingerprint database, encryption machine, log system, and local deployment system within the platform support module; the SecureMonitor Server back-end business module can perform terminal fingerprint management, anomaly analysis, security warnings, emergency disposal, post-audit, and other operations on terminal devices; the SecureMonitor Server front-end interaction module can obtain information from the SecureMonitor Server back-end business module, thereby sending emergency disposal commands to the SecureMonitor Client front-end interaction module when a terminal device may have a security risk.

[0077] In some embodiments, the fingerprint information includes one or any combination of device model, device product number, device unique serial number, Flash ID, CPU ID, MAC address, IMEI number, system firmware identification number, and system configuration identification number.

[0078] FIG7 is a flowchart of constructing the fingerprint information of a terminal device in an embodiment of the present application. FIG7 shows the process of establishing fingerprint information when a factory produces a terminal device. Referring to FIG7 , for example, the mother POS is restricted to use in a factory environment, similar to a server with a higher security level. Step 1: The CA administrator performs the mother POS initialization operation based on the mother POS certificate issued by the CA, so that the mother POS generates a device identification fingerprint; Step 2: The NPI (New Product Introduction Engineer) logs in to the existing TCMS system and requests the generation of fingerprint identification resources to deploy the mother POS on the production line; Step 3: The project manager logs in to the TCMS system and approves the request, so that the CA system releases resources (such as certificate fingerprint issuance resources) to the factory mother POS; Step 4: The assembly line worker performs the factory assembly line operation and injects the terminal fingerprint information into the terminal device through the mother POS. The terminal device can obtain the fingerprint information by downloading the fingerprint resource via USB (Universal Serial Bus); Step 5: The assembly line worker batch uploads the terminal fingerprint information to the terminal fingerprint database in the background through the mother POS.

[0079] For example, as shown in FIG4 , the fingerprint information of the present application can be stored in an encrypted manner in the terminal trusted root module 111, for example, in the Flash memory of the TEE and SE. After the terminal device leaves the factory, the terminal trusted root module 111 stores CMD CERT, TF CERT, TF KEY, etc.; the encryption machine in the cloud trusted root module 121 stores CMD KEY; and the terminal fingerprint database 210 of the cloud trusted platform 120 stores TF CERT.

[0080] FIG8 is a flow chart of the working stages of the production terminal equipment, maintenance terminal equipment, and security protection system in an embodiment of the present application. Referring to FIG8 , for example, in the production stage: the factory tool (factorytool) program of the terminal equipment initiates the upload of the terminal fingerprint information. The uploaded terminal fingerprint data needs to be signed with the key in the factory encryption machine; the existing KMS system verifies the legitimacy of the terminal fingerprint data and stores it in the terminal fingerprint database; performs a factory reset operation, such as deleting the factory tool program. In the rework / repair stage: the terminal fingerprint information is deleted using the existing authorization tool (AuthTool). The AuthTool requires an online login account before it can be used. It requires pre-authorization and authentication in the TEE or SE, and records operation logs in the cloud, such as the operator, date, terminal information, etc.; after the terminal device deletes the terminal fingerprint data, the AuthTool initiates the upload of the terminal fingerprint information. The uploaded terminal fingerprint information needs to be signed with the key in the encryption machine; the KMS system stores the terminal fingerprint information.

[0081] Continuing to refer to Figure 8, for example, in the startup and local exception analysis process of the working stage: the terminal fingerprint data is collected by the security monitoring management software (SPManager) program and compared with the backup fingerprint information in the TEE or SE. The comparison process can be the responsibility of the TEE or SE; if the analysis result of the comparison is that there is no abnormality, the entire local exception analysis process is terminated; if the analysis result of the comparison is that the SN (Serial Number) is abnormal, the SN is automatically restored from the backup area of ​​the TEE or SE, and the entire local exception analysis process is terminated; if the analysis result of the comparison is that the model, small model, or FlashID is abnormal, the terminal device is controlled to lock the machine and enter the maintenance and recovery process of the terminal device. After the maintenance phase is completed, the terminal device is unlocked, and the entire local exception analysis process is terminated.

[0082] Continuing to refer to FIG8 , for example, in the 24-hour, cloud-based security monitoring process during the working phase: the SecureMonitor Client of the terminal initiates uploading of heartbeat data, which includes terminal fingerprint data or a summary of terminal fingerprint data; the SecureMonitor Server on the cloud performs an anomaly analysis based on the heartbeat data, such as comparing the terminal fingerprint information in the heartbeat data with the fingerprint information in the terminal fingerprint database; if the analysis result is normal, the entire cloud-based security monitoring process is terminated; if the analysis result is abnormal, such as the model, small model, FlashID, SN, ROM, system configuration, APP, security patch is too low, etc., a security alarm is issued and an alarm grade is given, and graded processing is performed (such as locking the terminal device, displaying a warning, etc.), system recovery and problem accountability processing are performed, and the entire cloud-based security monitoring process is terminated.

[0083] As shown in reference Figure 3, this application sets up a terminal trusted platform 110, a terminal trusted root module 111, a cloud trusted platform 120, a cloud trusted root module 121 and establishes a terminal device security monitoring local service and cloud service. Once an abnormality is detected, an alarm signal is automatically issued and emergency disposal of the terminal device is performed. It can effectively protect the information integrity of the terminal device and the security of user data, and strengthen the security monitoring and alarm functions of the terminal device.

[0084] This application also proposes a security protection system for terminal devices in other embodiments. Figure 10 is a schematic diagram of a security protection system for a terminal device in another embodiment of this application. Referring to Figures 3 and 10, for example, a trusted execution environment (TEE) is set in the security protection system of the terminal device shown in Figure 3, while a trusted execution environment (TEE) is not set in the security protection system of the terminal device shown in Figure 10.

[0085] As shown in FIG10 , the security protection system 100 of the terminal device of this embodiment includes: a terminal trusted platform 110, including a terminal trusted root module 111, in which the terminal trusted root module 111 stores the fingerprint information 1110 of the terminal device, the terminal fingerprint private key TF KEY, the terminal fingerprint public key certificate TF CERT and the instruction public key certificate CMD CERT; the fingerprint information 1110 is used to uniquely identify the terminal device; the terminal fingerprint private key TF KEY is used to sign the fingerprint information; the terminal fingerprint public key certificate TF CERT is used to verify the legitimacy of the signature of the fingerprint information; a cloud trusted platform 120, including a cloud trusted root module 121, in which the instruction private key CMD KEY is stored, the instruction private key CMD KEY is used to sign the trusted control instruction issued by the cloud trusted platform 120; the instruction public key certificate CMD CERT is used to verify the legitimacy of the signature of the trusted control instruction; a security monitoring service module 130, including a security monitoring client 131 (SecureMonitor Client) and a security monitoring server 132 (SecureMonitor Server), the security monitoring client SecureMonitor Client is used to monitor the terminal trusted root module 111 and report the terminal monitoring information to the security monitoring server SecureMonitor Server; the security monitoring server SecureMonitor Server is used to monitor the cloud trusted root module 121 and transmit the trusted control instructions to the security monitoring client SecureMonitor Client, and the trusted control instructions are used to control the terminal device.

[0086] Exemplarily, the core of the security protection system 100 of the terminal device shown in Figure 10 of the present application lies in the terminal trusted root module 111 and the cloud trusted root module 121. The terminal trusted root module 111 and the cloud trusted root module 121 are based on the underlying layer of the operating system and Flash implementation. Based on the hardware characteristics of Flash, the trusted root module can be tamper-proof, thereby effectively protecting the data in the trusted root module.

[0087] Exemplarily, the technical solution shown in Figure 10 of the present application can protect the fingerprint integrity of commercial IoT devices. By setting up a terminal trusted platform 110, the fingerprint information of the terminal device can be stored and generated (the fingerprint information can be used as an unalterable characteristic identifier), and the terminal trusted root module 111 can provide each terminal device with a unique, unmodifiable device fingerprint certificate, effectively preventing the terminal device from being illegally tampered with; by setting up a cloud-based trusted platform 120, a cloud-based trusted root module 121 and establishing a terminal security monitoring cloud service, the security monitoring and alarm functions of the terminal device can be enhanced.

[0088] The terminal trusted root module 111 and the cloud trusted root module 121 of the present application are equivalent to the trusted computing module. Running and storing core security programs and sensitive data in the trusted computing module can effectively resist various attacks. The trusted computing module greatly enhances the security and stability of the system by securely storing terminal fingerprints and fingerprint keys, and providing secure computing functions; by setting up a security monitoring service module 130, the security monitoring server 132 can receive the heartbeat data sent by the security monitoring client 131 in real time and compare it. Once an abnormality is found, an alarm signal will be automatically issued, so that the cloud trusted platform 120 can issue trusted control instructions in time to control the terminal device, which can effectively protect the information integrity of the terminal device and the security of user data.

[0089] The following describes the terminal device security protection method of the present application. The terminal device security protection method uses the terminal device security protection system described above. The terminal device security protection method of the present application can be executed in a computer processor, which controls the terminal device, or the terminal device security protection method can be executed in the terminal device processor. The present application does not limit the operating environment of the terminal device security protection method.

[0090] Exemplarily, the present application designs security protection methods for two types of terminal devices. The security protection method for the first type of terminal devices can use the security protection system of the terminal devices shown in Figure 1, and the security protection method for the second type of terminal devices can use the security protection system of the terminal devices shown in Figure 10.

[0091] The following first introduces the security protection method for the first type of terminal equipment.

[0092] The security protection method for the first type of terminal device of the present application is equivalent to local security monitoring and alarming of the terminal device. For ease of understanding, the security protection method can be considered to be a detailed introduction to the local anomaly analysis process in Figure 8. In actual application, the security protection method of the present application can be set to execute once when the security protection system of the terminal device is started and every hour after startup. Such a setting can continuously detect abnormal conditions of the terminal device, thereby improving the security and security protection effect of the terminal device.

[0093] FIG9 is an exemplary flow chart of a security protection method for a terminal device according to an embodiment of the present application. Referring to FIG9 , the security protection method for a terminal device according to this embodiment includes the following steps:

[0094] Step Sb1: The security monitoring client collects fingerprint information of the terminal device;

[0095] Step Sb2: The security monitoring client sends fingerprint information to the security program of the trusted execution environment TEE;

[0096] Step Sb3: The security program of the Trusted Execution Environment (TEE) verifies whether the fingerprint information is secure. If the fingerprint information is secure, a security value is returned to the security monitoring client, and the execution of the security protection method ends. If the fingerprint information is unsafe, an abnormal value is returned to the security monitoring client, and the execution proceeds to step Sb4.

[0097] Step Sb4: The security monitoring client performs an emergency disposal operation on the terminal device and ends the execution of the security protection method.

[0098] The above steps Sb1 to Sb4 are described in detail below:

[0099] In step Sb1, the secure monitoring client SecureMonitor Client collects fingerprint information of the terminal device. Exemplarily, the fingerprint information collected in step Sb1 may include fields Model, DEV_PN, DEV_SN, DEV_ID, MAC, IMEI, OS_ID, and OS_CFG_ID.

[0100] In step Sb2, the security monitoring client SecureMonitor Client sends fingerprint information to the security program of the trusted execution environment TEE. For example, the security program of the trusted execution environment TEE of this application is the security monitoring trusted application SecureMonitor TA, where TA stands for Trusted Application.

[0101] In step Sb3, the trusted execution environment (TEE)'s security program, SecureMonitor TA, verifies the security of the fingerprint information. If the fingerprint information is secure, it returns a security value to the SecureMonitor Client, terminating the security protection method. If the fingerprint information is unsafe, it returns an exception value to the SecureMonitor Client and proceeds to step Sb4. By way of example, verifying the security of fingerprint information can effectively identify instances of terminal device information tampering, enabling timely emergency response to the terminal device, thereby improving the security and protection effectiveness of the terminal device.

[0102] In some embodiments, in step Sb3, the step of the secure program SecureMonitor TA of the trusted execution environment TEE verifying whether the fingerprint information is secure includes:

[0103] Step Sb3a: The secure monitoring trusted application SecureMonitor TA uses the built-in certificate authority (CA) to verify whether the terminal fingerprint public key certificate TF CERT is secure. If the terminal fingerprint public key certificate TF CERT is not secure, an exception value is returned to the secure monitoring client SecureMonitor Client and the process proceeds to step Sb4. If the terminal fingerprint public key certificate TF CERT is secure, the process proceeds to step Sb3b.

[0104] Step Sb3b: The security monitoring trusted application SecureMonitor TA compares the fingerprint information sent by the security monitoring client SecureMonitor Client with the fingerprint information in the terminal fingerprint public key certificate TF CERT to see if they are consistent. If the comparison is consistent, it means that the fingerprint information is safe; if the comparison is inconsistent, it means that the fingerprint information is unsafe.

[0105] Exemplarily, by verifying the legitimacy of the certificate through step Sb3a and verifying the security of the fingerprint information through step Sb3b, it is possible to accurately identify whether the terminal device information has been tampered with, thereby improving the accuracy of information tampering identification.

[0106] In step Sb4, the security monitoring client SecureMonitor Client performs an emergency response operation on the terminal device, terminating the security protection method. In some embodiments, in step Sb4, the step of the security monitoring client SecureMonitor Client performing an emergency response operation on the terminal device includes the security monitoring client SecureMonitor Client notifying the terminal device to stop operating. Exemplarily, the emergency response operation on the terminal device can also include notifying the terminal device's operating system (OS) to lock the device, clearing some key data from the terminal device, or clearing all key data from the terminal device. Such a configuration can prevent the leakage of customer information and customer keys.

[0107] This application designs a workflow between a terminal trusted platform and a security monitoring service module. The security monitoring client can compare fingerprint information, certificate information, and other data of terminal devices in real time. Once an anomaly is detected, an alarm signal is automatically issued and emergency measures are taken on the terminal device. This application can quickly and accurately identify whether a terminal device has been illegally tampered with, effectively protecting the information integrity of the terminal device and the security of user data, improving the efficiency of information tampering identification and the security and protection of the terminal device.

[0108] The following introduces the security protection method for the second type of terminal equipment.

[0109] The security protection method for the second type of terminal device of the present application is equivalent to cloud service security monitoring and alarming for the local terminal device. For ease of understanding, this security protection method can be considered to be a detailed introduction to the cloud security monitoring process in Figure 8. In actual application, the security protection method of the present application can be set to execute once when the security protection system of the terminal device is started and every 24 hours thereafter. This setting can continuously detect abnormal conditions of the terminal device, thereby improving the security and security protection effect of the terminal device.

[0110] FIG11 is an exemplary flow chart of a security protection method for a terminal device according to another embodiment of the present application. Referring to FIG11 , the security protection method for a terminal device according to this embodiment includes the following steps:

[0111] Step Sy1: The security monitoring client initiates a communication connection to the security monitoring server to establish secure communication;

[0112] Step Sy2: The security monitoring client collects the fingerprint information of the terminal device and sends heartbeat data to the security monitoring server, where the heartbeat data includes the fingerprint information;

[0113] Step Sy3: The security monitoring server verifies whether the signature of the heartbeat data is legal. If the signature is legal, the process proceeds to step Sy4; if the signature is illegal, the process proceeds to step Sy6.

[0114] Step Sy4: The security monitoring server determines whether the parameter calculation value in the heartbeat data has changed. If it is determined that it has not changed, the process proceeds to step Sy5; if it is determined that it has changed, the process proceeds to step Sy6;

[0115] Step Sy5: The security monitoring server sends a command to disconnect the communication connection to the security monitoring client, thereby terminating the execution of the security protection method;

[0116] Step Sy6: The security monitoring server performs emergency disposal operations on the terminal device and sends an instruction to disconnect the communication connection to the security monitoring client, thereby ending the execution of the security protection method.

[0117] The above steps Sy1 to Sy6 are described in detail below:

[0118] In step Sy1, the SecureMonitor Client initiates a communication connection with the SecureMonitor Server to establish secure communication. In some embodiments, in step Sy1, the communication connection includes a TLS (Transport Layer Security) communication connection. After the SecureMonitor Client initiates the communication connection with the SecureMonitor Server, the process also includes: the SecureMonitor Client unilaterally authenticates the legitimacy of the SecureMonitor Server.

[0119] In step Sy2, the SecureMonitor Client collects the terminal device's fingerprint information and sends heartbeat data to the SecureMonitor Server. The heartbeat data includes the fingerprint information. For example, the fingerprint information collected in step Sy2 may include the fields Model, DEV_PN, DEV_SN, DEV_ID, MAC, IMEI, OS_ID, and OS_CFG_ID. The format of the heartbeat data complies with the parameter format specifications in Table 4 below. The Body field in the heartbeat data complies with the heartbeat data Body parameter specifications in Table 5 below for commands and responses.

[0120] In step Sy3, the SecureMonitor Server verifies the validity of the signature of the heartbeat data. If so, the process proceeds to step Sy4; if not, the process proceeds to step Sy6. By way of example, verifying the validity of the signature can effectively identify tampering with the terminal device.

[0121] In some embodiments, the heartbeat data includes a unique serial number SN of the device; in step Sy3, the step of verifying whether the signature of the heartbeat data is legal by the secure monitoring server SecureMonitor Server includes:

[0122] Step Sy3a: The SecureMonitor Server parses the heartbeat data to obtain the device's unique serial number SN, and queries the terminal's fingerprint public key certificate TF CERT from the terminal's fingerprint database based on the device's unique serial number SN.

[0123] Step Sy3b: The SecureMonitor Server uses the terminal fingerprint public key certificate TF CERT to verify the legitimacy of the signature of the heartbeat data.

[0124] In step Sy4, the secure monitoring server SecureMonitor Server determines whether the parameter operation value in the heartbeat data has changed. If it is determined that it has not changed, the process proceeds to step Sy5; if it is determined that it has changed, the process proceeds to step Sy6.

[0125] In some embodiments, the parameter operation value in the heartbeat data is a secure hash algorithm operation value of the fingerprint information; in step Sy4, the step of the secure monitoring server SecureMonitor Server determining whether the parameter operation value in the heartbeat data has changed includes: the secure monitoring server SecureMonitor Server comparing the secure hash algorithm operation value of the fingerprint information in the id_sha field of the heartbeat data with the value in the terminal fingerprint public key certificate TF CERT to see if they are consistent, if they are consistent, it indicates that no change has occurred; if they are inconsistent, it indicates that a change has occurred. Exemplarily, the secure hash algorithm (Secure Hash Algorithm) of the present application uses SHA256, and the digest length of SHA256 is 256 bits, i.e., 32 bytes. The present application does not limit the type of secure hash algorithm.

[0126] In step Sy5, the secure monitoring server SecureMonitor Server sends a communication disconnection instruction to the secure monitoring client SecureMonitor Client, thereby terminating the security protection method. For example, the communication disconnection instruction in step Sy5 conforms to the parameter format specification of Table 4 below.

[0127] In step Sy6, the secure monitoring server SecureMonitor Server performs an emergency operation on the terminal device and sends a disconnection instruction to the secure monitoring client SecureMonitorClient, thereby terminating the security protection method. For example, the disconnection instruction in step Sy6 conforms to the parameter format specification of Table 4 below.

[0128] In some embodiments, in step Sy6, the steps of the secure monitoring server SecureMonitor Server performing an emergency disposal operation on the terminal device include:

[0129] Step Sy6a: The secure monitoring server SecureMonitor Server sends a request instruction to the secure monitoring client SecureMonitor Client to obtain fingerprint information;

[0130] Step Sy6b: The secure monitoring client SecureMonitor Client uses the command public key certificate CMD CERT to verify the validity of the signature of the request command and compares the random number in the request command. If the signature of the request command is invalid or the random number in the request command is inconsistent, the security protection method is terminated. If the signature of the request command is valid and the random number in the request command is consistent, the method proceeds to step Sy6c.

[0131] Step Sy6c: The secure monitoring client SecureMonitor Client sends the fingerprint information to the secure monitoring server SecureMonitor Server;

[0132] Step Sy6d: The SecureMonitor Server uses the terminal fingerprint public key certificate TF CERT to verify whether the signature of the fingerprint information is legal. If the signature is legal, the fingerprint information is stored; if the signature is illegal, the fingerprint information is discarded.

[0133] Step Sy6e: The secure monitoring server SecureMonitor Server sends a trusted control instruction to the secure monitoring client SecureMonitor Client. The trusted control instruction is used to perform emergency disposal on the terminal device.

[0134] For example, the format of the request instruction for obtaining fingerprint information in step Sy6a conforms to the parameter format specifications of Table 4 below, wherein the Body conforms to the Body parameter specifications of the instruction data for obtaining device fingerprint information in the instructions and responses in Table 6 below. The fingerprint information in step Sy6c is equivalent to the response data returned by the secure monitoring client SecureMonitor Client, and the corresponding instruction format conforms to the parameter format specifications of Table 4 below, wherein the Body conforms to the Body parameter specifications of the response data for obtaining device fingerprint information in the instructions and responses in Table 7 below. Table 8 shows the certificate information parameters for obtaining device fingerprint information in the instructions and responses. The trusted control instruction in step Sy6e is equivalent to an emergency disposal instruction, and the instruction format conforms to the parameter format specifications of Table 4 below, wherein the Body conforms to the Body parameter specifications of the instruction data for the emergency disposal instruction in the instructions and responses in Table 9 below. The trusted control instruction in step Sy6e is, for example, to lock the device or clear some key data, thereby preventing the leakage of customer information and customer keys.

[0135] In some embodiments, after step Sy6e, the method further includes:

[0136] Step Sy6f: The secure monitoring client SecureMonitor Client uses the instruction public key certificate CMD CERT to verify the legitimacy of the signature of the trusted control instruction and compares the random number in the trusted control instruction. If the signature of the trusted control instruction is illegal or the random number in the trusted control instruction is inconsistent, the security protection method is terminated. If the signature of the trusted control instruction is legal and the random number in the trusted control instruction is consistent, the method proceeds to step Sy6g.

[0137] Step Sy6g: The secure monitoring client SecureMonitor Client confirms the execution of the trusted control instruction and returns the execution result to the secure monitoring server SecureMonitor Server;

[0138] Step Sy6h: The secure monitoring server SecureMonitor Server uses the terminal fingerprint public key certificate TF CERT to verify whether the signature of the execution result is legal. If the verification is legal, it sends an instruction to the secure monitoring client SecureMonitor Client to disconnect the communication connection; if the verification is illegal, it repeats step Sy6h within a preset time period.

[0139] For example, the execution result of step Sy6g corresponds to the response data from the SecureMonitor Client. The instruction format complies with the parameter format specifications in Table 4 below, and the Body complies with the Body parameter specifications for the response data of the emergency response instruction in Table 10 below. After repeating step Sy6h a certain number of times within a preset time period, a command to disconnect the communication connection can be sent to the SecureMonitor Client. This prevents the repetition of step Sy6h in certain situations, which could consume computing resources and affect system performance.

[0140] The following Tables 4 to 10 describe the data formats for communication between the SecureMonitor Client and the SecureMonitor Server of this application.

[0141] Table 4 Parameter format specifications

[0142] Table 5 Heartbeat data Body parameter specifications in commands and responses

[0143] Table 6 Body parameter specifications for command data in commands and responses to obtain device fingerprint information

[0144] Table 7 Body parameter specifications for response data in commands and responses to obtain device fingerprint information

[0145] Table 8 Certificate information parameters for obtaining device fingerprint information in commands and responses

[0146] Table 9 Body parameter specifications for command data of emergency handling commands in commands and responses

[0147] Table 10 Body parameter specifications for response data of emergency treatment commands in commands and responses

[0148] Here, an embodiment is used to introduce the interaction process between the secure monitoring client SecureMonitor Client and the secure monitoring server SecureMonitor Server in the security protection method of the terminal device of the present application. Figure 12 is a flowchart of the interaction between the secure monitoring client and the secure monitoring server in an embodiment of the present application. Referring to Figure 12, for example, the SecureMonitor Client needs to interact with the SecureMonitor Server every 24 hours; in step S810, the SecureMonitor Client sends a connection request to the SecureMonitor Server to establish a connection, and the connection method includes the TLS one-way authentication method; in step S820, the SecureMonitor Client sends heartbeat data to the SecureMonitor Server, and the SecureMonitor Client waits for instructions; in step S830, the SecureMonitor Server sends instruction data to the SecureMonitor Client; in step S840, the SecureMonitor Client sends response data to the SecureMonitor Server; and in step S850, the SecureMonitor Server sends a disconnection instruction to the SecureMonitor Client.

[0149] This application designs an information interaction process between the security monitoring client and the security monitoring server. The security monitoring server can receive and compare the heartbeat data sent by the security monitoring client in real time. Once an abnormality is found, it will automatically issue an alarm signal, so that the cloud-based trusted platform can issue trusted control instructions in a timely manner to control the terminal device, which can effectively protect the information integrity of the terminal device and the security of user data.

[0150] The present application also includes a computer-readable medium storing computer program code, which, when executed by a processor, implements the security protection method for the terminal device described above.

[0151] When the security protection method of the terminal device is implemented as a computer program, it can also be stored in a computer-readable storage medium as a product. For example, a computer-readable storage medium may include, but is not limited to, magnetic storage devices (e.g., hard disks, floppy disks, magnetic strips), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs)), smart cards, and flash memory devices (e.g., electrically erasable programmable read-only memories (EPROMs), cards, sticks, key drives). In addition, the various storage media described herein can represent one or more devices and / or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media (and / or storage media) that can store, contain, and / or carry code and / or instructions and / or data.

[0152] It should be understood that the embodiments described above are merely illustrative. The embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or any combination thereof. For hardware implementation, the processor may be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, and / or other electronic units designed to perform the functions described herein, or a combination thereof.

[0153] Some aspects of the present application can be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software can be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". The processor can be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors or combinations thereof. In addition, various aspects of the present application may be expressed as computer products located in one or more computer-readable media, which include computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes...), optical disks (e.g., compact disks CDs, digital versatile disks DVDs...), smart cards, and flash memory devices (e.g., cards, sticks, key drives...).

[0154] A computer-readable medium may include a propagated data signal embodying computer program code, for example, in baseband or as part of a carrier wave. The propagated signal may be in a variety of forms, including electromagnetic, optical, etc., or a suitable combination thereof. A computer-readable medium may be any computer-readable medium other than a computer-readable storage medium that can be connected to an instruction execution system, apparatus, or device to communicate, propagate, or transmit the program for use. The program code on the computer-readable medium may be transmitted via any suitable medium, including radio, cable, fiber optic cable, radio frequency signal, or similar medium, or any combination of the above.

[0155] The basic concepts have been described above. It will be apparent to those skilled in the art that the above disclosures are merely examples and do not limit the present application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and revisions to the present application. Such modifications, improvements, and revisions are suggested in the present application and remain within the spirit and scope of the exemplary embodiments of the present application.

[0156] At the same time, this application uses specific terms to describe the embodiments of this application. For example, "one embodiment," "an embodiment," and / or "some embodiments" refer to a certain feature, structure, or characteristic related to at least one embodiment of this application. Therefore, it should be emphasized and noted that "one embodiment," "an embodiment," or "an alternative embodiment" mentioned twice or multiple times in different locations in this specification does not necessarily refer to the same embodiment. In addition, certain features, structures, or characteristics in one or more embodiments of this application may be appropriately combined.

[0157] In some embodiments, numbers are used to describe the quantity of components and attributes. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "about", "approximately" or "substantially" in some examples. Unless otherwise stated, "about", "approximately" or "substantially" indicate that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the description and claims are approximate values, which may change according to the required features of individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of the present application are approximate values, in specific embodiments, the settings of such numerical values ​​are as accurate as possible within the feasible range.

Claims

1. A security protection system for terminal equipment, characterized in that: include: A terminal trusted platform includes a terminal trusted root module, in which the terminal trusted root module stores the fingerprint information of the terminal device, the terminal fingerprint private key TF KEY, the terminal fingerprint public key certificate TF CERT, and the trusted execution environment TEE; the fingerprint information is used to uniquely identify the terminal device; the terminal fingerprint private key TF KEY is used to sign the fingerprint information; the terminal fingerprint public key certificate TF CERT is used to verify the legitimacy of the signature of the fingerprint information; the trusted execution environment TEE is used to provide an isolated data processing environment for the terminal trusted platform; The security monitoring service module includes a security monitoring client, and the security monitoring client is used to monitor the terminal trusted root module.

2. The terminal device security protection system according to claim 1, wherein: The trusted execution environment TEE is provided with a certificate authority CA, which is used to verify the security of data.

3. The terminal device security protection system according to claim 1, wherein: The security monitoring client includes an anomaly analysis module, which includes a security verification submodule and an information local comparison submodule; the security verification submodule is used to verify the security of the terminal fingerprint public key certificate TF CERT; the information local comparison submodule is used to compare the consistency between the fingerprint information obtained by the security monitoring client and the fingerprint information in the terminal fingerprint public key certificate TF CERT.

4. The terminal device security protection system according to claim 3, characterized in that: The security monitoring client periodically calls the anomaly analysis module according to a preset time interval to monitor anomalies in the fingerprint information of the terminal device.

5. The terminal device security protection system according to claim 1, wherein: The terminal trusted platform further includes a secure storage area, in which the fingerprint information of the terminal device is stored.

6. The terminal device security protection system according to claim 1, wherein: The terminal fingerprint public key certificate TF CERT is constructed based on the X.509 certificate.

7. The terminal device security protection system according to claim 1, wherein: The fingerprint information includes one or any combination of device model, device product number, device unique serial number, Flash ID, CPU ID, MAC address, IMEI number, system firmware identification number, and system configuration identification number.

8. The terminal device security protection system according to claim 1, wherein: It also includes a cloud-based trusted platform, which includes a cloud-based trusted root module. The cloud-based trusted root module stores an instruction private key CMD KEY. The instruction private key CMD KEY is used to sign the trusted control instructions issued by the cloud-based trusted platform, and the trusted control instructions are used to control the terminal device.

9. The terminal device security protection system according to claim 8, characterized in that: The security monitoring service module also includes a security monitoring server, which is used to monitor the cloud-based trusted root module and transmit the trusted control instructions to the security monitoring client; the terminal trusted root module also stores an instruction public key certificate CMD CERT, which is used to verify the legitimacy of the signature of the trusted control instruction.

10. The terminal device security protection system according to claim 8, characterized in that: The cloud trusted platform further includes a terminal fingerprint database, in which the terminal fingerprint public key certificate TF CERT is stored.

11. The terminal device security protection system according to claim 8, wherein: The trusted control instruction includes controlling the terminal device to lock the device and / or clearing the terminal fingerprint private key TF KEY.

12. A terminal device security protection method, characterized in that: A security protection system using a terminal device according to any one of claims 1 to 11, comprising: Step Sb1: the security monitoring client collects fingerprint information of the terminal device; Step Sb2: The security monitoring client sends the fingerprint information to the security program of the trusted execution environment TEE; Step Sb3: The security program of the trusted execution environment (TEE) verifies whether the fingerprint information is secure. If the fingerprint information is secure, a security value is returned to the security monitoring client, and the execution of the security protection method ends. If the fingerprint information is unsafe, an abnormal value is returned to the security monitoring client, and the execution proceeds to step Sb4. Step Sb4: the security monitoring client performs an emergency disposal operation on the terminal device, and ends the execution of the security protection method.

13. The terminal device security protection method according to claim 12, wherein: The security program of the trusted execution environment TEE is a security monitoring trusted application TA; In step Sb3, the step of the security program of the trusted execution environment TEE verifying whether the fingerprint information is secure includes: Step Sb3a: The security monitoring trusted application TA uses the built-in certificate authority CA to verify whether the terminal fingerprint public key certificate TF CERT is secure. If the terminal fingerprint public key certificate TF CERT is not secure, an exception value is returned to the security monitoring client and the process proceeds to step Sb4. If the terminal fingerprint public key certificate TF CERT is secure, the process proceeds to step Sb3b. Step Sb3b: The security monitoring trusted application TA compares the fingerprint information sent by the security monitoring client with the fingerprint information in the terminal fingerprint public key certificate TF CERT to see if they are consistent. If the comparison is consistent, it means that the fingerprint information is safe; if the comparison is inconsistent, it means that the fingerprint information is unsafe.

14. The terminal device security protection method according to claim 12, wherein: In the step Sb4, the step of the security monitoring client performing an emergency disposal operation on the terminal device includes: the security monitoring client notifying the terminal device to stop working.

15. A security protection system for a terminal device, characterized in that: include: A terminal trusted platform includes a terminal trusted root module, in which the terminal trusted root module stores the fingerprint information of the terminal device, the terminal fingerprint private key TF KEY, the terminal fingerprint public key certificate TF CERT, and the command public key certificate CMD CERT; the fingerprint information is used to uniquely identify the terminal device; the terminal fingerprint private key TF KEY is used to sign the fingerprint information; and the terminal fingerprint public key certificate TF CERT is used to verify the legitimacy of the signature of the fingerprint information; A cloud-based trusted platform includes a cloud-based trusted root module, wherein the cloud-based trusted root module stores a command private key CMD KEY, which is used to sign trusted control commands issued by the cloud-based trusted platform; and the command public key certificate CMD CERT is used to verify the legitimacy of the signature of the trusted control command. The security monitoring service module includes a security monitoring client and a security monitoring server. The security monitoring client is used to monitor the terminal trusted root module and report the terminal monitoring information to the security monitoring server. The security monitoring server is used to monitor the cloud trusted root module and transmit the trusted control instructions to the security monitoring client. The trusted control instructions are used to control the terminal device.

16. A terminal device security protection method, characterized in that: A security protection system using a terminal device according to any one of claims 9 to 11 or 15, comprising: Step Sy1: The security monitoring client initiates a communication connection to the security monitoring server to establish secure communication; Step Sy2: the security monitoring client collects the fingerprint information of the terminal device and sends heartbeat data to the security monitoring server, where the heartbeat data includes the fingerprint information; Step Sy3: The security monitoring server verifies whether the signature of the heartbeat data is legal. If the signature is legal, the process proceeds to step Sy4; if the signature is illegal, the process proceeds to step Sy6. Step Sy4: The security monitoring server determines whether the parameter calculation value in the heartbeat data has changed. If it is determined that it has not changed, the process proceeds to step Sy5; if it is determined that it has changed, the process proceeds to step Sy6; Step Sy5: the security monitoring server sends an instruction to disconnect the communication connection to the security monitoring client, thereby terminating the execution of the security protection method; Step Sy6: The security monitoring server performs an emergency disposal operation on the terminal device and sends an instruction to disconnect the communication connection to the security monitoring client, thereby ending the execution of the security protection method.

17. The terminal device security protection method according to claim 16, wherein: In the step Sy1, the communication connection includes a TLS communication connection; After the step of the security monitoring client initiating a communication connection to the security monitoring server, the method further includes: the security monitoring client unilaterally authenticating the legitimacy of the security monitoring server.

18. The terminal device security protection method according to claim 16, wherein: The heartbeat data includes the device's unique serial number SN; In step Sy3, the step of the security monitoring server verifying whether the signature of the heartbeat data is legal includes: The security monitoring server parses the heartbeat data to obtain the unique serial number SN of the device, and queries the terminal fingerprint public key certificate TF CERT from the terminal fingerprint database according to the unique serial number SN of the device; The security monitoring server verifies the legitimacy of the signature of the heartbeat data using the terminal fingerprint public key certificate TF CERT.

19. The terminal device security protection method according to claim 18, wherein: The parameter operation value in the heartbeat data is the secure hash algorithm operation value of the fingerprint information; In step Sy4, the step of the security monitoring server determining whether the parameter calculation value in the heartbeat data has changed includes: The security monitoring server compares the secure hash algorithm operation value of the fingerprint information with the value in the terminal fingerprint public key certificate TF CERT to see if they are consistent. If they are consistent, it means that no change has occurred; if they are inconsistent, it means that a change has occurred.

20. The terminal device security protection method according to claim 18 or 19, characterized in that: In step Sy6, the step of the security monitoring server performing an emergency disposal operation on the terminal device includes: Step Sy6a: the security monitoring server sends a request instruction to the security monitoring client to obtain the fingerprint information; Step Sy6b: The security monitoring client verifies the legitimacy of the signature of the request instruction using the instruction public key certificate CMD CERT and compares the random number in the request instruction. If the signature of the request instruction is illegal or the random number in the request instruction is inconsistent, the security protection method is terminated; if the signature of the request instruction is legal and the random number in the request instruction is consistent, the method proceeds to step Sy6c. Step Sy6c: the security monitoring client sends the fingerprint information to the security monitoring server; Step Sy6d: The security monitoring server verifies whether the signature of the fingerprint information is legal using the terminal fingerprint public key certificate TF CERT. If the signature is legal, the fingerprint information is stored; if the signature is illegal, the fingerprint information is discarded. Step Sy6e: The security monitoring server sends a trusted control instruction to the security monitoring client, where the trusted control instruction is used to perform emergency disposal on the terminal device.

21. The terminal device security protection method according to claim 20, wherein: After step Sy6e, the method further includes: Step Sy6f: The security monitoring client verifies the legitimacy of the signature of the trusted control instruction using the instruction public key certificate CMD CERT and compares the random number in the trusted control instruction. If the signature of the trusted control instruction is illegal or the random number in the trusted control instruction is inconsistent, the security protection method is terminated; if the signature of the trusted control instruction is legal and the random number in the trusted control instruction is consistent, the method proceeds to step Sy6g. Step Sy6g: The security monitoring client confirms the execution of the trusted control instruction and returns the execution result to the security monitoring server; Step Sy6h: The security monitoring server uses the terminal fingerprint public key certificate TF CERT to verify whether the signature of the execution result is legal. If the verification is legal, an instruction to disconnect the communication connection is sent to the security monitoring client; if the verification is illegal, step Sy6h is repeated within a preset time period.

22. A computer readable medium storing computer program code, characterized in that: When executed by a processor, the computer program code implements the security protection method for a terminal device as described in any one of claims 12 to 14 or any one of claims 16 to 21.

Images